Crisis PR: What to Do in the First 48 Hours

Public relations crisis management is the process of protecting an organisation’s reputation when something goes wrong, and the first 48 hours determine whether you contain the damage or compound it. Most brands don’t fail in a crisis because they lack a communications plan. They fail because the plan they have was written for a crisis that looks nothing like the one they’re actually in.

What separates brands that come through crises intact from those that don’t is rarely the quality of their PR agency. It’s the quality of their decision-making under pressure, before the agency has even picked up the phone.

Why Crisis Plans Fail Before the Crisis Starts

I’ve sat in enough planning meetings to know that most crisis communications frameworks are built in calm conditions, by people imagining a crisis that is orderly, sequential, and slow-moving. Real crises are none of those things.

Years ago, we were deep into production on a Christmas campaign for Vodafone. It was a strong piece of work, properly budgeted, signed off at the right levels, and built around a music track we’d cleared through a Sony A&R consultant we trusted. At the eleventh hour, a licensing rights issue surfaced that made the whole thing unusable. Not tweakable. Unusable. We had to scrap it entirely, go back to a blank page, develop a new concept, get client approval, and deliver to broadcast standards in a window that would have been tight under normal circumstances. It was, in every meaningful sense, a crisis, even if it never made the news.

What I learned from that experience wasn’t about music licensing. It was about how teams behave when the floor drops out. The people who performed well weren’t the ones who had a plan. They were the ones who could make clear decisions quickly, communicate without panic, and keep moving. The plan was irrelevant. The judgment wasn’t.

That’s the gap most crisis frameworks don’t address. They tell you what to do. They don’t tell you how to think when the situation is evolving faster than your process can keep up with.

If you want to go deeper on how communications strategy fits into broader brand and reputation management, the PR & Communications hub at The Marketing Juice covers the full landscape, from media relations to reputation frameworks to internal comms.

What Does “Crisis” Actually Mean in a PR Context?

Not every bad news day is a crisis. Conflating the two is one of the most common mistakes I see brands make, and it leads to either overreaction or underreaction, both of which cause damage.

A PR crisis is any event that materially threatens your organisation’s reputation, commercial relationships, or licence to operate, and that requires coordinated, time-sensitive communication to manage. That definition matters because it sets the threshold. A negative review is not a crisis. A product recall affecting 200,000 customers is. A critical piece in a trade publication is not a crisis. A whistleblower story picked up by national media is.

The categories worth distinguishing:

• Operational failures: product defects, service outages, data breaches, supply chain failures
• Leadership failures: executive misconduct, ethical violations, governance failures
• External attribution: being associated with a third party’s scandal or controversy
• Social media escalations: content that goes viral for the wrong reasons, customer complaints that gain traction
• Regulatory or legal events: investigations, fines, enforcement actions that become public

Each category has different dynamics, different stakeholders, and different response timelines. Treating them all the same way is a mistake. A data breach requires immediate, specific, legally compliant disclosure. A social media pile-on requires a different kind of speed and a different tone entirely.

The First Hour: What Actually Needs to Happen

The first hour of a crisis is mostly about information, not communication. Before you say anything publicly, you need to know what you’re actually dealing with. That sounds obvious. It’s frequently ignored.

The sequence that works:

Verify the facts as they stand, not as you hope they are. The instinct in a crisis is to assume the best-case version of events. Resist it. Get the clearest possible picture of what happened, what you know, and what you don’t know yet. The gaps matter as much as the facts.

Convene the right people, not all the people. Crisis management by committee is slow and produces watered-down decisions. You need a small group: the senior communications lead, a legal representative, the relevant operational lead, and whoever has final sign-off authority. Everyone else is a resource, not a decision-maker.

Establish a holding position. Before you have a full response ready, you need something to say to anyone who asks. A holding statement is not an evasion. It’s an acknowledgement that something has happened, that you’re taking it seriously, and that you’ll have more to say shortly. “We are aware of the situation and are working to understand the full details. We will provide an update within [timeframe].” That’s it. It’s not exciting. It’s appropriate.

Map your stakeholders immediately. Who needs to know about this, and in what order? Employees, customers, regulators, investors, media, partners. The order matters. Finding out from the news that your own company is in crisis is a trust-destroying experience for employees. Internal communication should almost always come before external.

Hours Two to Twelve: Building the Response

Once you have a holding position in place and the right people in the room, the work shifts to building a substantive response. This is where most organisations get into trouble, because two forces start pulling in opposite directions.

Legal counsel wants to say as little as possible. Communications counsel wants to say enough to control the narrative. Both positions are defensible. Neither is complete. The tension between them is where bad crisis responses are born.

I’ve managed enough situations where legal and communications were pulling in opposite directions to know that the answer is almost never to default entirely to one side. The question isn’t “what can we legally say?” It’s “what do we need to say to maintain trust, and how do we say it in a way that doesn’t create legal exposure?” Those are different questions, and they require legal and communications working together rather than sequentially.

The response itself needs to address four things, not necessarily in equal weight, but all four need to be present:

• Acknowledgement: What happened, stated clearly and without minimisation
• Accountability: Who is responsible, and whether that’s the organisation or a third party
• Action: What is being done right now, and what will be done next
• Assurance: What steps are being taken to prevent recurrence

Responses that skip acknowledgement feel evasive. Responses that stop at acknowledgement feel hollow. The action and assurance elements are what give a response credibility, because they’re specific and they’re falsifiable. You either do what you said you’d do or you don’t.

The Internal Communications Problem Nobody Solves

When I was growing the team at iProspect from around 20 people to over 100, one of the things I learned quickly was that internal communication failures become external ones. People talk. Employees are stakeholders too, and in a crisis, they’re often the first people journalists, customers, and partners call for a “real” account of what’s happening.

If your employees don’t know what to say, they’ll say something. It won’t be on-message. It might be inaccurate. It might be damaging. And it will almost certainly be quoted.

The internal communications component of crisis management is chronically underprepared. Most crisis plans have a section on media response, a section on social media, maybe a section on customer communications. The internal section is often a single paragraph telling people to “direct all enquiries to the communications team.” That’s not enough.

What employees need in a crisis is not a script. It’s clarity. They need to know what happened, what the organisation is doing about it, and what they should say if someone asks them directly. That means a clear internal briefing that goes out before, or at the same time as, any external statement. It means a named point of contact for questions. And it means leadership that communicates directly rather than hiding behind corporate statements.

The organisations that handle crises well tend to have leaders who communicate with their people first. Not because it’s strategically smart, though it is, but because it’s the right thing to do.

Social Media: Speed Without Recklessness

Social media has fundamentally changed the pace of crisis management. A story that once took 24 hours to reach national coverage can now reach millions of people in under an hour. That compression of time is the single biggest change in crisis PR over the past decade, and most organisations are still operating on old timelines.

The pressure this creates is real, but the response to it shouldn’t be to abandon process entirely. Speed without accuracy is dangerous. Publishing a correction to your crisis statement is almost as damaging as the original crisis.

What social media requires in a crisis:

Active monitoring from the moment the crisis is identified. You need to know what’s being said, where, and by whom. Not so you can respond to every comment, but so you have an accurate picture of the narrative as it develops. The way a story is framing itself in the first few hours often tells you more about what your response needs to address than your internal assessment does.

A decision on whether to engage, and where. Not every platform requires a response. If the conversation is happening on a platform where your brand has no presence, engaging there can amplify rather than contain. Know where your audiences actually are, and prioritise accordingly.

Consistency across channels. The statement on your website, the tweet from the corporate account, the LinkedIn post from the CEO, and the response to a journalist’s enquiry all need to say the same thing. Inconsistency between channels is read as deception, even when it’s just poor coordination.

Platforms evolve quickly, and so do the audiences using them. Understanding where conversations actually live matters as much as what you say. Later’s social media glossary is a useful reference for keeping track of emerging platforms and their audience dynamics, which becomes relevant when you’re trying to map where a crisis is spreading.

The Spokesperson Question

Who speaks for the organisation in a crisis is one of the most consequential decisions you’ll make, and it’s rarely made with enough care.

The default assumption is that the most senior person available should be the spokesperson. That’s not always right. Seniority signals accountability, which matters. But it also means putting your most exposed person in front of a situation that may still be evolving. If the CEO goes on record in hour three with information that turns out to be incomplete, you’ve created a much bigger problem than the original crisis.

The right spokesperson depends on the nature of the crisis, the audience, and the stage of the response. In the early stages, a senior communications director or a designated crisis spokesperson can hold the line while the situation is still being assessed. As the picture becomes clearer, more senior leadership can step in with a fuller response.

What the spokesperson needs, regardless of seniority:

• A clear brief on what is known, what is not known, and what cannot be said
• Preparation for the questions they will actually be asked, not the ones you wish they’d ask
• Authority to speak without needing to check back for every answer
• The composure to say “I don’t know yet” without it sounding like evasion

That last point is underrated. “I don’t know yet, but we’re working to find out and we’ll share what we learn” is a perfectly credible answer in the early stages of a crisis. Pretending to know things you don’t is not.

What the 24 to 48 Hour Window Looks Like

By the end of the first 24 hours, you should have moved from a holding position to a substantive response. By the end of 48 hours, the immediate crisis communications phase should be transitioning into a management phase, where you’re executing on the commitments you’ve made rather than still defining what those commitments are.

The markers of a well-managed first 48 hours:

• A clear, factually accurate public statement that addresses the four elements: acknowledgement, accountability, action, assurance
• Internal communications that preceded or accompanied external statements
• A consistent message across all channels and spokespeople
• A defined cadence for updates, so stakeholders know when to expect more information
• Media enquiries handled promptly and consistently
• Social media monitored and, where appropriate, engaged with

What you want to avoid by the end of 48 hours:

• Contradictory statements from different parts of the organisation
• A response that has been walked back or corrected
• The appearance of hiding, minimising, or deflecting
• Promises made without a clear plan to deliver on them
• Leadership that is visibly absent from the response

The brands that come through crises with their reputations intact, and some do, are the ones that make the right calls in this window. Not perfect calls. Right ones. There’s a difference.

Post-Crisis: Where Most Organisations Leave Value on the Table

Once the immediate crisis has passed, most organisations do one of two things. They either move on as quickly as possible, keen to put the episode behind them, or they conduct a review that produces a document nobody reads until the next crisis.

Neither is adequate. A well-managed post-crisis review is one of the most valuable strategic exercises an organisation can undertake, because it’s one of the few moments when the gap between your crisis plan and your actual crisis response is visible to everyone in the room.

The questions worth asking after every crisis, regardless of how well or badly it was managed:

• How did we find out about the crisis, and was that fast enough?
• Who made the key decisions, and did they have the right information to make them?
• Where did internal and external communications break down?
• What did we say that we wish we hadn’t, and what did we not say that we should have?
• What did our stakeholders need that we didn’t give them?
• What would we do differently in the first hour?

The answers to those questions are worth more than any crisis communications manual you could commission. They’re specific to your organisation, your culture, your stakeholders, and your actual behaviour under pressure. That’s the material you can actually improve.

Judging the Effie Awards gave me a different perspective on how brands talk about their own performance. The entries that were most credible weren’t the ones that presented everything as a triumph. They were the ones that were honest about what they’d tried, what had worked, and what the data actually showed. The same principle applies to post-crisis reviews. Honesty about what went wrong is more useful than a narrative that protects the people who made the calls.

Crisis management sits within a broader communications discipline that covers everything from proactive reputation building to media strategy. The PR & Communications section at The Marketing Juice is where I write about all of it, including how to build the kind of reputation that gives you more room to manoeuvre when things go wrong.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions