What a crisis plan is and what it is not
A crisis is a situation in which the normal management system can no longer keep up: events move faster than approvals. A crisis plan is a set of decisions made in advance for this mode: who gets authority, which scenarios are covered, which first steps are taken without meetings.
What it is not. It is not a forecast: a crisis almost never follows the written scenario. It is not a rulebook for every case: a decision-making framework matters more than a thousand instructions. And it is not a document “for an inspection”. A plan like that is more dangerous than no plan at all, because it creates an illusion of readiness.
7 steps to a working plan
- Define crisis scenarios. Pick 5-7 that are realistic for your business, not 50: IT outage, an accident at a site, loss of a key supplier, an incident involving people, a public reputational crisis, licence withdrawal or regulator sanctions.
- Appoint the crisis team and deputies. By name, with decision rights and limits. Deputies are a must: crises like to strike during holidays.
- Describe activation triggers. Which signs trigger crisis mode, and who declares it. Half of the damage comes from late activation: everyone waits for things to “sort themselves out”.
- Prepare the first 24 hours. For each scenario, a checklist of first actions: isolate, assess, convene the crisis team, notify. In the first hours nobody thinks. People either follow a list or act chaotically.
- Prepare communications in advance. Message templates for employees, customers, partners and the media, written before the crisis (more in the article on crisis communications).
- Secure resources. Backup communication channels, access to cash for emergency spending, contacts of lawyers and contractors: everything you will not have time to look for in a crisis.
- Run a rehearsal. A 2-3 hour tabletop exercise on one scenario will reveal more gaps than a month of document approvals.
Crisis team: who decides
The working line-up: a crisis team leader with the right to make final decisions (usually the CEO or the COO) and the owners of key areas: IT, production/operations, finance, HR, communications, legal. The key point is authority agreed in advance: which spending the team can approve without the owner, and which decisions need escalation. In a crisis it is too late to bargain over authority.
Communications: what to say and to whom
Companies lose more from silence and contradictions than from the incident itself. The minimum set: a first message to employees (within hours, not days), a position for customers, answers to the 10 most unpleasant questions and one appointed voice of the company. All of this is organisational work covered by existing salaries: zero extra budget and the biggest effect on the outcome.
Rehearsals: why a plan is dead without them
The first rehearsal always exposes the same things: phone numbers are out of date, authority is unclear, message templates do not fit, and the “responsible person” learns about their role during the exercise. This is normal: that is what rehearsals are for. The minimum format: a tabletop simulation every six months, 2-3 hours, one scenario, a debrief straight afterwards. We run such simulations with a stopwatch and a report, including a tough ransomware scenario (how cyber exercises work).
Frequently asked questions
How does a crisis plan differ from a business continuity plan? A business continuity plan is about restoring processes and resources. A crisis plan is about management and decisions in the acute phase. In practice they are two layers of one system: the BCP answers “how do we keep working”, and the crisis plan answers “who decides what while we cannot work”.
How long should a normal plan be? A framework document of 10-15 pages plus one-page checklists for each scenario. Nobody opens anything thicker in a crisis.
Where do you start if you have one week? A crisis team with authority, a first-24-hours checklist for the two main scenarios and a message template for employees. This minimum alone changes the outcome radically.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.