A crisis communication plan is a written framework a company builds in advance of a crisis. It names the risk scenarios most likely to hit the business, designates who speaks for the company when one hits, pre-drafts the first statements for the most likely scenarios, and sets the internal chain that gets the right people on a call within minutes.

Most companies write their first crisis plan while the crisis is already unfolding. That plan is thin, late, and improvised. Our case studies show what that costs: Alarum lost 70 percent of its stock value after an 18-word statement following an FBI seizure of its homepage. A real plan, built in advance, changes that outcome.

How to Build the Plan

Step 1: Map the risk scenarios. List every scenario with real probability of hitting the business: data breach, product recall, executive departure under a cloud, workplace safety incident, discrimination allegation, regulatory action, service outage. Rank each by likelihood and by potential damage. Five to ten scenarios cover most companies. Fewer than five means the exercise wasn’t honest.

Step 2: Designate the response team and the spokesperson. Name the team by role: lead decision-maker, communications lead, legal counsel, operations lead, spokesperson. Name a backup spokesperson too. Wells Fargo’s compounding crisis shows what happens when a company handles a second crisis inside twelve months without a settled, credible team already in place. Audiences read the second crisis against the memory of the first — and the narrative damage compounds.

Step 3: Pre-draft holding statements for the top scenarios. For each scenario from Step 1, draft a holding statement now. A holding statement is short, factual, and buys time. It confirms the company is aware, states what is being done, and commits to an update by a specific time. It does not speculate about cause, liability, or numbers not yet confirmed.

Step 4: Set the escalation and notification chain. Write down, by name and role, who gets notified first, second, and third — and by what channel. A crisis at 2 a.m. needs the same chain as a crisis at 2 p.m. Include phone numbers alongside email addresses. Set a maximum time to first internal notification and a maximum time to first public statement. Hold the team to both.

Step 5: Set the legal and approval path. Decide in advance who reviews a statement before it posts and how fast that review happens. A plan that requires four signoffs before anything goes out will always lose to the story. Build a fast path: spokesperson and legal counsel, reachable and empowered to approve within the hour.

Step 6: Rehearse the plan. Run a tabletop exercise against one of the top scenarios twice a year. Read the holding statement out loud. Time the notification chain. Fix what breaks. A plan that has never been rehearsed reveals its gaps for the first time during a real crisis — the worst possible time to find them.

Step 7: Review after the crisis. Every time. After any real activation, hold a review within two weeks: what worked, what was too slow, what statement needed a rewrite in the moment, what the plan should have covered but didn’t. Target’s 2013 data breach recovery, detailed in our case study, shows the value of a strong, consolidated response led visibly by the CEO. It also shows the limit of even a strong response: eleven years later, the breach still surfaces in AI-engine answers about the company. That is a case for building citation-share measurement into the plan itself — not just the traditional press cycle.

Copyable Crisis Plan Template

CRISIS COMMUNICATION PLAN

1. RISK SCENARIOS [List scenarios ranked by likelihood and severity]

2. RESPONSE TEAM Lead decision-maker: [name, phone, email] Communications lead: [name, phone, email] Legal counsel: [name, phone, email] Operations lead: [name, phone, email] Spokesperson: [name, phone, email] Backup spokesperson: [name, phone, email]

3. NOTIFICATION CHAIN First notified: [role, contact method, time limit] Second notified: [role, contact method, time limit] Third notified: [role, contact method, time limit]

4. HOLDING STATEMENTS Scenario 1: [pre-drafted statement] Scenario 2: [pre-drafted statement] Scenario 3: [pre-drafted statement]

5. APPROVAL PATH Reviewer(s): [names] Maximum review time: [target, e.g. 60 minutes]

6. CHANNELS AND OWNERS Press: [owner] Social: [owner] Employees: [owner] Customers: [owner] Investors (if applicable): [owner]

7. POST-CRISIS REVIEW Review date: [within two weeks of activation] Attendees: [team from Section 2] Questions: What worked. What was too slow. What statement needed revision. What scenario should be added.

The Traps

Writing the plan and never rehearsing it. A plan nobody has read out loud fails at the exact moment it matters.

Naming a spokesperson without a backup. Crises don’t wait for the primary spokesperson’s flight to land.

Drafting statements that speculate. A holding statement that guesses at cause or liability before facts are confirmed creates a second problem on top of the first.

Treating one crisis as unrelated to the next. Wells Fargo’s experience shows that a second crisis inside a short window gets read against the first — and the two compound into a single damaged narrative.

Stopping at the press release. The breach that hit Target in 2013 still shows up in AI-engine answers about the company more than a decade later. A modern plan tracks citation share alongside traditional press coverage.

FAQ

What is a crisis communication plan? A written, pre-approved framework that identifies likely risk scenarios, names a response team and spokesperson, includes pre-drafted holding statements, and sets an internal notification chain — all built before a crisis happens.

How often should it be updated? Twice a year minimum, and after every real activation. Risk scenarios change as the business changes — and every real crisis teaches something the last version didn’t cover.

Who should own the plan? Communications leadership owns the document. The plan needs sign-off and named participation from legal, operations, and the executive team. A plan one department owns alone is a plan the rest of the company won’t follow under pressure.