Edited on Jul 4, 2026

Every brand needs a crisis communication plan. Most don't have one. Of the ones that do, half were written by someone who has never been in a crisis.

A crisis plan is not a document. It is infrastructure. Built before you need it, tested regularly, refined after every real event. When the crisis hits — and it will — the plan is the difference between a controlled response measured in hours and a catastrophe measured in quarters of lost trust.

Here is the template. Ten parts. Every one has come from real crises we've navigated at 5W.

Part 1: The Crisis Definition Matrix

The first job is defining what counts as a crisis. Not everything that goes wrong is a crisis. Not everything the CEO panics about is a crisis. And not everything the operations team dismisses as "routine" is routine.

Build a matrix with three tiers:

  • Tier 1 — Existential. Death, injury, major financial loss, regulatory violation, executive misconduct, cyber breach with material data exposure. Full plan activation.
  • Tier 2 — Serious. Product recall, discrimination allegation, negative viral moment, activist campaign, litigation. Partial plan activation.
  • Tier 3 — Manageable. Customer complaint escalation, minor negative story, executive gaffe. Monitor and prepare, don't overreact.

The point isn't the categorization — it's forcing the leadership team to have the conversation before the crisis, not during it.

Part 2: The Crisis Response Team

Named individuals. Not titles. Not "the marketing team." People, with phone numbers and roles.

  • Crisis Lead. Usually the CCO or head of comms. Owns the response end-to-end. Empowered to make comms decisions in real time.
  • CEO or Named Executive Spokesperson. The face of the response. Media-trained. On-camera-capable.
  • Legal Counsel. Reviews all outbound statements. Advises on regulatory exposure and litigation risk. Does not veto communications.
  • Operations Lead. Owns the underlying operational response — the recall, the investigation, the fix.
  • HR Lead. For any people-related crisis.
  • Digital / Social Lead. Runs the owned-channel response and monitors the social response.
  • External PR Partner. Named firm, named lead account executive, contract already signed.

Every name has a backup. Every backup has a phone number. Every phone number is tested in tabletop exercises.

Part 3: The First-Hour Protocol

The first hour determines the next month. The protocol should be written to the specificity of a fire drill.

  • Minute 0–15: Crisis Lead confirms the event, activates the team, opens the incident log.
  • Minute 15–30: Team convenes. Facts are established. Legal, operations, HR each provide a 60-second briefing.
  • Minute 30–45: Holding statement drafted. Approved by CEO, Legal, Crisis Lead.
  • Minute 45–60: Holding statement issued to relevant stakeholders — media inquiries, employees, key customers, regulators as required.

A holding statement is not evasion. It is disciplined acknowledgment. It confirms the event, states the company takes it seriously, notes an investigation is underway, and promises further updates.

Part 4: The Stakeholder Map

Every crisis has multiple audiences. Miss one and the crisis expands.

  • Employees. Almost always the first audience. If they hear about the crisis from the news, you've already lost their trust.
  • Customers. Especially those directly affected. Personalized communication, not corporate blasts.
  • Media. Traditional and trade. Their timeline is faster than yours. Manage it or be managed by it.
  • Regulators. Where legally required, and often as a matter of goodwill.
  • Investors / Board. Especially for public companies. Disclosure obligations are unforgiving.
  • Partners and suppliers. Their exposure to the crisis is your exposure to a second crisis.
  • The general public via social channels. Owned social, paid social, third-party voices.

Part 5: The Dark-Site Library

For every major crisis scenario relevant to the business, a pre-drafted holding statement, follow-up statement, CEO video script, employee FAQ, and customer email — reviewed by legal, refreshed quarterly.

Every crisis plan should include at least the following scenario drafts:

  • Product safety incident or recall
  • Cyber breach or ransomware
  • Executive misconduct or departure under investigation
  • Discrimination or harassment allegation
  • Financial restatement or fraud allegation
  • Major operational outage or service failure
  • Death or serious injury involving customer or employee
  • Regulatory action or investigation
  • Activist campaign or boycott
  • Environmental incident
  • Political or geopolitical exposure
  • Viral negative moment (customer video, employee post, etc.)

Part 6: Message Discipline

One story. One voice. One set of facts.

In a crisis, every spokesperson — CEO, PR lead, customer service, front-line employees — must be operating from the same core message. Fragmented messaging is the single most common cause of crisis expansion.

The message architecture should include:

  • The core acknowledgment — what happened, in one sentence.
  • The empathy statement — for those affected. Human, not corporate.
  • The action — what the company is doing right now.
  • The commitment — what the company will do next.

Part 7: The Real Case Studies Every Team Should Study

The Tylenol recall (1982) — still the reference case

Johnson & Johnson pulled every bottle nationwide at a cost of $100M+ at the time. Never tried to minimize. Introduced tamper-resistant packaging. Rebuilt trust in 12 months. Every crisis textbook still opens with this.

The BP Deepwater Horizon response (2010) — how NOT to do it

Tony Hayward's "I want my life back" line remains the most-quoted crisis PR failure in modern memory. Slow acknowledgment. Corporate language when human language was required. Underestimated the scale in early statements. Cost the CEO his job and generated a decade of reputational drag.

The United Airlines dragging incident (2017)

A passenger was forcibly dragged off Flight 3411. The initial CEO statement described "re-accommodating" customers. That single word became the story. Corporate language in a human moment turned a serious operational failure into a defining brand crisis. The lesson: match the register of the moment, or become the story.

The Peloton "treadmill death" response (2021)

Initial denial. Public fight with the Consumer Product Safety Commission. Eventual recall — but only after the story had already defined the brand. The lesson: fighting the regulator is fighting the story.

Part 8: The Monitoring Infrastructure

You cannot respond to what you cannot see. Every crisis plan needs baseline monitoring across:

  • Traditional media — Meltwater, Cision, LexisNexis, or equivalent.
  • Social media — Sprinklr, Brandwatch, Talkwalker, or equivalent, including the platforms where your customers actually complain.
  • Trade publications — vertical-specific coverage.
  • Search results — the first page of results for your brand name and your CEO's name, tracked daily during a crisis.

Monitoring is where crisis response starts. If the comms team is finding out from Twitter, the plan already failed.

Part 9: The Post-Crisis Review

Every crisis should be followed by a formal review within 30 days. Not to assign blame. To document what worked, what failed, and what to change.

  • Timeline reconstruction — what happened when.
  • Response effectiveness — what messages landed, what didn't.
  • Coverage and sentiment analysis — across earned, owned, and social.
  • Plan updates — every review should produce specific changes to the plan.

Part 10: The Quarterly Drill

A plan that is not tested is not a plan. It is a document that gives the illusion of preparation.

Every 90 days, run a tabletop exercise:

  • Simulated scenario — fresh, realistic, unannounced timing.
  • Real-time response — no rewinds, no do-overs.
  • Full team participation — including legal and the CEO.
  • Debrief and plan updates — captured in writing, integrated into the plan document.

The Bottom Line

A crisis communication plan is not a marketing deliverable. It is executive infrastructure — as important as the fire suppression system, the insurance policies, and the cybersecurity architecture. It is built before it is needed, tested when it is not needed, and executed with discipline when it is.

The brands that survive crises without lasting damage all have one thing in common: they built the plan when they didn't need it. The rest learn the same lesson the same way.

FAQ

How long should a crisis communication plan be?

Long enough to be complete, short enough to be usable in real time. Most well-built plans are 25–40 pages including scenario drafts, contact lists, and protocols. The core response document — the part actually consulted during a crisis — should fit on a few pages.

How often should a crisis plan be updated?

Quarterly review at minimum. Full refresh annually. Immediate update after any real crisis, executive change, or major business change.

Should we hire an external crisis PR firm before we need one?

Yes. The worst time to find a crisis PR partner is during a crisis. The right time is now, when relationships can be built, protocols can be aligned, and the firm can be integrated into your planning process.

What's the biggest mistake companies make in a crisis?

Waiting to be sure of the facts before saying anything. The public will define the story in the vacuum. A disciplined holding statement in the first hour is almost always better than a perfect statement in the fourth.

About the author

Ronn Torossian is the founder and chairman of 5W AI Communications, the AI Communications Firm. He is the publisher of Everything-PR and the author of two best-selling editions of For Immediate Release.