Corporate Crisis Response: What One More Quarter of Delay Costs

Why a crisis response is designed on the wrong clock

Every crisis playbook addresses the news cycle, because the news cycle is what everybody can see. It runs in hours. The clock that decides the bill runs in quarters, starts at a document inside your own company, and is usually already running when the war room convenes.

So the room argues about the statement and the remediation budget. Both matter less than they feel. The question that sets the cost is how long the company has known, and what each further quarter of not acting adds.

The four costs, and which of them grow

Remediation is the figure the room argues about, and it is the only one of the four that delay does not move. The other three grow with the gap. At some quarter the expected penalty passes what the fix would have cost. That quarter is the crossing, and after it the argument that the fix is too expensive is no longer true on the company's own arithmetic.

Find the date: the gap starts at a document you already hold

Toyota's sticky-pedal case shows where the date sits. The Justice Department's statement of facts says Toyota was investigating the pedal in the U.S. by August 2009 and reproduced the problem by September 2009, then told regulators and Congress it first learned of it in October 2009.

Toyota's false date was built to make a 90-day reporting window appear to have been met. NHTSA demanded the maximum $16.375 million civil penalty from Toyota in April 2010 for more than four months of failure to notify, and in March 2014 Toyota agreed to a $1.2 billion penalty under a Deferred Prosecution Agreement.

Merck's date was a letter. In September 2001 the FDA sent Merck a warning letter about promotion that discounted the cardiovascular findings of its VIGOR study of Vioxx. Merck changed the label in April 2002 and kept selling, then withdrew Vioxx worldwide on September 30, 2004, after more than 80 million people had taken it.

Merck's bill came afterward: a fixed $4.85 billion fund for heart-attack and stroke claims in 2007, $950 million to resolve Justice Department marketing allegations in 2011, and $830 million to settle an investor class action in 2016.

Facebook's date was two years old when it mattered. The SEC alleged that Facebook had known for two years that Cambridge Analytica had misused the data of roughly 57 million users, while its filings told investors that user data "may be" improperly accessed. In July 2019 the FTC fined Facebook $5 billion and the SEC added $100 million.

Three breaches, three intervals

The penalty scales with the interval rather than with the harm, and a data breach is where the interval is easiest to see, because the discovery date is usually on record. Three breaches show three different intervals between knowing and telling.

Uber learned of a breach in November 2016, paid the hackers $100,000 to delete what they had taken, and dressed the payment up as a routine bug-bounty reward. Uber disclosed the breach a full year later, in November 2017. In September 2018 Uber agreed to pay a record $148 million to settle with all 50 states and the District of Columbia, and in May 2023 Uber's former security chief was sentenced to three years' probation and a $50,000 fine.

Equifax found its breach on July 29, 2017 and told the public 40 days later, on September 7, after it had worked out what had happened. Equifax's chief executive retired that month, and in July 2019 Equifax entered a global settlement with the CFPB, the FTC and 48 states providing up to $700 million.

Capital One confirmed its intrusion on July 19, 2019 and announced it on July 29, with roughly 106 million people affected. The $80 million penalty the OCC assessed on Capital One in August 2020 was for risk-governance failures from before the bank moved to the cloud, not for the disclosure.

The amounts are not comparable, and three cases prove nothing about rates. They do show what was examined: in Uber's case the year of concealment itself, and in Capital One's case not the ten-day disclosure but an older governance failure.

The narrow fix: what a quiet settlement buys

3M paid $9.1 million in July 2018 to resolve False Claims Act allegations over its Combat Arms earplugs, with no admission of liability. The settlement carried neither disclosure nor remediation, so it did not close the claims from users. 3M put its Aearo unit into bankruptcy with a proposed $1 billion trust in July 2022, a judge dismissed that case in June 2023 because Aearo was financially healthy, and in August 2023 3M announced a $6.0 billion earplug settlement.

Volkswagen confirmed its diesel defeat device to regulators on September 3, 2015, and its board assessed the fallout as "controllable and comparable to past cases that had been resolved amicably." German prosecutors later alleged that Volkswagen's chief executive had known since May 2015. In January 2017 Volkswagen agreed to plead guilty to three felony counts and pay $4.3 billion to U.S. authorities. By July 2020 Volkswagen had repaid more than $9.5 billion to U.S. car buyers, and more than 86% of claimants chose a buyback or lease termination over a fix. By mid-2020 the scandal had cost Volkswagen more than 30 billion euros, about $33 billion.

Nothing in that tells the company what to disclose. It tells the company what the deferral costs, which it did not know, and it puts that figure beside the remediation number the room has been repeating.

The second halt: answering the reaction instead of the substance

The second way a response fails is by treating the coverage as the crisis. It shapes a statement, contests a number or defends a procedure, and leaves the substance where it was.

In April 2010 the U.S. Coast Guard, in consultation with BP, told the public that the Deepwater Horizon well was leaking around 1,000 barrels a day. The government's Flow Rate Technical Group later put BP's peak flow at roughly 62,000 barrels a day. In November 2012 BP pleaded guilty to 11 felony manslaughter counts and obstruction of Congress and agreed to about $4.5 billion in criminal penalties, and in April 2016 a judge approved a $20.8 billion civil settlement with BP.

United's first statement after a passenger was dragged off Flight 3411 apologized for having to "re-accommodate these customers" and called the episode upsetting. A fuller apology came the next day. United shares fell as much as 4.3% on April 11, 2017, and on April 27 United announced ten policy changes, including raising maximum compensation for an involuntary bump to $10,000.

Samsung announced a global recall of the Galaxy Note 7 on September 2, 2016 without first notifying the CPSC, and its mobile chief described the cause as "a tiny problem in the manufacturing process." Overheating reports followed in the replacement phones, and by October 13 the CPSC had expanded the Samsung recall to roughly 1.9 million U.S. devices. By mid-January 2017 Samsung reported that 97% of Note 7s had been returned in the U.S.

Norsk Hydro is the short-gap case. Hit by ransomware on March 19, 2019, Norsk Hydro isolated its plants, said the same day what had happened, refused to pay the ransom and held daily press conferences. Norsk Hydro's estimate of the first-half cost still rose from $41m to roughly $64-75m. A short gap does not make a crisis cheap; it keeps the interval out of the bill.

What these cases show

Each case is drawn from the Stratrix case library and checked against the filings and reporting listed under Sources. The last column says what each one does not establish.

Running the decision

What this method cannot tell you

The case set is selected on enforcement rather than on conduct. These intervals are documented because a regulator, a prosecutor or a court compelled the file, and the companies that closed a gap quietly and early leave no record. The cases support recognizing a mechanism. They cannot support a rate, and this page claims no probability of enforcement and no penalty multiplier.

It also cannot tell you what you are obliged to disclose. That is a legal question with a legal answer. What the method gives you is the cost of the interval, in a form a board can act on while the interval is still open.

Questions