September 10, 2026
By: W. Scott Cole
When a college or university faces a crisis, controversy, or public inquiry, its legal position and public voice should align. Public pressure may tempt institutions to make decisions and communicate information before all facts are known, creating legal risks for the institution. Failure to communicate effectively and transparently with its constituencies can harm the institution more than potential legal action. In this environment, the general counsel's most valuable contribution is not merely advising on legal strategy but creating a disciplined structure for sound decision-making under pressure and helping leaders communicate with accuracy, empathy, and institutional credibility.
Crisis Readiness Is a Governance Function
Institutions often treat crisis readiness as simply having a communications plan, an emergency-management manual, or a contact list. Those tools are necessary, but they do not resolve the governance questions that become decisive when the institution is under pressure: Who has authority to act? Who must be informed? Who may speak? When and how should the board become involved? How will legal advice, operational response, and public messaging be coordinated? What happens when the president, board chair, communications team, and subject-matter experts do not agree?
A resilient institution prepares to answer these questions before the crisis. Crisis preparation is not intended to predict every scenario. It is designed to establish a flexible decision architecture that can be used for a variety of scenarios, including cybersecurity incidents, campus protests, public health emergencies, leadership controversies, serious safety events, financial irregularities, athletics matters, research disputes, and governmental inquiries. The general counsel is well-positioned to design that architecture because the counsel’s daily interactions with all areas of the university allow them to see the larger picture of where authority, risk, process, communication, and public accountability intersect.
Developing a concise crisis plan can help identify when a true crisis has occurred, who should be on the crisis team, and who must be “kept in the loop,” including the board, the board chair, elected officials, law enforcement, or outside advisors. The plan should align with governing documents, delegations of authority, collective bargaining obligations, existing emergency plans, insurance requirements, and applicable open-meeting or public records laws. The plan should be short enough to use in real time and specific enough to prevent uncertainty about who is responsible for the next decision.
Readiness also requires practice. Tabletop exercises reveal weaknesses that written plans may not identify. They show whether leaders understand escalation thresholds, whether the board expects to approve matters that management believes are delegated, whether the institution has the capability to preserve records across personal devices and messaging platforms, and whether legal and communications teams can effectively work together. A useful exercise creates time pressure and disagreement, then requires the group to decide who acts, who speaks, what is preserved, and when the next update will occur. The best plan is not the longest plan; it is the plan leaders can effectively use.
The First Hours: Structure Before Speed
Most avoidable crisis errors occur during the first 24 to 72 hours. Facts are incomplete, leaders are stressed, social media accelerates rumors, and stakeholders demand certainty. There is often pressure to issue a definitive statement before the institution has a reliable chronology. The general counsel's first task is to lower the temperature without delaying necessary action. That begins with determining whether the matter is truly a crisis or a serious issue that can be managed through ordinary processes. Over-escalation can create unnecessary stress and disruption; under-escalation can lead to bad decisions, inconsistent messaging, or preventable harm.
The initial assessment should consider legal exposure, safety, operational continuity, reputational harm, and governance significance. Counsel should ask what happened, what remains unknown, who may be affected, what is already public, what evidence must be preserved, what decisions cannot wait, and which external notices may be required. This is where the crisis plan’s team composition question gets answered in practice: the institution should identify one operational owner, one senior decision-maker, one communications lead, and one legal lead. Other functions should be added only when their expertise or authority is needed. A small team can expand; a sprawling team rarely contracts.
At the first crisis team meeting, counsel should help separate verified facts from allegations, discourage early assumptions about motive or responsibility, and distinguish between legal issues and political or reputational issues. Each will have an impact on decision-making, but should be separated as they may affect the institution in different ways. It is critically important to avoid adopting an early narrative before the evidence supports it, or face having to “change the story” and lose credibility.
The crisis team should maintain a chronology of key events, a decision log, and a communications log. The chronology should record what was learned, from whom, and when. The decision log should identify what was decided, the basis for the decision, who participated, and who approved. The communications log should show what each audience member was told and by whom. These records help the institution avoid shifting narratives during the crisis and reconstruct its actions in the event of litigation, regulatory review, audits, board or system review, or public records requests.
During the first 24 hours, counsel should brief the president and board chair, map key audiences, decide whether a holding statement is necessary, and determine whether outside experts are needed. Over the next two or three days, the institution should formalize the investigation and governance process, align board and presidential communications, and test every draft against factual, legal, privacy, employment, and records constraints. During the following week, leadership should identify initial corrective measures and ensure the legal and operational teams have sufficient staffing.
The Institution Is the Client
A crisis can raise issues for counsel as to who is the client. The general counsel must return to the foundational principle that counsel represents the institution, acting through its authorized constituents. That principle should be explained early, before personal and institutional interests become conflated.
Counsel should identify who is authorized to act for the institution on the particular issue, clarify the scope of representation, and address material conflicts promptly. If the president, board chair, trustee, or other individual faces personal exposure or has interests materially adverse to the institution, separate counsel may be appropriate. Separate counsel is not necessarily evidence of wrongdoing. It may simply be the best way to ensure each participant receives candid advice while preserving the general counsel's ability to advise the institution.
The distinction between governance and management also becomes critical. The board exercises oversight. The president and administration manage operations. However, these roles may change in a crisis. The general counsel can advise each on how to stay within their appropriate role in light of the circumstances. When the crisis involves the president, the board may need to assume operational control, appoint a special committee, or authorize an independent investigation. When the crisis involves a board member, that member may need to recuse themself from board decisions and seek independent counsel.
From Legal Review to Institutional Voice
Legal and communications teams should collaborate from the beginning, not sequentially. Communications professionals should not develop a nearly final statement and then ask counsel to approve it, and counsel should not insist on a legally safe message that lacks empathy, clarity, or institutional voice. The strongest work occurs when legal and communications professionals agree at the outset on the objective, known facts, legal constraints, intended audience, messenger, and timing, and that collaboration should account for media inquiries, not only internal or stakeholder-facing messaging.
Before communicating, the crisis team should ask why the institution needs to speak now; what is verified and what remains allegation, rumor, or preliminary assessment; what is legally permitted or required to be disclosed; who is the right messenger; which reporters or media outlets are already asking questions; and what is the immediate objective. The objective may be reassurance, safety, process integrity, regulatory compliance, correction of misinformation, leadership support, political necessity, or some combination of those goals. The answer determines both the content and tone of the communication.
A disciplined statement usually acknowledges the event, expresses appropriate empathy, identifies current action, explains the process governing next steps, describes what cannot yet be shared, and, when possible, states when another update will be provided. This structure allows the institution to communicate without pretending that preliminary information is complete. The language should be truthful, minimal, and objective. Labels such as misconduct, harassment, fraud, criminal conduct, policy violation, or termination for cause can create defamation, due-process, contractual, labor, insurance, or investigative consequences if used before the relevant facts are known or due process is complete. Counsel should distinguish allegations from findings and avoid adjectives that imply conclusions not yet supported by verified facts.
Counsel should also resist scapegoating: publicly sacrificing one person may satisfy immediate outrage, but it can create legal exposure weighed in the initial assessment and obscure institutional weaknesses that require correction. A credible response should address individual accountability when established, while also confronting deficiencies in process, controls, safety, culture, supervision, or remediation. It should also remain defensible when read months later in a complaint, deposition, audit, legislative hearing, accreditation review, or insurance dispute.
Finally, the messenger should be chosen deliberately. The most senior leader is not always the best spokesperson. A president may be the right voice for reassurance or institutional values, but is not always the right voice for technical detail, an active law-enforcement matter, or a controversy in which the president is personally implicated. A board chair, provost, chief information officer, campus safety official, medical expert, athletics leader, or communications professional may carry greater credibility and less of the reputational risk weighed in the initial assessment. When the president or board is itself under attack, the institution should separate legitimate institutional response from the individual’s personal defense, and hold to the same truthful, minimal, objective standard rather than mounting an aggressive rebuttal built on facts still under review.
Stakeholders, Privilege, and the Record
Different stakeholders ask different questions. The board may want to know every detail of how the crisis happened and how it is being investigated. The president will want to maintain operational control but may be required to accept more intense oversight, typically from the board chair. Students and faculty often seek reassurance. Employees want to understand operational impact. Donors and bondholders want stability. Regulators and accreditors want disclosure and compliance. Government officials may demand immediate answers before the institution has completed its review.
The crisis team should map the principal audiences, the objective of each communication, the channel and timing, against the messenger and decision-maker already assigned, and the next expected update. The president and board chair should understand their role, be consistent in messaging, and have the same understanding of which questions should be deferred. Frequent communication does not require substantive disclosure on every occasion. Sometimes the correct update is to confirm process, safety measures, available resources, and timing. Counsel should encourage leaders to promise process rather than outcomes and should resist promises that an investigation will be quick, confidential, independent, or exculpatory unless the institution can responsibly make and keep those commitments.
Attorney-client privilege is essential because leaders need a protected environment in which to seek candid legal advice, but a distinction should be made between oral and written advice. Work-product privilege may be limited in certain states, like Florida, unless there is actual or imminent litigation. In these states, sensitive legal discussions should be oral, limited to legal advice, and made only with participants who need the information for that purpose.
Participants should also understand that underlying facts are not privileged merely because they are conveyed to or through a lawyer. Drafts, texts, chat messages, personal devices, informal trustee communications, and consultant records may later be discoverable or subject to public-records laws. Early communications should therefore be accurate, restrained, and written with future audiences in mind.
Preservation should begin promptly when litigation, an administrative complaint, a legislative or congressional inquiry, a significant audit, or a major records request is reasonably anticipated. Counsel should identify relevant custodians, systems, devices, messaging platforms, security logs, surveillance, physical evidence, and third-party records. Investigation strategy, privilege strategy, and communications strategy must be coordinated so that a public statement does not prejudge the outcome, undermine an investigation, waive a position, or create an expectation the institution cannot meet. Leaders who will testify, meet with regulators, appear before a board, or face hostile questioning should be prepared to answer what they know, acknowledge what they do not know, avoid speculation, distinguish personal from institutional interests, and return to verified facts, institutional values, and concrete actions.
Hiring Outside Support
Outside support may be warranted when the matter attracts sustained or national attention, involves board or presidential exposure, creates a conflict or appearance concern, requires independent fact-finding, presents specialized regulatory or technical issues, or exceeds the institution's capacity. The decision to retain outside advisors should be made early enough for the advisor to shape the process rather than merely react to decisions already made. Before engagement, the general counsel should define the role of the advisor, whether the need is legal analysis, investigation, forensics, crisis communications, labor advice, legislative strategy, or subject-matter expertise. Counsel should determine who retains the advisor, what information may be shared, how the work supports legal advice, who manages and approves the work, how the advisor coordinates with internal teams, and how the institution will describe the advisor's role if asked.
Independence should be real rather than rhetorical. If an investigation is described as independent, the scope, reporting line, access to information, and authority to reach conclusions should support that description. The institution should also establish an exit plan addressing work-product custody, privilege decisions, retention, and transition back to internal responsibility.
After the Crisis: Converting Experience Into Resilience
The crisis is not over when the headlines fade. The institution may still face litigation, records requests, regulatory follow-up, employee relations issues, donor questions, accreditation concerns, or governance consequences. The general counsel should ensure that the chronology, decision record, communications log, investigation materials, approvals, and remedial actions are finalized and preserved. Counsel should also verify that outstanding notice, insurance, contractual, records, and reporting obligations have been completed.
An after-action review should occur while the experience is fresh. It should examine whether escalation occurred at the right time; whether the correct people were included; whether authority was clear; whether facts moved too slowly or statements moved too quickly; whether board and management roles remained distinct; whether privilege and records were handled as intended; whether outside advisors were effectively integrated; and whether the legal team had adequate staffing. The purpose is not to assign blame. It is to identify where the institution's operating system failed under pressure and to improve the process for the next crisis.
Conclusion
A credible crisis response protects more than the institution's immediate legal position. It protects the legitimacy of institutional governance, the ability of leaders to make difficult decisions, and the trust on which colleges and universities depend.
The general counsel plays a critical role in building the institution's crisis operating system before it is needed and then assists leaders in using that system when stress is at its highest. By clarifying authority, structuring the flow of facts, coordinating legal and communications strategy, protecting appropriate confidentiality, preserving a defensible decision record, and ensuring the institution learns after the event, the general counsel can help move the institution from reaction to credible leadership. The time to build that architecture is now, not after the next crisis arrives. The institutions best positioned to lead through it will be those that already answered these governance questions.
Questions?
Contact GrayRobinson Shareholder and Higher Education Team Leader Scott Cole or a member of the Higher Education Team.