In the first 24 hours after a corporate reputation crisis, a company should confirm the facts, name one decision owner and one spokesperson, tell employees and affected customers, publish a short first statement with a time for the next update, and keep a log of every decision. The goal of day one is not to win the story. It is to stop the story from getting worse.
By Ronn Torossian. Last updated: November 9, 2026. Cases are attributed to named sources. The example statement and employee note are hypotheticals for a fictional company. This is communications guidance, not legal advice.
What should happen in each block of the first 24 hours?
The first 24 hours work best as five blocks, each with an owner and a product. The table is the plan I would put on a wall.
| Hours | Priority | Owner | Product |
|---|---|---|---|
| 0 to 1 | Confirm what is known, stop scheduled posts and name the decision owner | CEO and communications | One-page fact sheet, version 1 |
| 1 to 4 | Brief counsel, the board and the response team; draft the first statement | Communications and legal | Draft statement |
| 4 to 8 | Tell employees; contact the most affected customers and partners directly | CEO and managers | Employee note, call list |
| 8 to 16 | Publish the first statement; answer reporters from one approved source | Spokesperson | Public statement, inquiry log |
| 16 to 24 | Update the facts, correct errors and set the next update time | Communications | Dated update |
What should the first hour check?
The first hour should check whether anyone is in danger, what can be confirmed and who needs information now. The Michigan Credit Union League's crisis playbook asks whether anyone is in immediate danger as its first question and warns that a fast response matters but an inaccurate one creates additional risk.
Percepture's first-hour guide frames the same check as three questions: is anyone at risk, what can we confirm, and who needs information now. A CDC emergency communication checklist for the first 48 hours gives the standard in three words: be first, be right, be credible. Speed has value only when the facts are right.
What should the first statement say?
The first statement should say what happened, what the company is doing, what is not yet known and when the next update will come. It should not guess at causes, name people without confirmation or promise outcomes that depend on others.
The crisis communication plan template shows how to prepare statements before an event, and the managing negative press guide covers who speaks and when to correct the record.
The example below is a hypothetical for a fictional company. "Northwind Foods is aware that a software error caused some customer orders to be charged twice, and we are sorry for the problem. Our engineers have stopped the error and are identifying every affected order. We do not yet know how many orders were affected. We will update this page by 6 p.m. Eastern and every four hours after that."
What should employees hear, and when?
Employees should hear the facts before or at the same time as the public, in a short note from the CEO. Employees are the first people customers and friends ask, so a staff member who learns the news from a reporter cannot answer. The example below is a hypothetical.
"Team, this afternoon we found a software error that charged some customers twice. We have stopped it and are fixing every affected order. Please send customer questions to the response desk at the number below, and do not guess about causes or numbers. I will update you again at 6 p.m." The note states what happened, what the company is doing, what staff should do and when the next update arrives.
Who should keep the decision log?
One person in communications should keep a timestamped log of every decision. Percepture advises recording the current statement version, unresolved questions, audience feedback, the next update time and named owners. The log lets the team check any new statement against earlier ones and shows later what was known at each hour.
| Time | Decision or statement | Decision owner | Approved by | Open questions |
|---|---|---|---|---|
| Hour 1 | Fact sheet version 1 created | Communications lead | CEO | Number of affected customers |
| Hour 6 | Employee note sent | CEO | Counsel | Cause of the error |
| Hour 9 | First public statement published | Spokesperson | CEO and counsel | Scope of refunds |
The entries above are a hypothetical template. Keep the log in one shared place with one owner, because a log that lives in several chat threads cannot be checked.
What did CrowdStrike do on day one?
CrowdStrike used its first day to say what had happened, what it was not and what customers should do. On July 19, 2024, a sensor configuration update released at 04:09 UTC affected about 8.5 million Windows devices, less than 1 percent of all Windows machines, according to Microsoft's estimate as reported by Intelligent CIO.
Chief Executive George Kurtz said the event was not a cyberattack, which answered the first question customers had, and CrowdStrike reported that more than 97 percent of Windows sensors were back online within about a week, per CBS News. The pattern is useful beyond technology: a short statement that rules out the worst fear can reduce speculation quickly.
What did Johnson & Johnson do first in 1982?
Johnson & Johnson acted on a principle it had written down years earlier. After seven people near Chicago died from cyanide-laced Tylenol capsules in late September 1982, the company recalled about 31 million bottles at an estimated cost of $100 million, according to Wharton Knowledge.
James Burke, the chief executive, said the company's Credo "gave me the ammunition I needed to persuade shareholders and others to spend the $100 million on the recall," as quoted by Wharton. The lesson for day one is that a decision order written before the crisis lets leaders act within hours. The PR crisis examples page covers the case in context.
How often should updates follow the first statement?
Updates should follow at a rhythm promised in the first statement. Everything-PR reports that specialist crisis firms often use a model of a first statement in 30 minutes, a first update in two to four hours and an update every 24 hours after that. ContentGrip advises setting the next update time before publishing the first message.
A missed update does more harm than a thin one. If there is no news at the promised time, publish a short note that says so and names the next time.
What mistakes cost the most on day one?
The costliest mistakes are speed without facts, silence without a reason and a statement that contradicts later findings. Each has a simple remedy.
- Speed without facts: publish only what the fact sheet confirms, and label the rest as unknown.
- Silence without a reason: say that you are investigating and give a time for the next update.
- Contradiction: keep a log of every statement, and check new drafts against it.
- Skipping employees: tell staff before or at the same time as the public.
For a security incident, the cybersecurity PR guide covers the same first day with regulatory clocks, and the crisis communications case study library and the corporate apology guide cover when an apology belongs in the first statement.
Frequently asked questions
What should a company do in the first 24 hours of a crisis?
Confirm facts, name a decision owner and a spokesperson, tell employees and affected customers, publish a short first statement and set a time for the next update.
Should a company apologize on day one?
If the company is at fault and the facts support it, a short, specific apology is often right. If facts are unclear, say what is known and when you will update.
How quickly should a company respond publicly?
As soon as there is a verified fact worth sharing, usually within hours. A short holding statement is better than a long silence.
Who should speak for the company?
One named spokesperson, so that every outside voice carries the same approved facts. Staff should send media questions to that person and not improvise.
Should the CEO be the spokesperson?
Often the CEO should speak when the crisis touches trust in the company itself, and a trained spokesperson can handle detailed questions. Decide before a crisis who speaks in which case.
Print the table, fill in the names for your own company, and decide today who the decision owner is. A crisis is too late to settle that.