Most organisations discover the quality of their crisis communications plan at roughly 4pm on a Friday. The ones that cope are rarely the ones with the longest document. They are the ones who decided who speaks, who approves and how fast — before the day arrived.
Here is the structure we use.
1. Severity tiers
Three is enough.
- Tier 1 — Local. A complaint, a bad review, a single journalist query. Handled by the function that owns it, logged, no escalation.
- Tier 2 — Material. Anything with regulatory, safety, employment or financial exposure. Communications lead informed within 30 minutes.
- Tier 3 — Existential. Harm to a person, criminal allegation, data breach, or anything likely to reach national media. Full team convened within 60 minutes, day or night.
Write the tier definitions with examples from your own sector. Generic definitions get argued about mid-incident.
2. Named roles, not job titles
Every role needs a person and a deputy, with mobile numbers on one page:
- Decision owner (usually CEO or MD)
- Communications lead
- Legal or regulatory counsel
- Operational fact-holder — the person who actually knows what happened
- Internal communications owner
- Log keeper
The log keeper matters more than people expect. In any subsequent review or inquiry, a contemporaneous timeline is the most valuable document you own.
3. Holding statements, pre-drafted
You cannot pre-write the truth of an incident, but you can pre-write the shape of your first response. Draft three: service failure, workplace incident, data or systems breach. Each is three sentences — what we know, what we are doing, when we will next update. Have them legally cleared now, not later.
Silence is a position. It is usually read as guilt or disorganisation.
4. Sequencing
Staff, then affected parties, then regulators where required, then media, then the wider public. Employees learning about their own organisation from the news is a second crisis layered on the first.
5. Channel rules
Decide in advance which channels you will use and which you will mute. Scheduled marketing content should pause automatically at Tier 2 and above — an upbeat social post published mid-incident does disproportionate damage.
6. The 48-hour rhythm
- 0–1 hour: convene, establish facts, issue the holding statement.
- 1–6 hours: brief staff, contact affected parties, single named media contact.
- 6–24 hours: substantive update with actions taken.
- 24–48 hours: remedy, accountability, and what changes.
7. The review nobody schedules
Two weeks after, run a 90-minute review: what was true, what we said, how fast, and what the plan got wrong. Amend the plan the same day. A crisis plan that is never revised is a plan that has never been tested.
The test
Read your plan and ask one question: could a competent colleague execute the first hour of this at 4am with no other information? If not, it is a reassurance document, not a plan.
That first hour is usually the whole game.