Duty of Care in a Crisis: An Employer's Obligations
- Aug 4
- 6 min read
When a serious incident strikes, an organisation's attention naturally turns to operations, reputation and stakeholders. But its first and most fundamental obligation is to its people. Duty of care, the legal and ethical responsibility an employer holds for the safety and wellbeing of its workforce, does not pause during a crisis. It intensifies, precisely when the organisation is least equipped to think about it.
This article sets out what duty of care means in a crisis context: what employers owe their people before, during and after an incident, where organisations most often fall short, and how to demonstrate that reasonable steps were taken. It is written for boards, executives and the law firms and insurers who advise them, and draws on advisory experience across live incidents. SJ Group International has supported clients through these situations internationally since 2019.
What duty of care actually means
It is a continuous obligation, not a clause that activates when something goes wrong.
Duty of care is the responsibility an organisation holds to take reasonable steps to protect the health, safety and wellbeing of its employees, and often others affected by its activities. It is grounded in law and reinforced by ethical expectation, and it applies continuously, not only in the moment of crisis.
The point that organisations most often miss is that duty of care in a crisis is largely determined before the crisis. The reasonable steps a court, a regulator or the public would expect are the ones taken in advance: assessing foreseeable risks, preparing for them, and ensuring people are supported if the worst happens. An organisation cannot retrofit its duty of care once an incident is underway. The substance of the obligation is built in the calm period beforehand, which is why it belongs inside the wider discipline set out in our complete guide to risk and crisis management.
Before a crisis: the duty to prepare
Foreseeable risk that is left unaddressed is where duty of care most often fails.
The clearest test of duty of care is whether an organisation took reasonable steps to anticipate and prepare for foreseeable harm. That means identifying the risks its people are genuinely exposed to, physical, psychological, travel-related, environmental, and putting proportionate measures in place before an incident, not after.
This is not a counsel of perfection. Organisations are not expected to eliminate all risk. They are expected to act reasonably in the face of risks they could foresee. An employer that sends staff into demanding environments without assessment or support, or that holds a crisis plan it has never tested, is exposed not only to the human consequences of an incident but to the difficult questions that follow it. We look at one specific dimension of this in travel risk management for executives and families, and at the assessment work underpinning it in risk assessment and prevention.
During a crisis: protecting people under pressure
When attention is pulled toward operations and reputation, the duty to people is easiest to neglect.
In a live incident, the pull of competing priorities is intense. Systems need restoring, stakeholders need managing, the narrative needs handling. In that environment, the welfare of the people directly affected, and of the team managing the response, can quietly slip down the agenda. This is exactly when duty of care matters most and is most at risk of being overlooked.
Meeting it during a crisis means keeping the safety and wellbeing of affected people as an explicit priority in decision-making, not an afterthought once the operational picture clears. It means communicating with employees honestly and promptly, because people who are left uninformed during an incident experience that as a failure of care. And it means protecting the responders themselves: crisis response places sustained strain on senior people, and an organisation that burns out its leadership is failing a duty of care to them too, a subject we address directly in C-suite burnout during a crisis.
After a crisis: the duty does not end at recovery
The human consequences of an incident often outlast the operational ones.
Recovery is the most neglected phase of any incident, and duty of care is where that neglect is most costly. When the immediate pressure lifts, organisations want to move on, but the people affected, and those who managed the response, frequently carry the consequences for far longer. The psychological impact in particular tends to surface after the event, not during it.
A serious approach to duty of care extends into recovery: supporting affected employees, recognising and addressing the strain on responders, and managing the residual human, legal and regulatory matters with the same care applied to the incident itself. Done well, this is also where the organisation learns, an honest, blame-free review of how its people were protected is one of the most valuable inputs into the next cycle of preparedness.
Demonstrating reasonable steps
After an incident, an organisation will be judged not on the outcome alone but on what it did.
When a serious incident is examined afterwards, by regulators, courts, insurers or the public, the question is rarely whether harm occurred. It is whether the organisation took reasonable steps to prevent it and to respond appropriately. The ability to answer that question well depends on having done the work and being able to evidence it.
This is one of the underappreciated benefits of structured preparedness: a documented risk assessment, a tested crisis plan, records of training and exercises, and a clear decision log from the incident itself all demonstrate that the organisation acted responsibly. The same logging discipline that helps a crisis team function also creates the record that later shows the duty of care was met. The board's role in assuring this is set out in the five questions every board should be asking about risk.
The board's responsibility
Duty of care is a governance matter that cannot be delegated away.
Ultimate accountability for an organisation's duty of care sits with its leadership and, in a corporate context, its board. Directors can delegate execution. They cannot delegate the responsibility, and a board that treats duty of care as an operational detail rather than a governance priority is exposed in a way it may not appreciate until an incident reveals it.
Effective governance asks the harder questions before they are forced: do we understand the risks our people are genuinely exposed to; have our arrangements to protect them been tested; and would we be able to demonstrate, after an incident, that we took reasonable steps? Boards that have worked through these questions, ideally under the realistic pressure of a simulation, are far better placed than those relying on the assumption that arrangements exist. Our training and preparedness work is built to test exactly that.
Frequently asked questions
Short answers to the questions asked most often about duty of care in a crisis.
What is an employer's duty of care? It is the legal and ethical responsibility to take reasonable steps to protect the health, safety and wellbeing of employees, and often others affected by the organisation's activities. It applies continuously and intensifies during a serious incident.
Does duty of care apply during a crisis? Yes, and it becomes more demanding. The obligation covers preparing for foreseeable harm beforehand, protecting people's safety and wellbeing during the incident, and supporting them through recovery, including the responders managing the event.
How can an organisation demonstrate it met its duty of care? Through evidence of reasonable steps: documented risk assessments, a tested crisis plan, training and exercise records, prompt and honest communication during the incident, and a clear decision log. The test is what the organisation did, not the outcome alone.
Who is accountable for duty of care in an organisation? Ultimate accountability sits with leadership and, in a corporate context, the board. Execution can be delegated, but the responsibility cannot. Boards should treat duty of care as a governance priority, not an operational detail.
About SJ Group International
SJ Group International is a discreet, executive led consultancy supporting clients through security, risk and crisis matters.
SJ Group International advises private clients, family offices, corporates and advisers on security, risk, crisis management and preparedness. The firm is known for calm, senior-level support, discreet delivery, and a practical approach shaped by real-world experience, serving clients internationally since 2019.
If you would like an independent view of whether your organisation would meet its duty of care under pressure, or help building the preparedness that demonstrates it, we will respond promptly and discreetly.