British Airways IT Meltdown - Lessons for Startups

Robert P. Mollen, Counsel at Fried, Frank, Harris, Shriver & Jacobson (London) LLP.

I spent the past weekend dealing with the effects of the British Airways IT system failures (a very stressful end to an otherwise good holiday).

Based on my own experience with corporate crisis management, I have some thoughts on what startups can learn from BA’s situation. This mirrors similar learning from public relations disasters experienced by other corporate incumbents, such as TalkTalk, United Airlines and Yahoo, and recent challenges faced by Theranos, Lending Club and other emerging companies.

None of this is profound, yet I am amazed how frequently the same points come up.

Risk management is not an afterthought

In the social media driven world in which we live in today, your brand and reputation can be damaged or destroyed in a matter of minutes and hours.

Consequently, more than ever, risk management needs to be built into your corporate DNA from the very beginning. You should identify the key risks of your business and rank them in a risk registry, and then address these risks in order of priority at a level appropriate for your level of investment. You also need to keep track of any areas where you have had to take a view, and revisit these areas periodically as you are better funded.

It is tempting to defer spending in areas that do not generate an immediate return, such as system redundancy, cybersecurity, and legal and other compliance. However, the costs of recovering from a disaster in these areas, assuming recovery is possible at all, will far exceed the costs of getting these points right in the first place.

There is also a temptation, in areas that do not immediately contribute to the bottom line, to think that cheaper is better, particularly in areas where you lack the knowledge to assess quality. In my experience, while you frequently don’t get what you pay for, you rarely get what you don’t pay for. A low cost option that is the wrong option can turn out to be very expensive if it exposes you to undue risk or is very expensive to fix.

IT is an area where I frequently see underinvestment. Like British Airways, a number of large corporations have recently suffered disasters in the context of cybersecurity or other IT systems failures.

Honest and prompt communications are critical

When things go wrong, it is critical that you provide prompt and accurate communications to your own staff and agents, customers and the general public. Communications are frequently delayed, or tempered, by a concern that promptness and honesty may increase exposure to legal liability. I recognize that this may be a risk in some circumstances, but it is one that can be managed -- in my experience, the risks of not communicating promptly and honestly are significantly greater.

Because these crises develop so quickly, it is important to have done some pre-planning. Part of this process is to clearly identify, in advance, who will speak for the company in circumstances like these and how you will determine what communications are appropriate.

Another part of this is anticipating areas of risk and considering how you would communicate in similar contexts. British Airways’ response to its IT failures was unforgivably shambolic given that other airlines had experienced similar IT systems failures in the recent past. It seemed extraordinary that BA continued to sell new tickets on their routes while failing to provide an online mechanism for customers to rebook without further payment. Additionally, query as to the support for British Airways’ claim that customers suffering cancelled flights would be automatically rebooked.

Similar criticisms can be levied against corporates that have experienced recent cybersecurity breaches, with loss of credit card and other personal identifying data or loss of data access due to ransom ware. In the world in which we live, there is no excuse for failing to anticipate, and prepare draft communications, for known risks like these.

You need to support your staff

Your people really matter in crisis circumstances. They will be your front line in communicating with customers, and may have to deal with personal abuse or other difficult circumstances. They are not fungible, and their support is critical. Treat your customer service people well, and make them feel part of the team. You also need to enable them to provide appropriate solutions within specified parameters, and consequently should pre-plan and train them for these situations.

Customer goodwill matters

Your customers (and other relevant stakeholders, such as regulators) will be more prepared to accept your failings if they are otherwise happy with the way that you are treating them. Customer dissatisfaction with recent efforts by British Airways to re-position itself to compete with budget airlines, an approach that had already put great strain on the BA brand, meant that there was no reservoir of customer goodwill on which BA could draw in the present circumstances.

Conclusion

You cannot plan for every disaster scenario, and your brand and reputation will always take a hit when things go wrong. However, appropriate risk management and pre-planning can reduce the risk of a disaster, and also put you in a better position to minimize the damage that you suffer.

* * *

This discussion is not intended to provide legal advice, and no legal or business decision should be based on its contents. If you have any questions or comments, feel free to contact [email protected] or via LinkedIn here.

You will find Bob’s other weekly blogs for emerging and growth companies on US issues, international expansion and early stage financing here: http://bit.ly/StartupGuides