The worst time to build a crisis communication plan is during a crisis.

This sounds obvious. And yet, research from the Institute for Crisis Management consistently shows that the majority of organizations that experience a significant reputational crisis had no formal crisis communication plan in place when the crisis hit. They scrambled. They improvised. And in most cases, the improvisation made things worse.

I’ve worked with brands that handled crises well and brands that handled them badly. The difference was never the severity of the crisis — it was whether they had built the framework before they needed it. The brands with a plan in place responded within hours, controlled the narrative, and recovered within weeks. The brands without a plan took days to respond, lost control of the story, and spent months repairing the damage.

A crisis communication plan isn’t a document you write and file away. It’s a working system — roles, protocols, pre-drafted templates, escalation paths, and monitoring triggers — that enables your team to move fast when the pressure is highest and the stakes are real.

Here’s how to build one that actually works.

What Counts as a Crisis

Before building the plan, you need to define what constitutes a crisis versus a regular negative event. Not every bad review, angry tweet, or unfavorable article warrants a crisis response. Overreacting to minor issues is almost as damaging as underreacting to real crises — it wastes resources, creates unnecessary panic, and trains your team to treat everything as an emergency until nothing feels like one.

A crisis is a situation that meets at least two of these criteria:

Immediate threat to reputation. The event could fundamentally change how stakeholders (customers, partners, investors, employees) perceive your brand. A product defect that causes harm, a senior executive’s misconduct, a data breach exposing customer information.

Spreading rapidly. The story is being picked up by multiple outlets or going viral on social media. The speed of spread determines whether you have hours or days to respond — in most modern crises, it’s hours.

Requires cross-functional response. The situation can’t be handled by one department alone. It requires coordination between communications, legal, customer service, operations, and executive leadership.

Potential for lasting damage. If unaddressed, the event could result in lost revenue, regulatory action, employee attrition, or permanent brand perception damage.

A negative product review is not a crisis. A viral thread from a former employee detailing a toxic workplace — with screenshots — is. Knowing the difference prevents both overreaction and underreaction.

Crisis Categories

Most organizational crises fall into one of six categories. Your plan should have pre-built response templates for each:

1. Product/service failure — Defects, outages, safety issues, recalls
2. Data/privacy breach — Unauthorized access to customer or employee data
3. Leadership/personnel — Executive misconduct, discrimination claims, high-profile departures
4. Financial — Layoffs, missed earnings, fraud allegations, regulatory fines
5. External attack — Misinformation campaigns, competitor attacks, activist targeting
6. Operational — Supply chain disruption, workplace accidents, environmental incidents

Phase 1: Pre-Crisis Preparation

The crisis communication plan is built during calm times. Every component you put in place now is one less thing you’ll have to figure out when you’re under pressure, short on time, and making decisions with incomplete information.

Assemble the Crisis Response Team

Define who is on the team, what each person’s role is, and how they’ll be contacted when a crisis breaks. The team should include:

Crisis Lead — The single decision-maker during a crisis. This is typically the CEO or COO for major crises, or the VP of Communications for smaller events. The crisis lead has final authority on messaging, response timing, and escalation decisions.

Communications Lead — Drafts and approves all external statements, press responses, and social media messaging. Works with the crisis lead on messaging strategy.

Legal Counsel — Reviews all public statements for legal exposure. Has veto power on language that could create liability but should not be allowed to delay response indefinitely for legal review. Set a maximum review time (30-60 minutes) in the plan.

Social Media Lead — Monitors social channels in real time, manages community responses, and escalates emerging issues. This person needs to be active on platforms where the crisis is unfolding within minutes, not hours.

Customer Service Lead — Handles inbound customer communications. Needs talking points and FAQ documents aligned with the public messaging.

Subject Matter Expert — Varies by crisis type. For a product issue, this is the head of engineering or product. For a data breach, this is the CISO or head of IT security.

Document the team’s contact information in a shared, offline-accessible format. During a crisis, your internal systems (Slack, email, intranet) may be compromised or overloaded. Every team member should have the crisis contact sheet on their phone.

Create the Escalation Matrix

Not every negative event requires the full crisis team. Build a three-level escalation matrix:

Level 1 — Routine issue: Handled by customer service and communications. No executive involvement needed. Examples: negative review, minor complaint going semi-viral, journalist inquiry about a non-sensitive topic.

Level 2 — Emerging situation: Communications lead and relevant department head are activated. Crisis lead is informed but not yet activated. Examples: product issue affecting a small group of customers, negative press coverage gaining traction, employee misconduct allegation.

Level 3 — Full crisis: Entire crisis team activated. Crisis lead takes command. Examples: data breach, product recall, executive scandal, viral reputational attack, regulatory investigation.

Define clear triggers for escalation from Level 1 to 2, and from 2 to 3. Trigger examples: media pickup count exceeds five outlets, social media volume on the topic exceeds 500 mentions in an hour, stock price drops more than 5%, or a Tier 1 publication contacts you for comment.

Pre-Draft Your Templates

When a crisis hits, you won’t have time to draft messaging from scratch. Every minute spent wordsmithing is a minute the narrative is being shaped without you. Pre-draft templates for each crisis category that can be adapted quickly.

Holding statement template — This goes out within the first 60 minutes. It acknowledges the situation, states that you’re investigating, and commits to providing updates. It buys you time without making commitments you might need to walk back.

Structure: “We are aware of [situation description]. We are actively investigating and will provide a full update within [timeframe]. [Affected stakeholder group] can contact [specific channel] for immediate assistance.”

Full response template — This goes out once you have facts. It states what happened, what caused it, what you’re doing about it, and what affected stakeholders should do. It should express appropriate concern without accepting liability (your legal counsel will help calibrate this).

Media statement template — Shorter than the full response, designed for journalist inquiries. Includes the key facts, a quote from the crisis lead or CEO, and contact information for follow-up.

Social media response templates — Short-form versions of the above for each platform. Include versions for: initial acknowledgment, update with new information, resolution announcement, and response to individual customer complaints related to the crisis.

Internal communication template — Your employees should hear about the crisis from you before they hear about it from the media. This template informs staff about what happened, what the company is doing, what employees should and shouldn’t say publicly, and who to direct press inquiries to.

Phase 2: The Response Framework

When the crisis hits, the plan shifts from preparation to execution. The first 60 minutes determine whether you control the narrative or the narrative controls you.

The First 60 Minutes

Minutes 0-15: Assessment and activation. The person who first identifies the crisis activates the escalation matrix. The crisis lead is notified and convenes the team (in person, by phone, or via a pre-designated communication channel). The immediate goal is to understand what happened, who’s affected, and how fast it’s spreading.

Minutes 15-30: Holding statement. The communications lead adapts the pre-drafted holding statement and gets crisis lead approval. If legal review is needed, use the pre-approved holding statement from your template library while the full statement is reviewed. Publish the holding statement on your website, social channels, and any platform where the crisis is being discussed.

Minutes 30-60: Information gathering. The subject matter expert compiles facts. Legal begins reviewing the situation for exposure. Customer service prepares to handle inbound volume with interim talking points. The communications lead begins drafting the full response.

This timeline is aggressive by design. Research from Edelman and others consistently shows that organizations that respond within the first hour fare dramatically better in reputation recovery than those that take 24-48 hours. Speed doesn’t mean recklessness — it means having the templates, team, and protocols ready so that speed is possible without sacrificing accuracy.

The Holding Statement: Your Most Important Tool

The holding statement is the most important document in your crisis communication arsenal. It does three critical things:

1. It shows you’re aware and engaged. Silence during a crisis is interpreted as either ignorance or indifference — both are devastating.
2. It buys time for a complete response. You can’t say what you don’t know yet. The holding statement sets the expectation that more information is coming without making premature commitments.
3. It establishes your channel as the authoritative source. When you put out the first statement, media and social media users have something to reference. If you say nothing, they reference each other — and the narrative spirals.

A good holding statement is factual, empathetic without being defensive, and specific about what comes next. A bad holding statement is vague, corporate-sounding, or makes promises the company might not be able to keep.

Message Framework: The 4A Model

For the full crisis response, I use a four-part framework that covers every dimension stakeholders need to hear:

Acknowledge — State clearly what happened. Don’t minimize, don’t deflect, don’t use passive voice. “A data breach occurred” is clearer and more trustworthy than “An incident may have impacted some user data.” Stakeholders can detect hedging, and it erodes trust faster than the crisis itself.

Apologize (when appropriate) — If your organization is at fault, say so. A sincere apology that takes responsibility is the fastest path to de-escalation. Conditional apologies (“We’re sorry if anyone was affected”) are worse than no apology at all — they signal that you don’t take the situation seriously. Legal will push back on direct apologies; negotiate this in advance during plan creation.

Act — State specifically what you’re doing to address the immediate situation and prevent recurrence. This must be concrete: “We’ve engaged a third-party cybersecurity firm to investigate the breach and are implementing two-factor authentication across all user accounts this week.” Vague commitments (“We’re taking steps to ensure this doesn’t happen again”) sound like corporate filler.

Advance — Set the timeline for updates and next steps. “We will provide an update within 24 hours with the results of our investigation.” Then meet that deadline. Every missed update erodes the trust you’re trying to rebuild.

“The companies that survive crises aren’t the ones that never make mistakes. They’re the ones that respond fast, take responsibility, and show stakeholders exactly what they’re doing to fix the problem. Speed, transparency, and accountability — in that order.”

— Salva Jovells, Presslei

Phase 3: Social Media During a Crisis

Social media is where most modern crises accelerate, and it’s where many organizations’ response plans fail most spectacularly. The dynamics are different from traditional media, and the tactics must be different as well.

The Speed Imperative

On social media, the window between a crisis emerging and the narrative being set is measured in minutes, not hours. A tweet goes viral. Screenshots circulate. Commentary accumulates. By the time a corporate communications team has drafted, reviewed, and approved a response through normal channels, the story has been told thousands of times without their input.

Your social media lead must have pre-authorization to post the holding statement on all channels immediately upon crisis confirmation, without waiting for the full response chain. This is why pre-drafted templates are essential — they’ve already been approved by legal and leadership during the calm planning phase.

What to Post and When

First post (within 30 minutes): Adapted holding statement. Keep it short. Acknowledge awareness, commit to updating. Pin it to the top of your profile.

Subsequent posts (every 2-4 hours during active crisis): Share new information as it becomes available. Each post should add something new — repeating the same holding statement signals that you’re not making progress.

Individual responses: For customers directly affected by the crisis, respond individually with specific guidance. Direct them to your customer service channel for detailed assistance. Do not engage in arguments or respond to trolls — this amplifies the negative conversation without helping affected stakeholders.

Post-resolution post: When the crisis is resolved, post a clear summary of what happened, what was done, and what changed as a result. This post becomes the reference point for anyone who encounters the story later.

What Not to Do

Don’t delete posts or comments. Deleting negative comments during a crisis is one of the fastest ways to escalate it. Screenshots will circulate, and the deletion itself becomes a story. The only exception is content that violates platform terms of service (threats, abuse, doxxing) — remove those and document the reason.

Don’t go silent on unrelated content. Pause all scheduled social media posts during a Level 3 crisis. A promotional post going out while customers are complaining about a data breach is tone-deaf and will be screenshot-shared as evidence of corporate indifference. Pause everything, respond to the crisis, and resume normal posting only when the situation is clearly resolved.

Don’t argue with the narrative. If incorrect information is circulating, correct it once with a factual statement. Don’t engage in back-and-forth corrections. Repeated corrections look defensive and keep the negative narrative in the public conversation. State the facts, link to your official statement, and move on.

Phase 4: Working with Journalists During a Crisis

During a crisis, journalists will contact you. How you handle those inquiries significantly impacts the narrative. Journalists are not the enemy during a crisis — they’re going to write the story whether you participate or not. Your choice is whether the story includes your perspective or just the perspectives of critics, affected customers, and competitors.

Responding to Media Inquiries

Respond to every inquiry. “No comment” is never an acceptable crisis response. It’s interpreted as an admission of guilt or indifference. If you don’t have full information yet, say: “We’re actively investigating and will provide a full statement within [timeframe]. In the meantime, here’s what we can confirm so far.”

Be proactive, not just reactive. Don’t wait for journalists to contact you. Once the holding statement is published, the communications lead should proactively reach out to journalists who cover your industry — the ones you’ve built relationships with through your regular PR work. Offer them a briefing, an interview with the crisis lead, or early access to the full statement. Journalists who receive proactive outreach during a crisis are significantly more likely to write balanced coverage.

This is where your ongoing media list and journalist relationships pay dividends beyond normal campaign cycles. A journalist who knows you, trusts your information, and has positive prior experience with your communications team is far more likely to give you the benefit of the doubt during a crisis than one who’s never heard from you before.

Designate a single spokesperson. Multiple people speaking to the media creates inconsistency, and inconsistency during a crisis is interpreted as either dishonesty or incompetence. The crisis lead or a designated senior spokesperson handles all media. Everyone else directs inquiries to that person.

Phase 5: Internal Communication

Your employees are stakeholders too — and in many crises, they’re the most vulnerable. They’re the ones who face questions from friends and family, who see the social media firestorm from their personal accounts, and whose morale and retention are most directly affected.

The Internal-Before-External Rule

Employees should hear about the crisis from the company before they hear about it from the media or social media. This means your internal communication goes out at the same time as (or slightly before) your public holding statement.

The internal message should include:

1. What happened — The same factual account you’re sharing publicly, with additional internal context if appropriate
2. What the company is doing — The response plan and timeline
3. What employees should do — Specific guidance on how to handle questions from customers, media, or personal contacts
4. What employees should not do — Clear instruction not to post about the crisis on personal social media, speculate publicly, or speak to journalists without authorization
5. Who to contact — Internal point of contact for employee questions and concerns

Failing to communicate internally creates two problems: employees feel disrespected (they found out from Twitter instead of their CEO), and they become potential sources of leaked, uncontrolled information because no one told them what the official position is.

Phase 6: Post-Crisis Recovery

The crisis response doesn’t end when the immediate situation is resolved. The recovery phase — which can last weeks to months — determines whether the crisis leaves permanent damage or becomes a footnote.

The Post-Crisis Review

Within two weeks of resolution, conduct a thorough review with the full crisis team:

• Timeline reconstruction: What happened, when, and how was it handled? Build a minute-by-minute timeline.
• Response assessment: What went well? What was too slow? Where did the plan fail?
• Communication audit: Review every public statement, social media post, and media interaction. Were they consistent? Were they timely? Did they match the intended message?
• Stakeholder impact: How did customers, partners, investors, and employees react? What feedback was received?
• Plan updates: Based on the review, update the crisis communication plan. Every crisis teaches you something the plan didn’t account for.

Reputation Rebuilding

After a major crisis, proactive reputation rebuilding through earned media is the fastest path to recovery. This is where reactive PR shifts back to proactive mode:

Tell the resolution story. The crisis itself was news. The resolution is also news. Pitch the story of how you identified the problem, what you changed, and what safeguards you put in place. Journalists who covered the crisis negatively will often cover the resolution — if you pitch it properly.

Use data to rebuild trust. If the crisis involved a product or service failure, publish the data showing the fix. “We identified the root cause within 48 hours and implemented a fix that has reduced the failure rate from X to Y” is a powerful narrative. Turn your recovery data into a PR story that demonstrates transparency and accountability.

Re-engage with key journalists. The journalists who covered the crisis are the most important contacts for the recovery narrative. Reach out personally, offer a post-mortem interview with the CEO, and provide concrete evidence of the changes you’ve made. Building this into your media outreach strategy ensures recovery coverage reaches the same audiences that saw the crisis coverage.

Setting Up Crisis Monitoring

You can’t respond to what you don’t see. Crisis monitoring is the early warning system that gives you the precious minutes between a crisis emerging and it going mainstream.

Monitoring Tools and Triggers

Set up automated monitoring across these channels:

Brand mentions: Google Alerts (free), Mention, or Brandwatch for real-time brand name monitoring. Include common misspellings, executive names, and product names. Our Google Alerts setup guide covers the configuration in detail.

Social listening: Monitor Twitter/X, LinkedIn, Reddit, and industry-specific forums for spikes in brand mentions, negative sentiment, or keywords associated with your crisis categories. Tools like Brandwatch and Sprout Social provide real-time alerting.

Review platforms: Monitor Trustpilot, G2, Capterra, and industry-specific review sites for sudden increases in negative reviews, which can be an early indicator of a product issue that hasn’t yet gone mainstream.

Competitor monitoring: Watch how competitors handle their crises — it’s free lessons in what works and what doesn’t, and it alerts you to industry-wide issues that could affect you next.

Define alert thresholds that trigger escalation: mention volume exceeds 2x normal rate, sentiment score drops below a threshold, a Tier 1 publication publishes a negative story, or a social media post about your brand exceeds a certain engagement threshold.

The Crisis Communication Plan Document

Everything above should be captured in a single, accessible document. Here’s the structure I recommend:

Section 1: Crisis Definition and Severity Levels — What qualifies as a crisis, the three-level escalation framework, and triggers for each level.

Section 2: Crisis Response Team — Names, roles, contact information (personal cell phones, not just work email), and backup contacts for each role.

Section 3: Escalation Matrix — Who activates, who’s notified at each level, and the decision authority chain.

Section 4: Response Templates — Pre-drafted holding statements, full responses, media statements, social media posts, and internal communications for each crisis category.

Section 5: Channel Protocols — How each communication channel (website, social media, email, phone, internal) is used during a crisis, who owns each channel, and posting protocols.

Section 6: Media Contacts — Key journalists who cover your industry, their contact information, and notes on prior relationship. This overlaps with your regular media list but should be accessible independently.

Section 7: Monitoring Setup — Tools, alert thresholds, and escalation triggers.

Section 8: Post-Crisis Review Template — The review framework and questions for the post-crisis assessment.

Store this document somewhere that’s accessible even if your primary systems go down. A shared Google Drive folder, a printed copy in each crisis team member’s desk, and a PDF on each team member’s phone. During a data breach or system outage, your intranet may be unavailable — the plan needs to be reachable anyway.

Salva Jovells is the founder of Presslei, a reactive PR agency that builds earned media authority through journalist relationships, not paid placements. Read our reactive PR guide to understand how proactive media relationships protect your brand during both good times and bad, or see our newsjacking playbook for turning breaking news into earned coverage.

About the Author

Salva Jovells

Founder of Presslei. 12+ years in ecommerce SEO across international markets. After a decade of link buying for Hockerty and Sumissura, I reverse-engineered 5,272 earned media placements and founded a reactive PR agency that builds authority through data-driven stories journalists actually want to publish. Based in Zurich.