How do you choose a crisis PR firm? Ask eight questions: whether the firm has handled your type of crisis, which senior people will answer the phone, how fast it can start, how it works with your lawyers, what conflicts it holds, how it is paid, what references it offers, and how it measures results. Ask them before an incident, because a firm chosen mid-crisis is chosen under pressure.
Timing is the reason to decide early. The U.S. Securities and Exchange Commission requires public companies to file a Form 8-K generally within four business days after determining that a cybersecurity incident is material, per its July 26, 2023 rule announcement. A firm that cannot line up its statements with that clock from the first day is the wrong firm for a breach.
Last updated: October 6, 2026.
What are the eight questions to ask a crisis PR firm?
The eight questions below separate firms that have run real incidents from firms that describe them. Ask each one of every firm on your shortlist, and compare the answers side by side.
| Question | Why it matters | What a good answer sounds like |
|---|---|---|
| Have you handled a crisis like mine? | Breaches, recalls, executive conduct and activist campaigns run on different clocks | Names the type of case, what the firm did and what happened next, without breaking client confidences |
| Who will answer the phone at 2 a.m.? | Crises do not wait for business hours | Names specific senior people, with a backup for each, and a written escalation path |
| How fast can you start? | The first hours set the story | Gives an hour count, and explains what happens in the first 60 minutes |
| How will you work with our lawyers? | Statements carry legal exposure | Describes a joint review step with a time limit, not a veto in either direction |
| What conflicts do you hold? | A conflicted firm cannot advise freely | Discloses current and recent clients in your industry before you ask twice |
| How are you paid? | Retainer, project and hourly fees behave differently under pressure | Puts the scope, the rates and the expense policy in writing before work starts |
| Which clients can I call? | References show how the firm behaves when things go wrong | Offers two clients with comparable incidents and lets you ask what went wrong |
| How do you measure results? | Press volume is not the same as a recovered reputation | Names measures such as sentiment, search results and how AI engines describe the brand months later |
How should a crisis PR firm work with your lawyers?
A crisis PR firm should work with your lawyers through a joint review step with a time limit, so statements are accurate and legally reviewed without being delayed past usefulness. The standard to ask for is that counsel reviews every outbound statement, and communications decides the wording within the limits counsel sets. The crisis communication plan sets that approval path in writing, including the maximum review time.
For a public company, ask the firm how it keeps a press statement consistent with a regulatory filing. The crisis statement templates show the four fields, nature, scope, timing and impact, that a breach statement and an 8-K both need to carry.
How do you test a firm with a scenario?
Test each shortlisted firm by giving it the same realistic scenario and asking for a first holding statement within an hour. Compare the drafts against the same checklist: does the statement name what happened, who is affected, the company action, the speaker and the next update time.
If the scenario involves wrongdoing, ask for the apology language too, and score it with the five parts in the corporate apology guide. A firm that drafts a defense inside the apology has told you how it will advise you under pressure. The guide to saying "no comment" strategically covers what the firm should offer when facts are still unconfirmed.
How do you check references?
Check references by calling clients who faced a crisis similar to yours and asking what the firm did in the first 24 hours, what it got wrong, and how it handled disagreement with the client's lawyers. Ask each reference whether they would hire the firm again for the same type of incident.
Ask the firm for public work as well. The crisis case study library shows the kind of analysis you should expect from any firm that claims crisis experience: named events, the response and the lesson.
What red flags should you watch for?
Five red flags should end a conversation with a firm or at least slow it down.
- It promises a specific outcome, such as a story killed or a reputation restored by a date.
- It cannot name the senior people who would work your account.
- It will not disclose conflicts.
- It recommends denial or a defense before the facts are confirmed.
- It treats legal coordination as an obstacle, not a step.
What should you do next?
Shortlist three firms, ask all eight questions, run the same scenario test with each, and sign the retainer before you need it. Then store the firm's contacts in the crisis communication plan, with a backup for every name, and drill the relationship once a quarter.
Ronn Torossian is the founder and chairman of 5W AI Communications, the AI Communications Firm. He is the publisher of Everything-PR and the author of two best-selling editions of For Immediate Release.