Online Crisis Management: What to Do Before You Need It

Online crisis management is the process of identifying, containing, and recovering from reputational threats that emerge in digital channels, before they compound into something that damages the business long-term. The brands that handle it well are rarely the ones with the slickest response teams. They are the ones who did the preparation work when nothing was on fire.

Most organisations treat crisis management as a reactive discipline. They build the plan after the first incident, hire the PR consultant after the headline, and write the holding statement while journalists are already calling. That sequencing is backwards, and it costs more than anyone wants to admit.

Why the First 90 Minutes Define Everything

There is a window at the start of any online crisis where the narrative is still fluid. Social media algorithms are still deciding what to amplify. Journalists are still in the “is this actually a story?” phase. Consumers are still forming their interpretation. That window is roughly 90 minutes, sometimes less. After it closes, you are no longer shaping the story. You are responding to someone else’s version of it.

I have seen this play out from the inside. Years ago, working on a major Christmas campaign for Vodafone, we hit a catastrophic licensing issue at the eleventh hour. A music rights problem that nobody had caught, despite working with a specialist consultant. The campaign had to be abandoned entirely. What I remember most vividly is not the panic of going back to the drawing board, or the pressure of rebuilding a concept under a brutal deadline. It is the speed at which the internal narrative formed. Within hours, people had decided who was responsible, what had gone wrong, and what it meant. The actual facts were still being established. That dynamic, where perception calcifies before information is complete, is exactly what happens in public-facing crises too.

The organisations that manage this window well have usually done one thing differently: they have defined in advance who speaks, what they say, and through which channels. Not the specific words, but the framework. Who is the authorised voice? What is the approval chain for a holding statement? Which platforms get prioritised? These decisions should never be made for the first time during an incident.

What a Crisis Response Infrastructure Actually Looks Like

The phrase “crisis plan” tends to conjure images of thick binders that nobody reads and flowcharts that look impressive in a board presentation. That is not what I mean. Useful crisis infrastructure is lean, specific, and built around the actual decision points that arise when something goes wrong online.

It starts with a threat matrix. Not an exhaustive list of every conceivable scenario, but a structured view of the most plausible risks for your specific business. A consumer brand with a large social following faces different threats than a B2B services firm. A company in a regulated industry has different exposure than a DTC startup. The matrix should map threat type against likelihood and potential severity, and assign a response tier to each combination.

Tier one might be a monitoring alert and internal notification. Tier two adds a holding statement and stakeholder briefing. Tier three triggers a full response protocol with designated spokesperson, prepared media lines, and escalated social monitoring. The specific thresholds matter less than the fact that they are agreed in advance. When something breaks, the question should not be “what do we do?” It should be “which tier is this, and who does what?”

Alongside the threat matrix, you need a contact directory that is actually current. In my agency years, I watched more than one crisis response slow to a crawl because nobody could reach the right legal contact, or the PR lead’s number in the system was three jobs old. Simple problem. Expensive consequence.

For broader thinking on how communications strategy connects to business resilience, the PR & Communications hub at The Marketing Juice covers the full landscape, from reputation management to media relations and beyond.

The Monitoring Problem Most Brands Get Wrong

You cannot manage what you cannot see. That sounds obvious, but the monitoring setups at most organisations are built for marketing intelligence rather than crisis detection. They track brand sentiment in aggregate, flag mentions above a certain volume, and produce weekly reports. That is useful for understanding brand health over time. It is almost useless for catching a crisis in its early stages.

Effective crisis monitoring needs real-time alerts, not daily summaries. It needs to flag unusual spikes in negative sentiment, not just high mention volumes. And it needs to cover the channels where crises actually start, which increasingly means community forums, niche subreddits, and TikTok comment sections, not just Twitter and Facebook. Platform behaviour has shifted significantly in recent years, and how audiences use newer platforms is still evolving in ways that affect where reputational threats emerge first.

The other monitoring gap I see consistently is the absence of dark web and closed community tracking. Most brand listening tools index public content. But some of the most damaging narratives about brands start in private groups, closed forums, and messaging apps before they surface publicly. By the time the public signal appears, the story is already formed. There is no easy fix for this, but being aware of the limitation changes how you calibrate your confidence in what your monitoring is telling you.

One practical improvement: set up a secondary alert layer specifically for employee and executive names. In my experience, crises that start with a senior individual’s statement or behaviour move faster and cut deeper than product or service failures. The personal dimension changes the emotional register of public reaction entirely.

Internal Alignment: The Part Nobody Prepares For

External messaging gets most of the attention in crisis management frameworks. Internal alignment gets almost none. That is a significant blind spot.

When a crisis breaks, your employees are also consumers of information. They are reading the same news, seeing the same social posts, and forming their own views about what happened and how leadership is handling it. If they hear contradictory messages from different parts of the organisation, or if they hear nothing at all and fill the gap with speculation, that internal confusion will surface externally. Through social media posts. Through conversations with customers. Through the way they answer the phone.

I spent several years turning around a loss-making agency, and one of the clearest lessons from that period was how quickly internal uncertainty becomes external signal. Clients could tell when the team was unsettled. Not because anyone said anything they should not have, but because confidence is visible, and so is the absence of it. The same principle applies in a reputational crisis. Staff who feel informed and guided project stability. Staff who feel left in the dark project exactly that.

A crisis communication plan that does not include an internal communications track is half a plan. The internal track does not need to be elaborate. It needs to be fast, honest, and consistent with what is being said externally. If the external message is “we are investigating and will update by end of day,” the internal message should say the same thing, plus whatever additional context is appropriate for employees. The two tracks should never contradict each other.

Holding Statements: What They Should and Should Not Do

A holding statement is not an apology. It is not a denial. It is a signal that you are aware of the situation, taking it seriously, and will provide more information when you have it. Done well, it buys time without conceding ground. Done badly, it either says nothing or says too much.

The most common failure mode is the statement that tries to do everything at once: acknowledge the issue, explain the context, express regret, outline next steps, and reassure stakeholders, all in four sentences. The result is a paragraph that reads as evasive even when it is not, because it is trying to manage too many objectives simultaneously.

A better approach is to separate the functions. The holding statement does one thing: confirms you are aware and are responding. A follow-up statement, issued when you have more information, provides the explanation and next steps. A third communication, once the situation is resolved, closes the loop. This sequencing gives each message a clear purpose and makes the overall response feel more deliberate and less defensive.

The legal instinct here is usually to say as little as possible. That instinct is understandable but often counterproductive in a social media environment. Silence reads as guilt or indifference to an online audience that expects real-time acknowledgement. The calibration is not “say nothing” or “say everything.” It is “say what you can, clearly, and commit to saying more when you can.” That is a position most legal teams can work with if you frame it correctly.

The concept of building trust through consistent, honest communication is something Guy Kawasaki has written about extensively, and the core principle applies directly here: enchantment, or in this context, trust, is built through quality, not quantity of words.

Platform-Specific Response Tactics

Different platforms have different crisis dynamics, and a response that works on LinkedIn will not work on X (formerly Twitter) and will actively backfire on TikTok. Understanding the behavioural norms of each platform is not optional.

On X, speed is everything and brevity is mandatory. Long threads are read by people who are already engaged with the story. The initial response needs to be a single clear statement that can stand alone. Pinning that statement to the top of your profile matters. So does monitoring replies and quote-tweets, because that is where the narrative is being actively shaped by others.

On LinkedIn, the audience is more professional and more patient. A longer, more considered statement is appropriate, and the tone can be more formal. But do not mistake “professional” for “cold.” LinkedIn audiences respond to human acknowledgement of failure or difficulty. Corporate boilerplate reads worse on LinkedIn than almost anywhere else because the audience knows exactly what it is.

TikTok presents a genuinely different challenge. The platform’s algorithm amplifies emotional content, and crisis content on TikTok tends to get remixed, parodied, and recontextualised in ways that are impossible to control. A formal statement dropped into TikTok comments will be ignored or mocked. If the crisis originated on TikTok or is primarily playing out there, a video response from a real person is usually more effective than written copy. Authenticity of format matters as much as authenticity of content.

Facebook and Instagram require attention to community management as much as official statements. Comment sections on brand posts become a focal point for negative sentiment during a crisis, and leaving them unmoderated sends a signal of abandonment. Having a community management protocol that specifies which comments get a response, which get removed, and which get escalated is part of the crisis infrastructure, not an afterthought.

The Recovery Phase: Where Most Plans Stop Too Early

Most crisis plans end at resolution. The immediate threat is contained, the media cycle moves on, and the organisation breathes out. That is the wrong place to stop.

Recovery is a distinct phase with its own requirements. The crisis may be over in terms of active media attention, but the reputational damage is still present in search results, in social media archives, in the memory of customers who saw the original incident. What you do in the weeks and months after the crisis determines whether trust actually rebuilds or simply goes quiet.

Recovery communications should be deliberate, not reactive. This means proactively sharing evidence of the changes you said you would make. It means acknowledging the incident in relevant contexts rather than pretending it did not happen. It means measuring sentiment over time rather than assuming that the absence of negative coverage means positive perception has returned.

I have seen brands make significant operational changes after a crisis and then fail to communicate those changes, assuming the actions would speak for themselves. They rarely do. Audiences do not monitor your internal operations. They respond to what you tell them, and if you tell them nothing, they assume nothing changed. The communication of change is as important as the change itself.

Search visibility is also part of recovery. Crisis coverage tends to rank well because it attracts links and engagement. A deliberate content strategy that builds positive, authoritative content around your brand name can, over time, shift what appears when people search for you. This is not reputation laundering. It is recognising that search results are a persistent record and that you have some agency over what that record contains.

The broader discipline of PR and communications strategy offers frameworks for thinking about long-term reputation management that extend well beyond the immediate crisis window. Recovery is a communications challenge as much as an operational one.

The Simulation Exercise Most Organisations Skip

Writing a crisis plan and testing a crisis plan are different activities. Most organisations do the first and skip the second. That is a significant gap, because crisis response is a perishable skill. If your team has never run a simulation, the first time they execute the plan will be during an actual incident, which is the worst possible time to discover that the approval chain has a bottleneck or that the holding statement template does not fit the most likely scenarios.

A tabletop exercise does not need to be elaborate. A two-hour session with the relevant stakeholders, a realistic scenario, and a facilitator who pushes on the decision points is enough to surface most of the gaps. The scenarios that tend to be most revealing are the ones that involve ambiguity: situations where it is not clear whether something constitutes a crisis, where the facts are still emerging, or where different parts of the organisation have conflicting interests in how the situation is handled.

The Effie Awards process, which I have been involved in as a judge, gives you a particular appreciation for the gap between what brands say they do and what they actually do under pressure. The submissions that describe crisis or reputational challenges and how they were handled reveal, pretty quickly, whether the response was genuinely strategic or whether it was improvised and then retrospectively framed as intentional. Simulation exercises are how you build the genuine article.

Run the simulation annually. Update the plan based on what you learn. Brief new team members on it when they join. The plan is not a document. It is a capability, and capabilities need maintenance.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions