Crisis Communication Plan: Build It Before You Need It

A crisis communication plan is a documented framework that tells your organisation who speaks, what they say, and how fast they move when something goes wrong. Without one, you are making those decisions under pressure, with incomplete information, and in public.

That is not a position any brand should be in. The organisations that handle crises well almost never improvise their way through them. They follow a plan they built when the stakes were low enough to think clearly.

I learned this the hard way, not in a boardroom debrief, but in real time. We were deep into a Christmas campaign for Vodafone, one of the best pieces of work the agency had produced that year. We had brought in a Sony A&R consultant to handle the music licensing. Everything looked clean. Then, at the eleventh hour, a rights issue surfaced that made the entire campaign unusable. Not editable, not patchable. Gone. We had to scrap it, go back to zero, create a new concept, get client approval, and deliver on a timeline that should have been impossible. The campaign that ran was good. But the experience of those days left a mark. When something breaks at the worst possible moment, the only thing that saves you is knowing exactly who does what next.

What Is a Crisis Communication Plan Actually For?

Most organisations treat a crisis communication plan as a PR document. It is not. It is an operational document with a PR output. The distinction matters because it changes who owns it, who contributes to it, and how it gets used.

The plan exists to answer four questions before they become urgent. Who is authorised to speak? What can they say without further approval? Who needs to be informed, and in what order? And what does the first 60 minutes look like operationally?

Everything else, the messaging frameworks, the stakeholder maps, the channel strategies, sits downstream of those four questions. If you cannot answer them instantly when a crisis breaks, the rest of the plan is academic.

This is where most plans fall apart. They are thorough on the strategic layer and almost silent on the operational one. They tell you what good crisis communication looks like without telling you who presses send on the first statement at 11pm on a Sunday.

Who Owns the Plan, and Why That Decision Matters

Ownership of a crisis communication plan is contested territory in most organisations. Legal wants to own it. PR wants to own it. The CEO’s office wants final say. HR thinks it should be involved in anything reputational. All of them are right, which is exactly why you need to decide before a crisis who has the casting vote.

In my experience running agencies, the most functional crisis structures put a single person in the decision seat, usually the most senior communications lead, with defined input rights for legal and the executive team. Input rights are not veto rights. That distinction has to be explicit, because under pressure, everyone defaults to wanting more control, and that instinct will slow you down at exactly the wrong moment.

The plan should name that person. It should also name their backup, because crises do not wait for people to return from annual leave. If the plan says “Head of Communications” without naming an individual and a deputy, it is incomplete.

Ownership also determines who keeps the plan current. A crisis communication plan written in 2022 and never updated is a liability. Personnel changes, channel changes, regulatory changes, all of these affect how a plan should operate. Assign a review cadence, twice a year at minimum, and make someone accountable for it.

How to Structure the Plan Itself

There is no universal template that works for every organisation. The right structure depends on your sector, your risk profile, your stakeholder complexity, and the size of your communications team. But there are components that belong in every plan, regardless of context.

Crisis Classification

Not every bad day is a crisis. One of the most useful things a plan can do is define the difference between a Tier 1 incident, a Tier 2 incident, and business-as-usual reputation management. The classification determines the response level, the escalation path, and the speed of action required.

A Tier 1 crisis might be a product recall, a data breach affecting customers, a serious workplace incident, or a senior executive misconduct allegation. A Tier 2 incident might be a negative media story that has limited reach, a social media complaint that is gaining traction, or an operational failure that affects a subset of customers. The response protocols for each should be meaningfully different.

Without a classification system, teams default to treating everything as Tier 1, which is exhausting and counterproductive, or treating Tier 1 events as Tier 2, which is dangerous.

The Response Team

Name the people. Roles are not enough. The plan should list the crisis response team by name, role, direct contact number, and backup contact. It should also define what each person is responsible for during the first hour, the first day, and beyond.

This team should include communications, legal, the relevant operational lead, and executive representation. In larger organisations, you may also need IT, HR, and customer service leads depending on the nature of the crisis. Define who joins the core team for which crisis types.

The Approval Chain

This is the section most plans get wrong. A statement that requires approval from the communications director, the legal team, the CEO, and the board chair before it can be published is not a communications plan. It is a bottleneck dressed up as governance.

The plan should define what can be published without executive approval, what requires one sign-off, and what requires two. For most organisations, an initial holding statement acknowledging awareness of a situation and committing to an update should be publishable with a single sign-off. Anything beyond that warrants more scrutiny.

Pre-approved language for common scenarios is one of the most underused tools in crisis communication. If you operate in a sector where data incidents are a credible risk, you should have a pre-approved initial statement for a data breach sitting in your plan before one happens. The same applies to product safety issues, executive departures, and operational failures. Pre-approved language does not mean pre-fabricated dishonesty. It means having the structural language ready so you are not writing from scratch under pressure.

Stakeholder Maps

Who needs to hear from you, in what order, and through which channel? This is a different question from who the public hears from. Internal stakeholders, employees in particular, should almost always be informed before external audiences. The damage done by employees finding out about a company crisis through news coverage is significant and largely avoidable.

The stakeholder map should cover employees, customers, investors or shareholders if relevant, regulators, media, and partners. For each group, the plan should define the communication channel, the timing relative to public disclosure, and who is responsible for that communication. If your plan only addresses media and social media, it is covering perhaps 40% of the stakeholder picture.

Channel Protocols

Different crises play out differently across channels. A product safety issue may require a direct email to customers, a press release, and a statement on your website. A social media incident may require a response on the specific platform where it originated before it goes anywhere else. A data breach may require regulatory notification through specific channels before any public communication.

The plan should define which channels are used for which crisis types, who manages each channel during a crisis, and what the protocol is for pausing scheduled content. Most brands have content queued across social channels at any given moment. A crisis plan that does not include “pause scheduled content immediately” as a first-hour action is missing something obvious.

If you want a broader view of how communications strategy fits into the wider marketing picture, the PR and Communications hub at The Marketing Juice covers the full landscape, from media relations to reputation management and beyond.

The Spokesperson Question

Who speaks for the organisation in a crisis is one of the highest-stakes decisions in the plan. It is also one of the most frequently defaulted rather than decided.

The default is usually the CEO. Sometimes that is right. For a crisis that strikes at the heart of the organisation’s values or leadership, the CEO should be visible and accountable. But for operational or technical crises, a CEO who cannot speak with authority on the specifics can look worse than a subject matter expert who speaks clearly and credibly.

The spokesperson decision should be made in the plan, not during the crisis. Define who speaks for which crisis type. Define who does not speak under any circumstances. Define whether you use a single spokesperson or multiple, and if multiple, how you ensure message consistency.

Media training is not optional for anyone named in the plan as a potential spokesperson. I have seen capable, intelligent executives fall apart in front of a camera because they had never been in that situation before. The first time your spokesperson faces a hostile interviewer should not be during a live crisis. Run the training. Record it. Watch it back together. It is uncomfortable and entirely necessary.

Speed Versus Accuracy: Getting the Balance Right

There is a persistent belief in communications that the first hour is everything, and that speed is the defining variable. Speed matters. But accuracy matters more. The organisations that have turned manageable crises into defining ones have often done so not by being slow, but by being fast and wrong.

A statement issued quickly that contains a factual error, an underestimation of the problem, or a commitment the organisation cannot keep creates a second crisis on top of the first. Now you are managing the original incident and the credibility problem created by your initial response.

The holding statement exists precisely to solve this problem. A holding statement says: we are aware, we are investigating, we will update you by a specific time. It does not require you to know the full picture. It requires you to acknowledge the situation and commit to a timeline for more information. That is achievable within the first hour in almost any scenario. The detailed response can follow when you actually know what you are dealing with.

The specific time commitment in a holding statement is important and frequently omitted. “We will provide an update as soon as possible” is not a commitment. “We will provide a full update by 3pm today” is. The latter holds you accountable and gives stakeholders a specific expectation to anchor to. It also forces your internal team to work to a deadline, which is useful.

The Internal Communication Problem

Most crisis communication plans are written with an external audience in mind. The internal dimension is treated as secondary, if it is treated at all. This is a significant oversight.

When I was running an agency and we hit a difficult period, the thing that mattered most to the team was not what we said publicly. It was whether they heard from leadership directly, honestly, and before the rumour mill filled the vacuum. The same dynamic applies in any organisation facing a public crisis. Employees who feel informed and respected become advocates. Employees who feel left in the dark become a secondary problem.

The internal communication plan should run parallel to the external one, not behind it. Define what you will tell employees, when, and through which channel. All-hands calls, direct manager briefings, and internal email updates each serve different purposes. The plan should specify which format is used at which stage.

It should also define what employees can and cannot say publicly. In the age of social media, every employee is a potential spokesperson. A well-meaning post from a junior team member that contradicts the official line is not a malicious act, but it is a communications problem. Clear guidance on social media conduct during a crisis, issued before the crisis, is part of the plan.

How to Test a Crisis Communication Plan

A plan that has never been tested has an unknown number of gaps. Testing is not about proving the plan works. It is about finding where it breaks before a real crisis does.

Tabletop exercises are the most common format. A facilitator presents a scenario, walks the team through the first 24 hours, and surfaces the decision points where the plan is unclear, slow, or contradictory. These exercises do not require expensive external consultants, though an external facilitator can be useful for objectivity. They require a realistic scenario, the right people in the room, and a genuine commitment to following the plan rather than just talking about it.

The scenarios you test against should reflect your actual risk profile. A financial services firm should be testing data breach and regulatory action scenarios. A consumer goods brand should be testing product safety and supply chain failure scenarios. A generic crisis scenario is better than nothing, but a sector-specific one is significantly more useful.

Run exercises at least once a year. Run them when significant personnel changes affect the crisis team. Run them when you enter a new market or launch a product that carries new risk. The plan should be a living document, and exercises are the mechanism that keeps it alive.

After each exercise, document what broke. Not in a blame-attribution sense, but in a plan-improvement sense. Every gap identified in an exercise is a gap that will not surprise you when it matters.

The Digital and Social Layer

Social media has changed the tempo of crisis communication more than any other single development. A crisis that would have taken hours to surface through traditional media channels in 2005 can now be trending within minutes. The plan has to account for this.

The social media dimension of a crisis plan should cover: who monitors social channels during a crisis, what the escalation trigger is for social content, how you respond to individual comments versus broader narrative, and what the protocol is for platform-specific issues. A crisis that originates on one platform may need to be addressed on that platform first before broader channels are engaged.

It is also worth understanding how local and trending content surfaces on social platforms, because crises often start local and go national or global quickly. The mechanics of how content spreads matter for understanding where to monitor and where to respond first. Search Engine Land’s coverage of how local trends surface on social platforms gives useful context on the mechanics of how location-based content propagates, which is relevant when a crisis originates in a specific geography.

Dark posts, direct messages, and community groups are also monitoring considerations. A crisis can gain significant momentum in spaces that are not immediately visible to a standard social listening setup. The plan should specify what monitoring tools are in use and what their coverage limitations are.

What Happens After the Crisis

Most crisis communication plans end at resolution. The best ones include a post-crisis phase that covers two things: stakeholder recovery and internal debrief.

Stakeholder recovery is the deliberate work of rebuilding trust with the audiences most affected by the crisis. This is not a single communication. It is a sustained programme of follow-through on commitments made during the crisis, proactive updates on remediation, and in some cases direct outreach to affected individuals or groups. The plan should define what this looks like and who owns it.

The internal debrief is where the plan improves. Within two weeks of a crisis resolution, the crisis team should sit down and work through what happened, what the plan got right, what it got wrong, and what needs to change. This debrief should be documented and the plan should be updated as a direct result. If the debrief happens but the plan does not change, the debrief was a conversation, not an improvement process.

There is also a monitoring period after resolution. Crises have afterlives. Media coverage can resurface. Social conversations can reignite. Regulatory investigations can extend. The plan should define how long post-crisis monitoring continues and what the trigger is for standing it down.

If you are building out your broader communications function alongside your crisis capability, the PR and Communications section of The Marketing Juice covers the strategic and operational dimensions of communications in more depth, from media relations to how communications integrates with wider marketing strategy.

The Common Failures Worth Naming

After two decades in agency leadership, I have seen crisis plans fail in predictable ways. The failures are almost never about the quality of the writing. They are about the gap between the document and the operational reality.

The plan exists only as a PDF that nobody has read. This is more common than it should be. A crisis plan that lives in a shared drive and has not been opened since it was written is not a plan. It is a compliance artefact. Plans need to be briefed, practised, and embedded into the muscle memory of the people who will execute them.

The plan assumes everyone is available. Crises do not respect working hours, annual leave schedules, or the fact that your communications director is at a conference in another time zone. The plan needs backup contacts, backup decision-makers, and protocols for remote activation. If the plan only works when the full team is in the office, it does not work.

The plan is too long to use under pressure. A 60-page crisis communication plan is impressive as a document and useless as a tool. The operational layer of the plan, the who, the what, the when, the how, should be distillable into a one or two-page reference document that can be accessed and acted on quickly. The full plan can contain all the background and context. The reference document is what people actually use when time is short.

The plan does not account for the crisis within the crisis. Some crises generate secondary incidents. A product recall that is handled well can be undermined by a poorly worded customer service response. A data breach that is disclosed appropriately can be compounded by an employee posting speculation on LinkedIn. The plan should include guidance on managing these secondary vectors, not just the primary incident.

The plan treats all media as equivalent. A local trade publication picking up a story is a different situation from a national broadcaster. A single journalist making enquiries is different from a coordinated media investigation. The plan should calibrate the response to the scale and nature of the media attention, not treat all press enquiries as equally urgent.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions