¶¶Òõ¶ÌÊÓƵ

Dr Juliet Bourke  00:02

Sometimes your day as a leader turns completely on its head. It could be business as usual all morning, but then there's a problem. A big one.

00:10

Phone numbers, email addresses, dates of birth, even passport details. A cyber attack against telecommunications giant Optus has compromised the identities of more than 9 million Australians.Ìý

Dr Juliet Bourke  00:25

Next thing you know, you're having to front your customers and the media, like the Optus CEO did in 2022.

00:31

Unfortunately, some unknown actors have managed to access our customers’ information.

Dr Juliet Bourke  00:38

Or, as CEO, you might find yourself with a safety crisis on your hands.Ìý

00:42

$3.6 million that's the price Dreamworld will pay. The theme park’s operators convicted tonight over a series of safety failures contributing to the 2016 Thunder River Rapids ride disaster.

Dr Juliet Bourke  00:54

Or it might be a reputation crisis you're suddenly grappling with.

00:57

Well, Australia is waking up to a major developing story in the cricketing world. Captain Steve Smith has admitted his team deliberately conspired to cheat on the third day of the third test in Cape Town.

Dr Juliet Bourke  01:09

Your company's in crisis, so how do you fix it and keep your brand's reputation intact?

This is The Business Of, a podcast from the University of New South Wales Business School. I'm Dr Juliet Burke, a professor of practice in the school of management and governance. If you ever find yourself sitting across the desk from Sue Cato, you're probably in big, big trouble. Sue Cato, or Cato, as everyone calls her, is one of Australia's leading crisis management experts, someone you call when the proverbial hits the fan.Ìý

So Cato, if I'm a business leader and I get that scary phone call in the middle of the night telling me there's a major crisis going on. What should I do first?

Sue Cato  02:05

You've really got to get into the fact and actually understand what the issue is. Who's actually made the call? Is it your general counsel? Is it your chairman? Is it a safety issue? Has there been an accident? Is it a bullying issue? You know, is it a performance issue? There are so many different angles that can be coming from, so it's really saying, ‘Right? What's my problem? Who do I need to pull together to deal with it?’. It's really good that you're being rung at three o'clock in the morning, you might not think that at the time, but it's a matter of taking a breath and understanding who you have to talk to to understand what you're dealing with.

Dr Juliet Bourke  02:41

And I've heard that preparation for this phone call is almost the secret to getting it right. What's your view on that?

Sue Cato  02:49

People think that you could do 500 different scenarios. Quite frankly, you could do 1000 different scenarios and maybe not map the right one. But what you need to do is actually say, if I do have an issue, who are the people? Are they prepared? Are they the right people? Do you have external advisors in place? And if you do have a crisis management plan, and it's in the bottom drawer, when was the last time someone read it?

Dr Juliet Bourke  03:11

So you mentioned Cato, that people might have thought about it – they developed a plan, but the plans in the bottom drawer. Surely there's a better way of preparing?

Sue Cato  03:21

Well, it's really understanding who in your team and in your external advisors who've got the core skill sets you need. The way to do that is before you have the issue. And quite frankly, sometimes the CEO is not good at managing crises and what happens if your CEO is stuck on a plane somewhere between New York, London, or whoever, and you can't access them? Who's the next in the chain of command? If you do have a problem with your CEO, is your chairman up for speaking? Is the chairman the right person? Or should the chairman be actually running the issue and there should be another spokesperson? It's actually thinking through all of that so that you're ready to go, rather than learning and getting the bruises on the job.

Dr Juliet Bourke  04:01

It sounds like you have an array of people in your crisis management plan, so you've got options.Ìý

Sue Cato  04:09

You do have options, but not all of them are going to be relevant. So for instance, if it's a cyber security issue, that's one specific area, you know. If it's sexual harassment and bullying, that's a different team that you're looking at. If it's a market performance issue or a safety issue, different people. So it's really understanding, when you're actually working out what your real problem is, what does the A team look like? And also understanding that you've, quite frankly, got to have backups, because if you've got something that's going to go for two to three weeks and people are working 24/7, you need to be able to change people out. So you need to have teams available.

Dr Juliet Bourke  04:45

I did hear about a crisis recently in Australia. I was talking to a board member, and it had all been set up – this was the crisis management plan, here are the go-to people – but then when it came to reality, some of those people just went to water. They didn't know that they didn't have that calmness to be able to handle the crisis.

Sue Cato  05:05

Seriously, not everyone should be in a crisis. I remember prepping a major bank executive on one occasion, and within about three seconds I had him swearing at the camera and I literally came out of it and went, ‘He's never to front the media. Ever, ever, ever, ever.’ But that's practice. You know we quite often run scenarios for clients, and it's amazing – everyone thinks they're totally prepared, but the moment when you actually test it you can see the people who should be involved and the people who shouldn't be involved. And seriously some CEOs are absolutely amazing in running a corporation, but you know, quite frankly, they might not be very good people people, but you can only test that when you actually push them.Ìý

Dr Juliet Bourke  05:47

You know, everyone has a strategy until they get punched in the face.Ìý

Sue Cato  05:51

Yeah, and it's true. Unless you've actually been in the fire, you're not going to know how people are going to hold up. And sometimes, you know, I remember watching a really long issue and a person was literally working 24/7 and I could see them getting more and more and more fragile. And what they needed to do if you remember during the whole COVID situation where you'd have the Premier speaking and the Head of Health speaking, a whole different team of people so that they could get subbed out, if you like, and so everyone was kept fresh. And that's very important in crisis management.Ìý

Dr Juliet Bourke  06:26

Cato what about if it's the CEO? What about if the crisis is about the CEO?

Sue Cato  06:30

It happens more often than you think. And the question is, what is the nature of the issue? Is it someone being incredibly unwell or, quite frankly, dying? Is it to do with bullying and sexual harassment? You know, is there a performance issue? Has there been a safety issue somewhere that's involved? It's looking where everyone is getting an entire map – a war game, if you like – of the good, the bad and the ugly, and what's the most urgent issue needing your attention? And, okay, have you got someone managing that? And this comes down to the team, because one person can't do everything, which is why you've got to have trusted, reliable and skilled people who immediately know what their job is and can go in and sing from the same song sheet. And so it's really understanding what you need to deal with. So if you're a publicly listed company and for whatever reason, let's just say you've got a CEO who's suddenly unavailable to the business, and that's material. You know, it's 3am in the morning and the market is trading at 10am, so you've got to get all of this stuff lined up potentially in those hours in that time. So it's really, once again, understanding what the nature is, but the other thing is if it's sexual harassment and bullying or some other matter, it could be that the CEO says, ‘No, I don't agree.’

Dr Juliet Bourke  07:47

Okay, so what do you do then, when there's a fight?

Sue Cato  07:51

That's when the lawyers come in. And for someone like me I'm often in a position where I can say to the CEO ‘You can see the way this is going to end one way or another. Do we want it to drag out, or is it something that we should handle quickly?’. And sometimes the accusations aren't true, and so you've got somebody who's in the middle of this totally distracted from actually doing their job, their entire reputation in question, and what they're being accused of, once you track it down, is it not right. That's always possible in these situations. So once again, it's getting your source of truth. You're getting your facts lined up, so that you can actually make the right call.

Dr Juliet Bourke  08:32

What does that feel like for you? Cato, as the external advisor, getting that call?

Sue Cato  08:36

One of the reasons you're hopefully getting the call is that you've done it once or twice. So it's knowing the questions to ask, getting calmness in the environment – so that rather than people running around, sort of, you know, thinking the sky is falling, just saying to everybody ‘Okay, calm, let's fix it’. And it's really understanding how far it can go as well. It's really critical. There is sometimes that you see people take ages and ages and ages to fix problems when it's pretty obvious what the end game is, and, quite frankly, getting to the end game is about cauterizing the pain, quite frankly, and bringing it to a head and getting it over and done with.Ìý

Dr Juliet Bourke  09:15

Well, it's obvious to you, because this is not your first rodeo. But the person who's in the seat, I imagine them as like a deer in headlights.

Sue Cato  09:22

They can be. Once again, every human being is different and people respond to stimulus, if you like, in different ways. And understanding that about the person before you actually get into the issue is key in understanding how to actually work with them and help them through it.

Dr Juliet Bourke  09:39

And sounds to me when I'm listening to you that you're that cool, calm, independent head, who’s seen it before, who can anticipate where it's going to and then guide people along the path.

Sue Cato  09:55

And it's being prepared to be unpopular. Actually, it's just telling the truth. That's the key thing. I hate to, sort of, ruin the mystique, but it's always actually, quite frankly, based on fact and telling the truth.

Dr Juliet Bourke  10:07

So Cato, You're known for giving great advice, great independent thought. But what about if the person you're giving that advice to doesn't take it seriously? 

Sue Cato  10:15

You can come at that a couple of different ways. One, ultimately the individual will take the advice or not take the advice. That's their call. And the consequences, well, they'll own them and that's fine. But if we're in a situation where not only is a client not wanting our advice, not liking our advice and not taking our advice, we're clearly not the right people. And there’ve been situations where you look at it and you just think ‘You know what? There are people that you're going to enjoy working with and we’ll recommend other people to step in. And that's just respectful.Ìý

Dr Juliet Bourke  10:49

So how do you travel that line then of giving this independent advice to the person who's ultimately paying your bill?

Sue Cato  10:55

This is why external advisors are really important. You can have incredibly skilled people in-house on your team, but sometimes it's pretty career limiting when you've got to tell the CEO or the chairman that they've got an issue and they've got a problem and you need to be able to do that behind closed doors and, you know, if they sack me they sack me. But if you're a person who's got a mortgage and kids and all that kind of stuff, and you do your very best in the most constructive way to see change happen and you can't, some people are in the position that they will quit. But many people just literally, if they're in that environment, they've got to work, they've got to eat, they've got to live, they've got to pay homes, put kids through schools, so an external advisor, that's why we can be most useful.Ìý

Dr Juliet Bourke  11:42

So I imagine there are situations where people in the organisation aren't in agreement – you know, the board might not agree with the CEO, members of the board might not agree with each other. How do you then guide them through that complexity? 

Sue Cato  11:58

You see it all the time, and you've also got different levels of experience – not only in your executive team, but also on your board. You could have some any days where it's their first role or you can have people who've been around way too long and are way too tolerant about things that you know don't meet community expectations now. So they could say, ‘Oh, he's a good bloke, don't worry about it’ or, ‘Okay, she got a bit cross, but that's fine, you know, that's her job’. So it's really, once again, being able to explain to people exactly what the issue is and exactly what the ramifications are given the choices that you're going to make.

Dr Juliet Bourke  12:32

I've heard you say before that sometimes when people are in the middle of a crisis, all they see is the media response to that crisis. And so they direct their attention to the glare of the media, and they forget other stakeholders and that some of those stakeholders are going to be interested in, you know, what the response is for a lot longer than the media.

Sue Cato  12:57

Absolutely true. And the media, quite frankly, is... while sometimes people think the media is creating the problem, the media are responding to a set of circumstances. So for instance, if you are being accused of being, say, opaque and the market doesn't believe what your strategy is, don't shoot the media. Get your strategy clear and be able to tell your story better. You know, if your institutional shareholders are cross with you, they’re cross for a reason. What actually is the reason, and what can you do about fixing it? You know, I've been involved in something very recently where I've said to people, ‘Listen guys, the media are 2% of this. We've got much bigger issues here that we've got to deal with. We'll deal with the media. We'll be as transparent as we can be’, and that, frankly, raises the other point, which is don't say stuff to the media or your stakeholders unless you know it's true. And sometimes people feel this desperate need to fill a void and so they'll go out to the media and or other stakeholders and make an assertion about a situation which is then found out not to be correct. Now, where that gets you is you either didn't know or you've lied, and it's incredibly hard to get trust back.Ìý

Dr Juliet Bourke  14:12

Can you take us back to the Optus scandal? Because I think, you know, that's the one where there were assertions made by Optus that they didn't actually know.

Sue Cato  14:20

I mean, it's played out, and quite frankly, there are plenty of debates about who knew what and who didn't know what, etc. So, you know, there are people inside Optus who believe that what they've said was 100% accurate and obviously there's a major report coming down on it so time will tell. You know, you see people believing that they know what's happened and then you've got the lawyers saying you can't apologise or you can't do this because that's an admission and that will cause other issues. But it's totally fine to say ‘This is what's occurring. We believe X is the cause of it, we don't know. Our first focus is on looking after the people’ or sorting out whatever remedy you can, Which is not an admission, it's a remedy, and then saying, ‘But we're diving into it, and when we know more information, we'll share that with you’.

Dr Juliet Bourke  15:06

That's the first time I've ever heard someone say, you can say back to the media, ‘We don't know’.

Sue Cato  15:12

Well, because it's true. It's the right thing to do.

Dr Juliet Bourke  15:17

Yeah, but I feel like people in a crisis want to behave sort of teflony.

Sue Cato  15:21

And that's when they get into trouble. Often, it's totally fine to say ‘This is occurring. This is what we're doing about it, and you can trust us and we'll come back to when we know more’. You're not leaving a void, you’re actually getting your voice out there. The other issue that people talk about is if you leave a void that other people will make up their own minds about what's going on and fill that void very unhelpfully for you. So if you don't know what's going on but people do want to talk to you, it's about, once again, getting the fact based, knowing what you know, and then dealing with that known truth and then you know as it develops, deal with it.

Dr Juliet Bourke  15:59

Before we continue, let's quickly recap on what happened with the Optus data breach back in 2022. Professor Barney Tan explains:

Professor Barney Tan 16:09

The Optus response to the data breach was deemed to be inadequate – that's the general sentiment surrounding the data breach – because of a number of things. A timely response for crisis communication is essential because, increasingly with social media, it's what the audience expects. It's what you know the public expects. We expect to have real time updates on everything that's occurring thanks to social media. So it's very critical for organisations to get on top of this as soon as they can, right. They took very long to actually acknowledge the breach and actually inform their affected customers. There were actually two additional issues – one of those things was inconsistent messaging. So what the public found was that between what Optus released as their official statements and the information provided by third-party sources, including what the government was putting out, there was a lot of inconsistencies. So this inconsistency actually undermined trusts, which suggests that there's a lack of coordination and control and it fed the perception that Optus, perhaps, was trying to hide certain things. Also, Optus was not perceived to be apologetic. So their initial responses, especially, did not convey any form of accountability or empathy, right, and this was reported by the media. I think having a sincere apology and a statement that is put out there to actually take responsibility for the breach would be key to rebuilding trust. So this perceived lack of empathy in the communication, I think, alienated the affected customers. And also, I guess, what perhaps could be managed better is the fact that they should have provided, I suppose, more specific updates in terms of what they were trying to do to recover from the crisis. What happened with Optus was that their updates were perceived to be rather vague and that just adds to this perception of a lack of transparency among stakeholders, which is obviously what they're expecting if they perceive their interests to be affected.

Dr Juliet Bourke  18:28

One of the biggest problems with crisis management on a broad scale is a learning problem.Ìý

Professor Barney Tan 18:34

Collectively, we actually do not have the opportunity to learn from each instance of a crisis because the fact of the matter is that organisations do not like to share knowledge about their own failures. So without this adequate sharing of information on what happened, collectively we all miss out on the opportunities to learn from one another. And you would see this right? First there was Optus, then it was Medibank, there's just a continuous stream of large Australian corporations that have been hit with data breaches, but there's no or very little data sharing or information sharing across these corporations. Even us here at UNSW Business School, when we approach one of these organisations to ask if we would have the opportunity to study the crisis and perhaps draw lessons learned and create explanations for what happened and how these issues that have erupted can be overcome, we're often told no, because it's confidential and private. And I suppose it's to be expected because organisations don't typically like to talk about failures and perhaps there are also liabilities associated with these incidents as well, but this gives us, I guess, a missed opportunity to perhaps identify weaknesses in approaches and also improve future responses. And, of course, you know, if we are not learning from past mistakes, we are just doomed to repeat them.

Dr Juliet Bourke  20:06

So can you talk us through reputations? What's top of mind when you're thinking about crisis and reputation?

Sue Cato  20:13

Well, keep in mind reputations can be good and bad. What reputation is really all about is people have an expectation of how you'll behave in a certain situation, and it's when people behave in a manner that's not expected, is when you get a dislocation. So if someone you expect them is an absolutely shocking human, drug runner, etc, and suddenly turns into Mother Teresa that's shocking and dislocating. But equally, when you've got somebody who expect the most fabulous performance and integrity and all of that stuff and you find out that, in fact, there's a fatal flaw, that's when reputations get damaged.Ìý

Dr Juliet Bourke 20:52

How do you manage that? 

Sue Cato  20:54

I used to think that some people's reputations could never be rebuilt, but actually, as I'm getting more mature I actually think people can be brought back no matter how bad the situation is. But it depends on being able to embrace what the problem was – acknowledge the issue and be able to give people a reason to believe that it won't happen again.Ìý

Dr Juliet Bourke  21:16

So just come back to in some way, how you handle a crisis is really how your values are on display? 

Sue Cato  21:23

100%. Once again, it comes back to reputation – if you're going out there and saying that you are absolutely committed to, you know, ESG and looking staff first and all of those sorts of things and then you don't actually deliver on that, your reputation, whether you're an individual or a corporation, will be damaged.

Dr Juliet Bourke  21:43

And so for the person who's listening to this thinking, ‘I don't want to be in the glare of the media. I don't want to be dealing with one of those crises’, apart from preparation any other tips for them?

Sue Cato  21:56

I think it's really important to make sure that your organisation is very aware of where problems can come from and be able to actually flag something. So to be able to say, ‘Look bit worried about X, it might go absolutely nowhere, but can we have a look at it?’ So it's an organisation that wants to know what's going on and if you can catch things early often they don't become massive problems. So the ability for proper risk management – smaller and bigger risk management – is really critical to actually keeping a calm life.

Dr Juliet Bourke  22:36

The Business Of podcast is brought to you by the University of New South Wales Business School, produced with Deadset Studios.ÌýTo stay up to date with our latest podcasts as well as the latest insights and thought leadership from the Business School, subscribe to BusinessThink at