Why words cost more than the incident
A failure, accident or attack is the event; the damage to reputation comes from the response to it. The public and clients forgive companies for incidents. They do not forgive lies, silence and chaos: when the story changes three times a day, when staff learn the news from the media, when the official answer contradicts screenshots. Restoring systems takes days; restoring trust takes years.
The good news: the outcome depends almost entirely on preparation, and preparation costs no money. It is organisational work covered by existing salaries.
5 principles of crisis communication
- Speed matters more than completeness. The first message goes out within hours: “we know, we are looking into it, we will come back with details by N o'clock”. A pause gets filled with other people's versions.
- Never lie. You do not have to say everything, but you must not say anything untrue: one lie that is caught makes every other word worthless.
- One voice. One spokesperson and one version for all channels; other staff know where to redirect questions.
- Your own people first. Staff learn what is happening before the press does. Otherwise they become the press's source.
- Talk about people, then about processes. The first words are about the safety of people and client data. Leave phrases like “departments are operating normally” out of the opening.
What to prepare in advance
- Templates of first messages for 5–7 scenarios: for staff, clients, partners and the media. In a crisis you edit them in 15 minutes instead of writing them from scratch.
- Answers to the 10 most unpleasant questions for each scenario, agreed with a lawyer in advance.
- An appointed spokesperson and a deputy, plus the “who stays silent” rule: everyone else.
- Channels: how to physically reach staff and clients if corporate systems are down.
- A list of what must not be said: admissions of guilt before the investigation, promises of deadlines, guesses about causes.
The first hours: what to do, step by step
Hour 0–1: record the facts (what is known for certain), activate the crisis team, stop unofficial comments. Hour 1–3: first message to staff, first external message from the template, set the time of the next update. After that, regular updates at the promised time, even if there is no news: “we are working on it, next update at 18:00”. The discipline of updates is itself a signal that the situation is under control. More on the full framework in the article on the company crisis plan, and on the specifics of cyber incidents in our analysis of why companies hide cyberattacks.
Classic mistakes
“No comment”. It reads as “we have something to hide” and hands the microphone to others. Legal language instead of human language. “Partial service degradation is taking place” instead of “we have a failure, we are fixing it, here is what to do”. Premature promises. A named recovery time that is then missed is a second crisis on top of the first. Forgotten staff. The internal audience always matters more than the external one: staff talk to clients.
Frequently asked questions
Do you need a PR agency? In an acute public crisis it helps, but the prepared materials, the spokesperson and the first hours are always yours: an agency cannot react that fast.
Should you admit a cyberattack? A hidden attack that becomes known later hurts more than an admitted one: the lie adds to the damage. Also, many companies have a legal duty to notify.
How do you practise? A communications block is part of every exercise: the spokesperson writes a real message as the scenario unfolds, and the crisis team approves it against the clock.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.