The Board's Crisis Readiness Agenda 

A company's ability to protect shareholder value through a crisis depends less on the event and more on its preparation.

Crises rarely destroy shareholder value because of the triggering event alone. The impact on value is more closely tied to proper readiness, which yields an optimized response and preservation of value. For boards, crisis readiness should be a core value-protection responsibility, rather than an operational function sitting below the normal agenda and deferred to management.

Independent research found that organizations with stronger crisis management practices, or “recoverers,” lose less than 5 percent of share value following a crisis. “Non-recoverers,” or companies that were unable to recover share value after a crisis, lose more than 11 percent of share value.

Control Risks’ own case-set analysis showed that companies generally recover when boards and management teams identify vulnerabilities before a crisis, then respond quickly to crises with credible leadership, clear communication, and tested succession or continuity plans.

Companies that enter a crisis with unresolved public grievances and negative external narratives, weak escalation mechanisms, or a slow leadership response are more likely to experience prolonged market underperformance or reputational damage.

Control Risks’ research found that when firms prepared and responded well to a crisis, recoverers’ aggregate share value increased 30.92 percent compared to pre-crisis value, while non-recoverers lost 23.76 percent of share value after a crisis.

Control Risks analyzed market responses to crisis events affecting 24 publicly listed companies between 2024 and 2026 across the technology, financial services, manufacturing, retail, and health-care sectors. We found that preparation and response, not the nature of the crisis itself, determined share price impact.

For boards, the practical lesson is that crisis readiness—incorporating horizon scanning, business continuity, succession planning, and post-incident learning—is a core governance responsibility and a direct tool for protecting enterprise value.

How Crisis Preparedness Impacts Share Value

Source: Control Risks

Crisis Management and D&O Coverage

The effectiveness of recovery is built in advance. Management should identify pre-crisis risks early, including unresolved stakeholder grievances, politically sensitive brand positions, governance weaknesses, poor visibility into cross-functional or cascading risk, and negative narratives before they become public controversies. These risks should be presented to the board holistically, rather than separately, through legal, communications, security, investor relations, or human resources channels. Most boards are updated annually unless there is a change in risk posture.

Boards should assess whether their directors and officers (D&O) insurance includes crisis management extensions or access to prearranged crisis response resources. Shareholders increasingly scrutinize not only the triggering event but also whether directors acted promptly, ensured appropriate disclosure, engaged qualified external support, and challenged management’s response. A poorly managed response can become the basis for derivative litigation, regulatory action, or reputational criticism, even when the original incident was outside the board’s direct control.

Prearranged crisis resources, such as crisis advisors, public relations firms, and the establishment of employee assistance programs, can help directors demonstrate oversight and duty of care. When board members can show that they anticipated crisis-response needs, secured access to qualified experts, and used those resources to inform timely decisions, they are better positioned to demonstrate that they exercised reasonable governance in a high-pressure environment.

Preparing for a Crisis

A useful board lens for directors’ role in crisis management is readiness, response, and recovery.

Before a crisis, the board should ensure management understands the company’s most critical activities and their cross-functional dependencies (e.g., physical security, cybersecurity, third-party risk, geopolitical risk, and public and shareholder relations) and funds appropriate training and exercises for personnel with responsibility for crisis management. Directors should also work with executive leadership to connect business continuity planning with crisis management, executive protection, cybersecurity resilience, and succession planning.

During a crisis, the board should be supported by a well-rehearsed notification and escalation process, receive regular updates, ask focused questions that support decision-making without distracting management, and offer relevant subject-matter expertise. After a crisis, the board should require a rigorous post-incident review, ensure corrective actions are tracked, and consider an external, independent review of management’s and the board’s response.

Boards should take the following actions to proactively plan for a crisis:

Preestablish escalation processes. Management and the board should understand and rehearse how and when directors will be notified of a crisis. This includes situations where pre-crisis monitoring reveals a risk that may later become a crisis, such as online threats to executives.

Often, a board escalation matrix is used to identify the types of crises that involve the board and the requisite impact to the business. For example, most boards will be highly involved in issues involving executive malfeasance, cybersecurity incidents, and problems in which the CEO is incapacitated.

Test crisis governance before it’s needed. Boards should confirm that crisis management plans identify key stakeholders, who has the authority to act, how decisions escalate, how and where information flows, who communicates with investors and employees, and how alternate leaders, such as the chief financial officer or chief operating officer, can step in if needed. 

This should be practiced through tabletop exercises that cover a range of potential risks, such as targeted violence against executives, reputational controversy, and political backlash scenarios.

Treat succession planning as a market-stability tool. The board should maintain emergency and long-term succession plans for the CEO and other critical executives.

Require post-incident accountability and learning. Never let a crisis go to waste. In the recovery phase, the board should oversee a disciplined external review of what happened, what signals may have been missed, how decisions were made, and whether corrective actions address the root causes. Communicating corrective action plans in transparent follow-through will rebuild trust for impacted stakeholders, including key clients.

The central question for boards is whether directors have governance discipline and sufficient visibility into crisis preparedness. Boards should also work with management to test response mechanisms, helping ensure that an acute event is managed effectively to protect and sustain company value.

The views expressed in this article are the author's own and do not represent the perspective of NACD.

Control Risks is a NACD partner, providing directors with critical and timely information, and perspectives. Control Risks is a financial supporter of the NACD.