Company crisis plan: a working structure in 7 steps

What a crisis plan is — and is not

A crisis is a situation where the normal management system stops keeping up: events move faster than approvals. A crisis plan is a set of decisions made in advance for that mode: who gets authority, which scenarios are covered, which first steps happen without meetings.

What it is not: a forecast (crises rarely follow the described scenario), a rulebook for everything (what matters is the decision framework), or a document «for the auditor» — that kind is worse than none, because it creates an illusion of readiness.

7 steps to a working plan

1. Define crisis scenarios. Not fifty — five to seven realistic ones: IT outage, site accident, loss of a key supplier, a people incident, a public reputational crisis, regulatory action.
2. Name the crisis team and deputies. By name, with decision rights and spending limits. Deputies are mandatory: crises love vacation season.
3. Describe activation triggers. What signs, observed by whom, switch the company into crisis mode. Half the damage comes from late activation — everyone waits for it to «blow over».
4. Prepare the first 24 hours. Per scenario, a checklist of first actions: isolate, assess, assemble, notify. In the first hours nobody thinks — people follow lists or panic.
5. Pre-draft communications. Message templates for staff, clients, partners and press — written in peacetime (see crisis communications).
6. Secure resources. Backup communication channels, access to emergency cash, lawyer and contractor contacts — everything you cannot go searching for mid-crisis.
7. Run a rehearsal. A 2-3 hour tabletop on one scenario reveals more gaps than a month of document reviews.

The crisis team: who decides

A working lineup: a team lead with final authority (usually the CEO or COO) plus owners of IT, operations, finance, people, communications and legal. The key is pre-agreed authority: what the team may spend without the owner, what requires escalation. Negotiating authority during a crisis is too late.

Communications: what to say

Companies lose more on silence and contradictions than on the incident itself. The minimum kit: a first message to staff within hours, a client-facing position, answers to the ten hardest questions, one designated voice. All of it is organizational work inside existing salaries — zero extra budget, maximum effect on the outcome.

Rehearsals: why an untested plan is dead

The first rehearsal always exposes the same things: outdated phone numbers, unclear authority, unusable templates, an «owner» who learns about the role during the game. That is what rehearsals are for. The minimum format: a tabletop simulation every six months, one scenario, immediate debrief. We run such simulations with a stopwatch and a management report — including the hard ransomware scenario (how a cyber exercise works).

FAQ

How is this different from a business continuity plan? The BCP is about restoring processes and resources; the crisis plan is about command and decisions while things are broken. Two layers of one system.

How long should the plan be? A 10-15 page frame plus one-page checklists per scenario. Anything thicker never gets opened in a crisis.

What can we do in one week? A team with authority, first-24-hours checklists for the two main scenarios, a staff message template. Even that minimum changes the outcome radically.