How to Develop a Crisis Communication Plan
A step-by-step framework for preparing your organization to communicate effectively during any crisis, protecting your reputation and maintaining stakeholder trust.
Every organization will face a crisis at some point. Whether it's a product recall, data breach, executive misconduct, natural disaster, or social media controversy, how you communicate during these critical moments can determine whether your organization emerges stronger or suffers lasting damage.
A crisis communication plan isn't something you create during a crisis—it's a comprehensive framework developed in advance that guides your response when stakes are highest. Organizations with solid plans respond 40% faster and experience 60% less reputational damage than those caught unprepared.
This guide walks you through building a crisis communication plan that covers identification, response protocols, stakeholder management, and post-crisis evaluation. By the end, you'll have a actionable framework ready to deploy when you need it most.
What You'll Learn
- How to identify and categorize potential crisis scenarios for your organization
- Building a crisis response team with clear roles and responsibilities
- Creating holding statements and message templates for rapid deployment
- Establishing communication protocols for different stakeholder groups
- Setting up monitoring systems to detect emerging crises early
- Conducting crisis simulations to test and improve your plan
Before You Start
- Access to organizational leadership for stakeholder mapping
- Understanding of your organization's key audiences and channels
- Contact information for key internal and external stakeholders
- Basic knowledge of your industry's regulatory requirements
Step-by-Step Guide
Conduct a Crisis Vulnerability Audit
Before you can plan for crises, you need to identify what crises are most likely to affect your organization. Start by gathering your leadership team and key department heads for a vulnerability assessment session.
Create a list of potential crisis scenarios across categories: operational (product failures, service outages), reputational (executive misconduct, negative press), financial (data breaches, fraud), natural (disasters, pandemics), and technological (cyberattacks, system failures).
For each scenario, assess both likelihood (1-5 scale) and potential impact (1-5 scale). Multiply these to create a priority score. Focus your planning on high-likelihood, high-impact scenarios first.
Document industry-specific risks. A healthcare company needs plans for patient data breaches, while a food manufacturer needs product contamination protocols. Review past crises in your industry for patterns.
Look at what crises your competitors have faced in the past 5 years. Their experiences often predict your future vulnerabilities.
Establish Your Crisis Response Team
Your crisis response team (CRT) should include representatives from communications, legal, operations, HR, and executive leadership. Each member needs clearly defined roles that activate immediately when a crisis is declared.
Designate a Crisis Team Leader (usually the CCO or VP of Communications) who has authority to make rapid decisions. Include a primary and backup spokesperson—typically your CEO for major crises, with a senior communications leader as backup.
Define the chain of command and decision-making authority at different crisis severity levels. Level 1 (minor) might require only department-head approval, while Level 3 (major) requires CEO and board notification.
Create a contact tree with multiple ways to reach each team member—mobile, home, personal email. Test this quarterly. Include out-of-hours protocols since crises don't respect business hours.
Include someone from IT on your crisis team. In today's environment, nearly every crisis has a digital component requiring technical expertise.
Map Your Stakeholders and Channels
List all stakeholder groups who need communication during a crisis: employees, customers, investors, media, regulators, partners, suppliers, and the general public. Prioritize them based on who's most affected and who has most influence.
For each stakeholder group, document their primary concerns during a crisis and the best channels to reach them. Employees need internal communications first (email, intranet, all-hands). Media needs a press page and direct PR contact. Customers may need social media responses and website updates.
Create a RACI matrix showing who is Responsible, Accountable, Consulted, and Informed for communications to each stakeholder group. This prevents confusion about who communicates what to whom.
Pre-establish relationships with key journalists covering your industry. During a crisis, known relationships allow for more productive conversations and fairer coverage.
Your employees are your most important audience. If they hear bad news from outside sources before internal communication, you've lost credibility.
Develop Holding Statements and Message Templates
Create "holding statements" for your most likely crisis scenarios. These are initial responses that acknowledge the situation without committing to details you may not have confirmed. They buy you time while gathering facts.
A good holding statement follows this formula: Acknowledge the situation, Express concern for affected parties, Commit to action ("We are investigating and will provide updates"), and Provide a timeline for more information.
Develop message templates for each stakeholder group and scenario. These aren't scripts to read verbatim—they're frameworks ensuring your key messages are consistent across all communications.
Pre-approve core messaging with legal counsel. During a crisis, legal review delays can be devastating. Having pre-approved language for likely scenarios accelerates response time significantly.
Never say "no comment." It implies guilt. Instead use: "We're gathering information and will share updates as they become available."
Build Your Monitoring and Detection System
Set up comprehensive media monitoring covering traditional news, social media, review sites, and industry forums. Use tools like Meltwater, Cision, or Brandwatch to track mentions of your organization, executives, and products.
Create alert thresholds that trigger escalation. A single negative tweet might not warrant CEO attention, but a trending hashtag criticizing your company requires immediate response. Define these thresholds clearly.
Monitor competitor crises too. Industry-wide issues often spread—a product safety concern at one company can quickly become industry scrutiny affecting all players.
Establish a daily monitoring report and a rapid-alert system for emerging issues. The earlier you catch a brewing crisis, the more options you have to respond effectively.
Set up Google Alerts as a free backup to paid monitoring tools. Include common misspellings of your company name.
Create Response Protocols and Escalation Procedures
Document step-by-step response protocols for each crisis category. Within 15 minutes: notify crisis team, begin fact-gathering. Within 1 hour: post holding statement, notify key stakeholders. Within 4 hours: provide substantive update.
Define crisis severity levels with specific criteria. Level 1: Localized issue with limited stakeholder impact. Level 2: Regional or significant customer impact. Level 3: National attention or major business threat. Each level triggers different response protocols.
Create decision trees for common scenarios. If [X happens], then [take these actions]. This removes ambiguity when people are stressed and time is critical.
Include protocols for after-hours and holiday scenarios. Crises often emerge when key leaders are traveling or unavailable. Backup authorities and communication chains must be crystal clear.
The first 60 minutes of a crisis are called the "Golden Hour." Your response in this window shapes the entire trajectory of the crisis.
Prepare Your Digital Crisis Infrastructure
Create a "dark site"—a pre-built crisis response website or webpage that can go live within minutes. Include your holding statement, FAQ section, contact information, and update timeline. Keep it ready but unpublished.
Pre-draft social media response templates and have them approved. During a crisis, you may need to respond on Twitter, Facebook, LinkedIn, and Instagram simultaneously with consistent messaging.
Set up a dedicated crisis email address and phone line that can be staffed during emergencies. Ensure these have adequate capacity for potential volume spikes.
Prepare a crisis FAQ document for customer service teams. They'll be on the front lines fielding questions and need consistent, approved responses.
Test your dark site quarterly by publishing it briefly on a non-indexed URL. Technical issues discovered during a real crisis are costly.
Train Your Team and Conduct Simulations
Conduct crisis communication training for all response team members. Cover media interview techniques, social media response protocols, and stakeholder communication best practices.
Run tabletop exercises quarterly where you simulate a crisis scenario. Walk through your response protocols, identify gaps, and refine procedures. Include realistic time pressure.
Conduct at least one full-scale crisis drill annually. This should involve actual communications (marked as drills) to test systems, timing, and team coordination under pressure.
After each drill, hold a debrief session to capture lessons learned. Update your plan based on what worked and what didn't. Crisis plans should be living documents that improve continuously.
Invite external crisis communications experts to observe your drills. Fresh eyes often spot vulnerabilities your team has become blind to.
Document Post-Crisis Protocols
Your plan should include procedures for after the acute crisis phase ends. This includes reputation recovery communications, stakeholder follow-up, and long-term narrative management.
Create a post-crisis review template covering: What happened? How did we respond? What worked? What failed? What changes are needed? This institutional learning prevents repeating mistakes.
Plan for ongoing stakeholder communication after a crisis. Affected customers, concerned employees, and watchful media need to see follow-through on your commitments. Build this into your protocols.
Include procedures for updating and archiving crisis materials. Holding statements used in one crisis become case studies for future planning.
Schedule your post-crisis review within 2 weeks of resolution. Wait longer and memories fade, lessons get lost, and urgency for improvement disappears.
Common Mistakes to Avoid
Waiting until a crisis to develop your plan
Treat crisis planning as ongoing risk management. Develop your plan during calm periods when you can think strategically. Update it quarterly and after any industry crisis.
Creating a plan that sits unused on a shelf
Conduct regular training and drills to keep the plan fresh in team members' minds. Store it digitally where it's accessible from anywhere, not just in office binders.
Having only one spokesperson trained for media
Train at least 3 people as potential spokespeople. Your primary choice may be unavailable, traveling, or even the subject of the crisis. Backup is essential.
Ignoring social media in your crisis protocols
Social media is often where crises break first and spread fastest. Your plan must include social monitoring, response protocols, and escalation procedures specific to each platform.
Prioritizing legal protection over transparent communication
While legal review is important, over-lawyered responses that avoid accountability damage trust. Work with legal to find messaging that's both compliant and human.
Related Resources
Related Services
Frequently Asked Questions
How long should a crisis communication plan be?
How often should we update our crisis communication plan?
Who should have access to the crisis communication plan?
What's the difference between a crisis and an issue?
Should we hire a crisis PR agency before a crisis happens?
How do we handle a crisis that's not our fault?
What should we do if our CEO is involved in the crisis?
How do we measure crisis communication effectiveness?
Should employees be allowed to post about a crisis on social media?
What's the biggest mistake companies make during crises?
Need Expert Help?
Sometimes DIY isn't enough. Let our experts handle the heavy lifting while you focus on what you do best.