The crisis plan is one of those documents everyone assumes belongs to someone bigger. The bank has one. The airline has one. A forty-strong fintech or a growing foundation looks at the size of the thing, decides it is overkill, and moves on to a problem that feels more real today.
Then the bad day arrives. A payment outage at the worst possible hour. A data exposure. A founder’s old post resurfacing. For an NGO, a safeguarding allegation or a donor who wants to know exactly where their money went. And the company discovers, in the space of about ninety minutes, that it has no idea who is allowed to speak, what it is allowed to say, or who is supposed to be writing it.
The instinct is backwards. Crisis communications is treated as a big-company concern, but the logic runs the other way. A large organisation has a hundred touchpoints with the public and a reputation built over decades; one bad day is a dent. A company of forty has a handful of touchpoints and a reputation that is mostly potential. One bad day, handled badly, can become the thing people remember about you. The less you have, the more a single event can define you.
You do not need a playbook, you need a page
Most advice on this points you towards a document. A proper crisis manual, with scenario trees and escalation matrices and a stakeholder map that took a consultant three weeks to draw. It is comprehensive, it is impressive and on the day it matters nobody opens it.
Under real pressure, people do not read. They do not have forty pages of attention. They have a racing pulse, a phone filling up and roughly the judgement they walked into the room with. A plan only works if it survives that state. Which means it has to be short enough to hold in your head and specific enough to act on without interpretation.
So the goal is not a manual. It is a single page of decisions, made in advance, when you are calm. The page does not try to anticipate every crisis, because it cannot. It locks down the handful of things that are the same in every crisis, so that on the day you are choosing words, not roles.
Decide who speaks, and who does not
The first decision is the one most companies have never made: who is the voice. Not who is in charge, who actually says the words, on the record, in public.
In a vacuum, everyone speaks. The founder posts. Two people from support reply to angry customers in slightly different tones. Someone in the team retweets a defence of the company that turns out to be wrong. By the time anyone notices, there are four versions of the story and they do not agree, which is itself now part of the story.
Decide it in advance. One named spokesperson, one named deputy for when the first is on a plane or asleep, and a clear rule that nobody else speaks for the company until the line is set. That includes the founder, who is usually the hardest person to hold to it and the most damaging when they freelance. The rule is not about control for its own sake. It is that a single clear voice is the only way the outside world can tell what the company actually thinks, as opposed to what one rattled employee thinks at 11pm.
The first hour decides most of it
The first response sets the frame for everything that follows. Get it roughly right and you have bought yourself time to find out what happened. Get it wrong and you spend the next week correcting yourself, which reads as either dishonest or out of control.
There are really only three moves in that first hour, and none of them require knowing the full story.
- Acknowledge quickly. Silence in the first hour is read as guilt or incompetence, and the gap fills with other people’s version of events. You do not need answers to say, clearly, that you are aware and you are dealing with it.
- Say what you know and what you are doing. Two true sentences beat ten careful ones. State the facts you are sure of, state the action you are taking and stop. People forgive a company that is visibly working the problem far more readily than one that goes quiet.
- Never speculate, and never guess at the cause. “We believe this was caused by…” is how you end up retracting in public. If you do not know, say you are investigating and that you will say more when you can stand behind it.
That last point is the one founders break under pressure, because the urge to explain is overwhelming. Resist it. A confirmed fact tomorrow is worth more than a confident guess tonight that turns out wrong.
To see how that holds together, picture a payments company. Forty people, a card-issuing product, a few thousand businesses relying on it to move money. At 4.50pm on a Thursday, transactions start failing. Not all of them, maybe one in three, which is worse than a clean outage because nobody can yet say what is broken or how big it is. Support starts seeing the same message from a dozen customers at once. Twitter notices before the engineers have finished reading the first alert.
The first hour is not about fixing the outage, the engineers own that. It is about not letting a payments wobble become a story about a company that cannot be trusted with money. So within twenty minutes, before the cause is known, the spokesperson publishes a holding line. It does not pretend to know more than it does. It might read:
We are aware that some payments are currently failing or delayed. We have identified the issue and our team is working on it now. Your money is safe. We will post an update by 6pm, sooner if we have news before then. If you need help in the meantime, reach our support team directly.
That is four sentences and it does the whole job. It acknowledges, it commits to a time, it answers the one question every customer actually has, which is whether their money is gone, and it does not guess at cause. The line buys ninety minutes of patience the company would otherwise spend being described by its angriest users.
Then, around midnight, comes the temptation. The engineers have a working theory: a third-party processor pushed a bad config. The founder, exhausted and stung by a thread calling the product unsafe, drafts a post naming the processor and explaining it was never really their fault. It would feel wonderful to send. It is also a confident guess at cause, in public, before the post-mortem is in, attaching another company’s name to a failure that might turn out to be shared. The move is to not send it. The holding update at midnight is the boring one: we have restored most payments, we are monitoring, full explanation to follow once we are sure of it. The clever version waits for the facts. There is rarely a prize for being first to a wrong answer, and rarely a penalty for being a day late to a right one.
The moves that reliably make it worse
Knowing what to do is half of it. The other half is recognising the failures that turn a manageable day into a memorable one, because they are the defaults people reach for when frightened.
The most common is going silent. The thinking is that if you say nothing, there is nothing to quote and the thing will blow over. It almost never does. Silence does not stop the story, it just removes you from it, and a story told entirely by the people angry with you is the worst possible version.
Close behind it is lawyering every sentence into meaninglessness. Legal review has its place, and there are genuine moments to involve it. But a statement that has been sanded down until it admits nothing, denies nothing and says nothing reads exactly like what it is: a company hiding behind its lawyers. It protects you from a liability you may not have and exposes you to a trust problem you definitely now do. Worse still, the two failures compound: the longer you stay silent, the more the eventual statement gets lawyered, until what finally goes out is both late and empty.
And then there is the founder freelancing on social at midnight, which undoes all of it. Tired, stung, certain they can settle this personally, they post. Sometimes it is a defence, sometimes a counterattack, occasionally an apology that concedes more than anyone intended. By morning it is the headline, and the careful holding line the team agreed at 9pm is irrelevant. This is precisely what the spokesperson rule exists to prevent, and precisely the rule that gets broken first.
The shape is the same outside fintech, though what is at stake shifts. Picture a small foundation, a dozen staff, that runs programmes for vulnerable young people and lives on the trust of a handful of major donors. On a Friday afternoon a safeguarding allegation surfaces, about a volunteer, posted publicly by someone who says nobody listened when they raised it privately. It is the worst possible timing, late in the week, and the worst possible subject, because for an organisation like this trust is not part of the offer, it is the entire offer.
The wrong first hour is the one that comes naturally here: say nothing until the lawyers and the board have weighed in on Monday, because the matter is serious and sensitive and you do not want to get it wrong. But two days of silence on a safeguarding claim does not read as care, it reads as a cover-up, and it is read that way first by the donors whose confidence keeps the lights on. The first hour instead is a short, human acknowledgement that takes the concern seriously without prejudging it: we have seen this, safeguarding is the thing we take most seriously, we are looking into it properly and we will not comment on specifics while we do, because the young people involved come first. It does not admit what is not established and it does not dismiss what was raised.
The pressure here does not arrive at midnight from inside, it arrives a day or two later from the people the organisation most needs to keep. A major funder calls, unsettled, wanting a private assurance that the volunteer has been suspended and that nothing like this could ever have happened on their grant. A trustee, protective of the cause and rattled by the thread, presses the comms lead to put out something fuller, to name the volunteer or to say plainly that the allegation is baseless, anything that makes the worry stop. It comes from loyalty rather than malice, which is what makes it hard to refuse. But a reassurance given to a donor in private that the facts have not yet earned is the safeguarding equivalent of the founder’s post: a confident line, ahead of what is known, that the organisation may have to walk back in front of the very people it was meant to comfort. The disciplined move is to hold the same line privately that you hold publicly. You can be warm, you can be available, you can promise to tell them the moment there is something solid to tell and you can decline to say more than that to anyone, board member or funder, until the process has actually found something. The temptation to defend the volunteer by name, or to deny before anyone has checked, is the founder-at-midnight move in a different costume. The same discipline answers it: acknowledge fast, say only what you know, protect the people the organisation exists to protect and let the facts arrive before the conclusions do.
The honest objection
The fair counterargument is that you cannot plan for a crisis you cannot imagine. You do not know whether your bad day will be an outage, a regulator, a departing employee with a grievance, or something nobody in the room has thought of. So why pretend a page can cover it.
It is a real point, and it is also the reason the page works rather than the reason it fails. You are not trying to script the crisis. You are deciding the things that do not change. Who speaks is the same whether the trigger is a breach or a safeguarding allegation. Acknowledge fast, say only what you know, do not guess at cause: same in every case. The specifics of any given crisis are unknowable. The shape of a good response to all of them is not, and that shape is what fits on the page.
Put another way, the document does not save you. The decisions do, and you can only make them well before the day, because on the day there is no calm version of you available to make them.
The page, more or less
If you wrote it down this afternoon, it would be short. The named spokesperson and their deputy. The rule that nobody else speaks until the line is set. The three first-hour moves. A holding line you can adapt in two minutes rather than draft from nothing. The two or three people who need to be in the room, and how you reach them out of hours. That is most of it.
It will not be perfect, and it does not need to be. It needs to exist before you need it, because the version of you that has to use it will not be in any state to write it.
This is the kind of judgement a Fractional Communications Director is for: the senior voice that knows which decisions to lock down in advance, and why those are the ones that hold on the day, sitting at your table rather than arriving after the fact. The plan itself takes an afternoon to build, well before you have a bad day, and that is about the last time you will need to think about it until you do.
If you do not have one yet, that is the conversation worth having now, not on the day. Book a conversation.