How to Build a Crisis Communication Plan

The plans that hold up under pressure were almost always written when nobody was panicking. The ones that fail were written in the middle of the fire, or never written at all. In my experience, the difference between an organization that absorbs a hit and one that gets defined by it usually comes down to a single question: did they decide in advance who speaks, what gets said, and who needs to hear it, or are they deciding all of that for the first time at 11 p.m. while the story spreads?

A crisis communication plan is how you make those decisions while you are calm, so that when the day comes you are executing instead of inventing. The Institute for Public Relations frames the value plainly. Organizations handle crises better when they keep a written plan current, name a crisis team in advance, rehearse both, and draft some messages before they are needed (Institute for Public Relations). None of that is exotic. It is simply work that almost nobody does before they are forced to.

Here is the plan I build with clients, component by component.

Start with a real risk assessment

A plan that treats every threat as equally likely is a plan nobody will use. Begin by mapping the specific ways your organization could realistically end up in the news for the wrong reasons. For a company that might be product failure, a data breach, an executive scandal, a layoff, a lawsuit, or a viral customer complaint. For a public figure or a political organization it might be an opposition attack, a leaked document, a financial question, or an old statement resurfacing.

Rank each scenario on two axes: how likely it is, and how much damage it would do. The handful that score high on both are where your planning effort belongs. This is also where the research helps. W. Timothy Coombs built Situational Crisis Communication Theory around a simple idea: the right response depends on how much blame the public will assign you. He sorts crises into three groups. In the victim cluster you are seen as a victim too, as in a natural disaster or product tampering. In the accidental cluster the harm looks unintentional, like a technical failure. In the intentional cluster the public holds you responsible for a deliberate misdeed (Institute for Public Relations). Knowing in advance which group a scenario falls into tells you how contrite the response needs to be. A natural disaster and a cover-up do not call for the same tone, and guessing wrong in the moment is costly.

Build the crisis team and name one spokesperson

When a crisis hits, the worst thing that can happen internally is a scramble over who is in charge. Your plan should name a senior crisis team in advance, with a clear leader and defined roles: someone who owns the facts, someone who owns legal exposure, someone who owns communications, and someone who owns internal and employee messaging. Each role needs a named primary and a named backup, because crises do not check calendars.

The single most important decision in this section is the spokesperson. Pick one. Ready.gov puts it directly: determine in advance who will speak to the media, and prepare that person with talking points so they can speak clearly in terms people understand (Ready.gov). One trained voice keeps the organization consistent. The moment three executives are talking to reporters and posting on their own, you have stopped telling a story and started feeding a contradiction, and contradiction reads as guilt. We cover the live mechanics of this in how to handle a PR crisis in the first 48 hours, but the choice is made here, on a quiet afternoon, not at the podium.

Pre-draft messages and a holding statement

You will not have time to write from a blank page when it counts, and you should not try. The strongest plans include pre-approved message templates: a short holding statement you can release within the first hour to show you are aware and engaged, plus skeleton statements for each of your top-ranked scenarios with blanks to fill in as facts come in.

Ready.gov recommends exactly this, with messages pre-scripted, approved by management, and stored where the team can reach them remotely for quick editing (Ready.gov). Coombs adds the substance these templates should carry. Before any spin or defense, your first job is what he calls instructing information, telling people what happened and what they should do, and adjusting information, telling them what you are doing about it and how you are helping those affected. Research shows this ethical base response should come first in any crisis and can blunt reputational damage even when you are clearly at fault (Institute for Public Relations). Templates that lead with empathy and action, not legal hedging, are the ones worth pre-writing.

Map your stakeholders and notification order

A crisis is rarely a single audience. Ready.gov lists the obvious ones: employees, customers, suppliers, management, and government officials or regulators, each with its own needs (Ready.gov). Your plan should add the ones specific to you: investors, your board, partners, donors, a regulator who must be told within a legal window, and the families of anyone harmed.

For each audience, decide three things in advance: what they need to know, who is best placed to tell them, and in what order they hear it. Sequencing matters more than people expect. Employees learning about a crisis from a reporter instead of their own leadership is its own second crisis. Compile the contact information now, keep it current and secured, and store it somewhere reachable when your normal systems may be down. The list you cannot find at midnight does you no good.

Decide your channels before you need them

Different messages travel on different roads. Your plan should specify which channel carries which message: a press statement, your own website, an email to customers, an all-hands note, a social post, a call to a regulator. Ready.gov describes standing up a contact center and an information center so inbound questions get consistent, accurate answers from staff working off a shared FAQ, while you also push information out through your own channels (Ready.gov).

The principle underneath all of it is to own as much of the message as you can on property you control. Your website, your email list, and your verified accounts are channels where your words arrive unedited. The more of the story you tell on ground you own, the less you depend on others to tell it for you.

The dimension most plans ignore: search and AI answers

Here is where most crisis plans, even good ones, stop short. They prepare for journalists and customers, then act as if the story lives only in the places they are watching. It does not. Today a large share of people who hear something about you will immediately type your name into Google or ask an AI assistant what happened. What those systems say in the first days often becomes the durable version of events, because the first credible account of a story tends to be the one that sticks.

This is not a small audience, and the worst version of a story often travels fastest. An MIT study of about 126,000 stories on Twitter found false ones were 70 percent more likely to be retweeted than true ones, and the truth took roughly six times as long to reach 1,500 people (MIT News). While you are perfecting a press statement, search results and AI summaries are hardening around whatever is loudest.

A modern plan accounts for this directly. That means publishing your accurate account quickly on a page search engines and AI systems can find and cite, structuring it so it is easy for those systems to read and attribute, and treating the search result and the AI answer as primary audiences rather than afterthoughts. It is also where a sustained smear is different from a one-day story, which is worth understanding in advance through what a smear campaign is and how to respond. Getting your version into the answer early is part of the plan, not a cleanup task for later.

Build in the post-crisis review

The work is not finished when the news cycle moves on. Build a debrief into the plan: what we saw coming and what we missed, where the response was fast and where it lagged, which messages landed and which fell flat, and how the search and AI picture looks now against before. Capture it while memories are fresh, then fold the lessons into the next version. The Institute for Public Relations recommends reviewing the plan on a regular schedule, at least once a year, and your own last crisis is the best teacher you will get (Institute for Public Relations). A plan that never changes is a plan slowly going out of date.

A plan is only as good as the practice behind it

A document in a drawer is not preparedness. The organizations that fare best are the ones that rehearse, putting the plan and the team through realistic scenarios until the roles, the spokesperson, and the templates feel familiar under pressure. The Institute for Public Relations treats this practice as core to handling crises well (Institute for Public Relations). The first time your team runs the play should never be the real thing.

At Snake River Strategies this is the quiet, unglamorous work we do with clients long before any crisis: the risk map, the team, the spokesperson, the templates, the stakeholder order, and the search and AI plan that most firms still treat as someone else’s job. Done right, it is invisible. The crisis that never becomes a story is the best outcome there is, and it is almost always the product of decisions made on a calm afternoon, not a frantic night.

Sources

• Institute for Public Relations · Crisis Management and Communications
• Institute for Public Relations · Crisis Management and Communications (Updated)
• Ready.gov · Crisis Communications Plans
• MIT News · Study: On Twitter, false news travels faster than true stories
• Situational Crisis Communication Theory · overview