Identifying and understanding key trends in litigation is an important step for organisations seeking to understand their litigation risk exposure and ensure that they are litigation ready.
In this note, Scott Crabb offers his observations on this important topic. Scott is a seasoned litigator with over 35 years’ experience in assisting clients in managing litigation risk, responding to crises and resolving disputes.
Evolution of regulatory risk
Key message: The changing regulatory landscape continues to create fresh challenges and risks.
Unsurprisingly, regulated risk was traditionally centred on heavily regulated sectors of the economy or areas such as financial reporting, competition law, and workplace and safety. However, that has changed over time with developments in the way business is conducted.
For some time, cybersecurity and data privacy have been hot topics for regulators, particularly where personal information, financial records, health data or critical systems are affected. It has become critical for organisations to be able to demonstrate active oversight of privacy and cyber-risk, not only within the organisation, but also in respect of third parties such as managed service providers and supply chain partners.
AI represents a new frontier. Use of AI tools has introduced vulnerabilities and added additional complexity in the areas of privacy, data sovereignty and cybersecurity. AI is also predicted to increase the frequency and complexity of cyberattacks through activities such as AI-generated phishing attacks, deepfake impersonation fraud and automated exploitation of cyber vulnerabilities.
AI-influenced decision-making, reliance on AI-generated content and AI-enabled services or products will each increase compliance challenges in areas that are already under scrutiny from regulators, and lead to a more intense focus on governance frameworks relating to the use of AI. At present, in many organisations, governance frameworks have failed to keep pace with AI use.
Even in areas of traditional regulatory focus, litigation risk continues to evolve. For instance, in the workplace, change has come in the form of culture-related investigations and legal claims about bullying, harassment, executive misconduct and psychosocial hazards.
Claims of this nature are often of intense media interest. The result is that culture has come to be seen as an important governance rather than simply an HR issue.
Another example is the recent regulatory focus by the Australian Securities & Investments Commission (ASIC) on marketing statements in the environmental, social and governance (ESG) space on topics such as:
Carbon-neutral representations
Sustainability commitments
Environmental disclosures
Ethical sourcing claims
Social responsibility statements
Proactive regulators
Key message: Regulatory enforcement activity is increasing and executive accountability is becoming a focus.
ASIC’s recent focus on ESG claims is an illustration of another trend.
Across a number of sectors, regulators are adopting a more proactive stance and are seeking to actively detect risk rather than simply respond to misconduct.
For instance, ASIC recently restated its commitment to “strong, visible and active enforcement”, supported by a significant increase in investigations and legal proceedings.
Similarly, the Office of the Australian Information Commissioner has signalled an increased willingness to seek higher penalties for serious privacy breaches and to pursue civil proceedings alongside regulatory action, particularly in response to large-scale data incidents.
Of particular interest to directors and senior executives, regulators and litigation funders are also focusing on personal accountability. This is resulting in directors and senior executives being challenged on whether they exercised appropriate judgment, diligence and supervision before a problem arose.
Questions they might face in the wake of a crisis include:
Did you personally understand key risks and receive adequate information and updates on them?
Did you ensure that the organisation had adequate risk and governance frameworks?
Did you ensure that response plans had been tested?
Did you ensure that management received adequate oversight?
While directors and senior executives are not expected to prevent every problem, they are now being expected to demonstrate active oversight of foreseeable risks.
Technological change
Key message: Technological change is leading to the creation of new types of litigation risk and dramatically increasing the stakes.
Privacy breaches or cyberattacks were once considered IT issues that did not warrant the attention of senior management or the board. However, that all changed once it became clear that a privacy breach or cyber event could trigger a cascade of legal, regulatory, financial, operational and reputational consequences.
The outcome is that privacy and cyber-risk are issues needing demonstrated board oversight.
Use of AI tools is generating new forms of litigation risk. For instance:
AI tools create privacy and copyright challenges, especially regarding how models are trained and who owns AIgenerated output
AI tools may generate hallucinations or material that is both misleading and actionable
Decisions influenced by AI can be expected to be examined closely in legal disputes, particularly in high-risk areas such as procurement and contracting, HR decisions, regulatory compliance and reporting, customer outcomes, and health and safety
AI-related records are increasing the range of potentially relevant evidence and the discovery burden
AI tools also have the potential to undermine legal professional privilege
There is also widespread concern about AI-related products and services leading to regulatory action or litigation, especially as the ASIC and the Australian Competition and Consumer Commission have signalled that AI-related conduct is a priority.
Snowball effect
Key message: Individual incidents are triggering enterprise crises.
Individual incidents are continuing to trigger regulatory inquiries and investigations. Regulators are particularly motivated to act where there is a risk of harm to consumers, investors, markets, public safety or the environment, or where there have been complaints or whistleblower reports. However, these criteria are not essential or present in all cases.
In turn, regulatory inquiries are frequently leading to broader litigation such as:
Shareholder actions
Customer claims
Contractual disputes
Class actions
Director liability allegations
Through this cascading series of events, organisations are rapidly finding themselves in a position where they are required to manage a multifront crisis with competing demands.
Compounding these problems, social media and continuous news cycles mean that disputes can become public crises that are the subject of intense media scrutiny. Organisations without properly coordinated litigation and communications strategies are losing control over the narrative and suffering reputational damage.
Growing focus on preparedness
Key message: Litigation is increasingly focusing on preparedness and what organisations did before an incident or problem emerged.
There is an increasing focus on the steps taken by organisations to identify and manage foreseeable risks, particularly in regulatory investigations and shareholder claims. This is sometimes described as a shift from outcome to process. For instance, where an organisation has suffered a cyberattack, the focus may shift away from the fact that a cyberattack occurred to whether the organisation was adequately prepared for it.
Regulators and class action funders are increasingly directing their attention to the quality of governance. In this context, there is often intense focus on executive decision-making, governance effectiveness, and risk management frameworks and systems.
Focus points include risk reviews and board awareness of emerging risks, reporting lines, adequacy of scenario and stress testing, incident response planning and whether decision-making is adequately documented.
A corollary is that records that allow an after-the-event assessment of the effectiveness of organisational oversight – such as board papers, minutes, risk reports and management presentations – are frequently becoming core evidence when an organisation faces a crisis.
Adequacy of response is critical
Key message: A point of increasing focus is how effectively an organisation responds to an incident or compliance failure. Organisations are being judged on:
How quickly and effectively incidents are being identified, escalated and investigated
The quality of the investigation
The timeliness and adequacy of the proposed remedial response
The level of transparency in communications with regulators and the public
Demands on organisations managing a multifront crisis can be acute. Mistakes made when gathering facts, preserving evidence and engaging with regulators and the media can be costly.
Organisations with inadequate preparation, resourcing or execution of incident response or crisis action plans are finding themselves badly exposed.
It remains the case that an inadequate response can influence enforcement and litigation outcomes and cause severe reputational damage, loss of customer trust, and reduced brand and market value. On occasion, an organisation’s response can aggravate the problem and cause more damage than the original problem itself.
Economic stress
Key message: Litigation risk is tied to economic conditions.
It is a trite point, but when economic conditions deteriorate:
Customers delay payment
Suppliers seek price increases
Projects are delayed or cancelled
Contracts become uneconomic
Businesses look for ways to exit arrangements
Disputes that tend to arise include:
Supply chain disputes
Breach of contract claims
Payment disputes
Exercise of termination rights
Force majeure claims
Variation and price adjustment claims
Financial stress frequently generates fraud risk and insolvency-related litigation.
Tougher economic conditions also often lead to increased scrutiny on boards and senior executives as to the adequacy of their oversight and response to deteriorating conditions.
In short, litigation risk will increase if economic conditions continue to deteriorate.
