Article

The Crisis Communications Playbook I Hope You’ll Never Use

Advertising Communications crisis Marketing

March 19, 2025

Unlike every issue that’s come before today, this is one that I’m asking you to download, print, bookmark, save, whatever – but I hope you’ll never need to use it.

This issue is all about crisis comms. Given the current state of :gestures broadly: everything, it seemed that now was as good a time as any to share my thoughts & approach on the topic.

This is the crisis communications playbook that we – myself & the team at Warschawski – have created, refined and evolved over the last decade.

Preparation

I’m going to be frank: no one wants to think about a crisis. Most of us are hard-wired to be positive, to believe that our people are fantastic and that our organization would never find itself in a crisis situation.

That’s a delusion.

Successful crisis preparation starts with being frank & honest with yourself. Even the world’s most fantastically-run businesses have risk profiles. They may be minuscule, but even a small risk can have devastating consequences if left unaddressed or unmitigated (just ask the crew of the Death Star). Your organization is no different.

Scenario Planning

If there’s a single commonality across every successful person (and by extension, organization) I’ve encountered, it’s that each invests an inordinate amount of time and mental energy in gaming out various scenarios and thinking through wide ranges of potential outcomes (that includes both the likely & the black swan events). The reason is simple: preparation matters.

Magnus Carlsen, arguably the greatest chess player to ever live, summed it up nicely when he remarked, “Be well enough prepared that preparation won’t play a role.”

My goal is to never encounter a crisis situation in reality that I haven’t already contemplated & considered in my preparation. The details may differ, but the fundamentals do not. When a crisis hits, the time to create a plan & war-game scenarios is over. The fog of war rolls in quickly – noise is high, signal is scarce, tension is building and emotion is boiling over. That’s hardly the time for planning.

Instead of hoping that a crisis doesn’t strike, proactively mitigate risk through scenario planning.

Fundamentally, this is no different from how the military identifies potential threats and crafts responses, or how chess players practice responding to various openings.

The first step is bringing together a select group of people – usually several members of the executive team, plus legal, PR/Comms, and any relevant SMEs – to identify potential crises, along with their risk profile. Every attendee should come prepared to this meeting with a list of potential crisis situations they believe could pose a threat.

There are likely some situations that most or all members have identified as crisis risks (a hack, an active shooter or attack on a building, a deepfake of a key executive, an allegation of inappropriate conduct, theft of company funds, IP or trade secrets, a death on company property, etc.), along with some that only a few subject matter or technical experts are aware of (a supply chain issue, a system vulnerability, a regulatory issue, a prominent investor being investigated or indicted, etc.).

You can also use AI to support your efforts – spin up a private GPT (or whatever model you prefer), then prompt it with relevant details about your organization and ask it to generate a list of potential crisis situations. If it identifies a few that you haven’t considered, add them to the list for discussion.

Each scenario identified by either your team or AI should be discussed by the full group, with particular attention to the following two sets of questions:

Crisis Probability Factors

Why is this a crisis risk?
What steps – if any – have we taken to reduce this risk?
Who is most likely to be affected by this situation, if it were to occur?
What evidence/factors – if any – increase the risk of this crisis to our organization (for example, we’ve received 3 cyber threats from known hacker groups in the last 2 months)

RIST Factors

How large is the potential REACH of this scenario (i.e. does it impact everyone, or just a sub-segment of an audience)?
What is the level of IMPACT to those affected (i.e., does this have life-threatening implications, like a salmonella infection in a product, or is this a minor inconvenience)?
How relevant or SALIENT is this issue to our core audiences? Does it tie into a broader social movement that could add fuel to the fire?
To what degree/extent does responsibility for this scenario TRANSFER to our organization? If this situation were to occur, how severe could its impacts be on our organization in the short and long-term? Rate using a scale of 0 (none) to 10 (end of the organization as a going concern or worse).

Categorize each situation on a 2×2 matrix like the one below:

Focus your efforts first on planning for the “Highest Priority” and “High Priority” scenarios; if you have the time or resources, then move on to the low priority ones.

Learn From Others

“Those who fail to learn from history are doomed to repeat it.”

It’s true that no two situations are identical, and reverse engineering a crisis plan from public record is an exercise in futility and frustration. But none of that implies that there is nothing to learn from how other people and/or organizations handled (or didn’t handle) previous similar situations.

Like scenario planning, this is another aspect of crisis planning/prep where AI can handle some of the grunt work:

Ask your preferred AI tool (I think deep research & Gemini are excellent for this) to identify instances of companies facing similar situations to each scenario you’ve identified.
Surface relevant articles, media clips, coverage, social media comments, etc. from each situation – paying particular attention to how the organization in crisis responded, how the situation played out, the immediate and long-term impacts, how the conversation evolved as the situation unfolded, etc.

Your goal in doing this should be to understand the range of probable outcomes – along with any unexpected twists/turns each situation could take and how core audiences (customers, investors, employees, partners, regulators) are likely to respond/react. For example, you might find a particular set of high-reach X handles is stirring the conversation each time a specific type of crisis situation occurs, or that certain industry journalists tended to jump to conclusions before the facts were known. These are helpful tactical tidbits that will allow your strategy to be more effective in crafting your own response.

Create Sample Messaging + Quick Response Plans

Armed with both the most probable scenarios and knowledge of how similar situations have played out in the past, you should craft “playsheets” for each potential scenario. These should include:

Immediate Action Steps – if the crisis occurs, what specific questions need to be asked + answered as quickly as possible in order to enable you to respond.
- Who is/was involved?
- What is the scope of the incident?
- When did it start?
- What has been done?
- Is the situation ongoing?
- What is the damage?
Holding Statements – these are responses with fill-in-the-blanks, tailored to specific audiences (i.e. investors, customers, employees, regulators/legislators/elected, media, public).
Core Influencers – who are the people/partners who can help you disseminate information and/or stem the tide of the crisis? These might be community partners or leaders, influential individuals, organizations that are involved or may be asked by the media to opine on the situation, etc. One of the core reasons why we examine previous “similar” scenarios is to identify what individuals/organizations various media are most likely to go to for comment, so you can cultivate relationships with those groups long before they’re needed.
Other Source of Influence – Identify the core sources of influence + information among the most-likely-to-be-impacted audiences. This is a wonderful use case for Sparktoro and/or other audience research platforms – you want to know where key audiences are getting information so you can ensure your response is present where they’ll find it.
Q&A – Based on the research you’ve done, you should be able to identify a core set of scenario-specific questions that you’re likely to get from reporters, customers, employees, online advocates/influencers, etc. Craft initial answers with blanks to each one. It seems small, but in a crisis, you don’t have a few hours to pass Q&A responses back and forth.
Internal Statements + Briefs – draft scenario-specific briefs for each situation that can be distributed to applicable audiences; as with the holding statements + Q&A, include blanks that can be filled in with the particulars.
Social Media Responses – Ensure you have responses tailored to each social platform, again with placeholders.
Level 1 / Level 2 / Level 3 Escalation Paths + Responses – Identify how you’ll respond to this situation in each stage of the crisis (more on that below).

One other thing to mention: if, during your preparation, you realize that a core audience or influential group/person doesn’t have a relationship with your organization or isn’t in regular communication with your organization, change that ASAP. The best time to build relationships is long before you need them; the worst time is when you’re in a crisis.

Actively invest in building both your brand reputation (writ large) and relationships. It’s exponentially easier to defend a well-liked, trusted, credible brand than it is a distrusted or scandal-ridden one.

Confirm The Crisis Team

For each potential scenario, ask who on your team you’d want in the room to deal with that exact situation. Make an actual list. Repeat it for each one.

There will be a few people who are on every list. This might include:
- President
- CEO
- COO
- CFO
- Chairman of the Board
- Chief Marketing / Communications Officer
- CHRO / Chief People Officer
- Outside Comms Exec / Agency
- General Counsel or Outside Counsel
- Head of Investor Relations
- Lobbyist or Public Affairs Exec

Anyone on this list is part of your core crisis team. Endeavor to keep this small – no more than 7-10 people. Crisis situations demand agility and focus, and nothing is more antithetical to that than trying to get 17 executives / decision-makers to agree on anything when emotions are higher than Snoop Dogg on 4.20. Trust me on this. Less is more.

Similarly, there will be people who appear on some scenario lists, but are absent from others. Those people are not part of your core crisis team, but are part of the extended team. You’ll brief them on the playbook, share the scenario plans with them for input, and call on them in the (hopefully unlikely) event their expertise is required.
- Head of IT
- Head of Product
- VP/Head of Compliance
- Head of Engineering
- Lobbyist & Government Affairs
- Executive Director
- Regional/District Exec
- Service Line Executive
- Real Estate & Facilities Lead
- Head of Security

Anyone on this list is a “situational” crisis team member – they are not part of the core team, but will be read into the relevant crisis plan(s) and called upon if and where appropriate.

Needless to say, everyone on the core team must trust everyone else. The last thing you need is interpersonal drama or workplace frustration impeding your ability to manage a crisis. If you do have a concern about the ability of one or more members of the core team to work together, either (a) remove the least valuable and replace with someone else OR (b) pull both (or all, if more than two) aside and give them the opportunity to either work it out or leave. Your crisis team is the dam holding back the flood waters; a single crack can (and often will) lead to failure.

Roles & Responsibilities

There’s a reason why professional teams script roles + plays for critical situations: everyone needs to be crystal clear on what’s expected of them in crunch time. There is nothing worse in a crisis than a disagreement or faulty assumption resulting in an unforced error. The best way to avoid it is to assign roles long before a crisis strikes and practice executing them long before they’re needed.

Here are the core roles to fill:

Primary Decision Maker*

Titles: CEO, President, Chairman, COO

Responsibilities:

Convene the crisis team
Approve all material decisions
Final approval on all communications to key groups (employees, partners, regulators, customers, investors, public)
Approve requests for outside resources & support (i.e., Outside Counsel, Investigators, Forensic Teams, Specialized Experts)

Risk Management & Legal Counsel*

Titles: General Counsel, Outside Counsel, VP of Legal

Responsibilities:

Legal review of all messaging, statements and other releases – provide recommended updates/changes for final approval by the primary decision maker.
Oversee legal team (in-house or outside counsel)
Direct oversight over all compliance + regulatory issues pertaining to the situation

Crisis Communications Leader*

Titles: Chief Marketing Officer, Chief Communications Officer

Responsibilities:

Designate + Train internal/external spokespeople
Create initial drafts of all communications for review by other crisis team members
Manage media, website + social media
Coordinate distribution of information to all relevant audiences
Collect + share data on response efficacy to the crisis team.

Employee + Team Management*

Titles: Chief Operating Officer, Chief Human Resources Officer, Chief People Officer

Responsibilities:

Review all messaging + statements to internal audiences – provide recommended updates/changes for final approval by the primary decision-maker.
Collect + surface relevant internal information (feedback, team comments, new information that’s come to light pertinent to the situation) to the crisis team – this person should have a ‘finger on the pulse’ of your team.
Provide information on overall morale, emotional state of the team, etc.
Share updates to employees

Product + Tech Management

Titles: Chief Technology Officer, Chief Product Officer, IT + Information Security Officer

Responsibilities:

Obtain updates from relevant internal and external teams; translate technical updates/information to non-technical audiences.
Recommend edits/changes to messaging based on relevant technical information
Communicate priorities, action items and requests to technical team(s)

Depending on your industry and organization, you may need other roles in addition to (or in place of) the ones listed above. Those might include: (1) investor & board relations; (2) customer success/customer service; (3) real estate; (4) building security. The essential functions that any crisis team should include are indicated with an asterisk (*) – make sure that you have these roles assigned.

Set Up An Early Warning System

When a crisis situation strikes, your speed-to-response is everything. The faster you know about a potential hot spot, the faster you can be ready to respond. If someone – a reporter, a customer, an investor, a regulator – is calling you about a crisis, you’re already behind the proverbial 8-ball.

Fortunately, there are plenty of tools out there that (for a very low cost) can create an early warning system, alerting you before the crisis fully materializes. These include:

Media Monitoring: most organizations have something like Cision or Meltwater in place, which provides regular (15-30 minute) scans for new articles mentioning your brand. This is like a weather vane on top of your barn: good to have, but not super helpful for avoiding tornados (i.e. if the weather vane goes haywire, it’s already too late).
Integrated Monitoring: this is a platform like Brand24, Brandwatch, or Sprinklr, which provides ongoing, near-real-time monitoring of media, the open web and social channels, including monitoring of images + videos. While these solutions can struggle a bit with paywalls (hence why media monitoring is still good to have), they nail the most important aspect of early warning: helping you follow the conversation as its developing online (read: before the reporters know about it).

You can also configure this to monitor certain accounts and/or for certain words/phrases (for instance, if you believe there’s an unhappy customer trying to stir the pot, or suspect a situation involving an employee/stakeholder, this allows you to get ahead of that).

If/when something trips your early warning system, you can then decide whether or not to pull the crisis alarm.

When To Pull The Crisis Alarm

Put simply, not every potential crisis is an actual crisis – there are times when situations just blow over. There are cases where your organization responding might actually result in the outcome you’re trying to prevent (i.e. a crisis). We use a three-level system to understand what is (and what is not) a crisis:

Level 1 Crisis: this is a concerning situation that has not yet developed into a crisis – it could be online chatter, or an escalating HR situation, or an emerging legal/regulatory disagreement that has the potential to cascade into a full-blown crisis. For most level 1 situations, the best course of action is to alert the crisis team to its existence, then monitor.
Level 2 Crisis: when a level 1 crisis begins to gain traction – either in the form of significant online engagement, preliminary investigations from media, escalating legal/regulatory issues, etc. AND begins to directly impact a small segment of your audience, it is a level 2 crisis. For most Level 2 crisis situations, the optimal response is to alert the crisis team and conduct direct outreach to those individual(s) or group(s) impacted to resolve the situation/avoid further escalation.
Level 3 Crisis: Finally, there’s a Level 3 crisis. This occurs when the crisis situation spreads to the point where it impacts a large segment of your key audience(s), with the potential to cause significant operational, financial and/or reputational damage to your organization. At this point, it is essential to activate the crisis response team and implement your crisis management plan.

Crisis Management Priorities

In every crisis situation, you will have too much to do and too little time to do it. The solution is prioritization. Here’s the list we’ve shared with clients going through crisis situations for over a decade:

Safety + People – Your first priority must be the safety of your people – no one cares about anything else you do IF your people are in danger. Put your people (customers, employees, partners, stakeholders) at the center of your decision-making process. Until they are safe, do not progress down this list. People first.
Trust & Transparency – If you lose trust in a crisis, it is extremely unlikely you’ll gain it back. The highest-probability road to a successful resolution is for your organization to be the go-to source for accurate, timely information on the situation. Share what you can, when you can. Do not evade, speculate, lie, obfuscate or exaggerate. If you are the source of truth, you can help to shape the narrative; if you’re not trusted to be a reliable source of information, you become a bystander in your own crisis.
Response Velocity – Rumor spreads faster than the flu at a daycare. You must be faster. Provide updates to the critical stakeholders as quickly as is reasonably + responsibly possible (i.e. without breaking priority #2). Set clear expectations for when the next update will be provided or when additional information can be expected to be available. A good rule of thumb to follow is the 10-20-60-90: 10 minutes to acknowledge the situation; 20 minutes to confirm the immediate set of pertinent facts; 60 minutes to communicate those facts to core/impacted audiences; 90 minutes to review, assess + update.
Clarity + Focus – It’s easy to get distracted during a crisis situation. Don’t let it happen. Focus on sharing the most important information with the most important people. Keep it simple and straightforward.
Legal Compliance + Risk Mitigation – in just about any crisis situation, assume there’s going to be a lawsuit at some point. Your legal counsel needs to be involved every step of the way. Where possible, ensure your communications are privileged. There’s a difficult balance between what your lawyers want you to say (likely: nothing) and what you need to say (something). Find that balance. Never, under any circumstances, lie. I promise you this: the lie will do more damage than the crisis.

Overarching Messaging Points/Guidelines:

Be prepared to address each of these questions in your communications about a crisis – some you’ll have answers to before others, but (eventually) all of them need to be answered:

What happened?
How did it happen?
What is the ultimate cause of the issue?
Who is responsible for the situation?
Is this an isolated incident, or does it pose a greater risk?
What immediate actions are necessary, if any?
When will the next update be available?
Where can people go to learn more?
What are you doing about the situation?

You should be working as quickly as possible to obtain verifiable answers to each of these questions. Again: do not give in to the temptation to share rumors or spread unconfirmed information.

Remember, a crisis situation is an emotional situation. The more you can share that puts people at ease and conveys a sense of control, the better off you’ll be. It’s also worth mentioning that the best crisis responses balance rationality with empathy: put yourself in the position of your audience. They’re likely afraid, angry, grieving, apprehensive, furious and/or frustrated. Acknowledge it.

Then, move on to what needs to happen next – what do you need them to do? Are there relevant pieces of information that they should know about the situation and/or your response? What are you doing right now to address the situation? When should they expect the next communication from you? Where can they go for more information?

There’s an old saying that there’s no better way to enrage an angry person than to tell him/her to calm down – that’s doubly true in a crisis. Lean in with empathy, follow through with facts.

The Ten Crisis Communications Commandments

As the crisis situation evolves, there will be times when you need to make decisions about what to do or share. Here are the principles I use when making those decisions:

First, Do No Harm: everything you share to any audience during or in the immediate aftermath of a crisis situation should reduce the short- and/or long-term risk posed by the situation. You simply can not afford an unforced error during a crisis situation.
Be Clear + Concise: all communications should be in the simplest possible language. Be clear. Be decisive. Do not be cute, use jargon, be vague or try to evade. If you’re not sure, don’t say it.
Never Lie: the cover-up is always worse than the crime. Trust is the only currency that trades during a crisis, and if you lose it on a lie, it’ll take years to gain it back (just ask Volkswagen).
No Comment Is Not An Option: No matter what the question or situation, responding to a question with “No Comment” will be taken as an admission of guilt. If you don’t know, say that – along with what you’re doing to get the relevant answers or address the relevant situation.
Only Share When You’re Certain: The most common issue for brands during a crisis situation is sharing information prematurely – that is, before it’s confirmed/known/verified. If something is uncertain or unconfirmed, do not share it. If you have to revise it later, it will cost you credibility. This is doubly true for a crisis situation that is spreading via social media – the internet rarely forgives and never forgets.
Know What You Know & Know It Cold: Before you share something, ensure you know it inside + out, backwards + forwards. You must be comfortable with the facts. You must be clear on the uncertainties and unknowns. You must know exactly what is going on, what you’re doing about it, and when you expect to have more information. Even the slightest hint of uncertainty – a stutter, a nervous tick, a fumble – can undo an otherwise exceptional performance.
Everything Is On The Record: Should be obvious, but rarely is – assume EVERYTHING is on the record, unless it is clearly and explicitly agreed to by both parties. Depending on the situation and your level of trust in the other party, consider recording the conversation (with consent, depending on the relevant law). If possible, get any “off the record” confirmations in writing.
Play Offense, Not Defense: One of the biggest mistakes you can make in a crisis is being perceived as defensive – it perpetuates a perception of guilt. Instead, be positive, clear and succinct. Do not hesitate to repeat yourself.
Control The Emotion To Control The Crisis: Crisis situations are fueled by fear, anger, rage and uncertainty. They override reason and rationality. If you want your message to stick, you must keep the emotions under control. When emotions flare, reason goes out the window, and the situation spirals out of control.
Stay Cool, Calm & Collected: Controlling the emotion surrounding a crisis begins with controlling your own emotions. In each appearance, phone call, press conference, town hall, whatever – you (or your spokesperson) must be cool, calm & collected. Be confident in the information you are sharing. Exude confidence in your appearance, voice, tone, body language, posture – all of it. The feeling you want to convey to everyone watching is, “These people are on it. They have it under control, or they have it under control.”

Don’t Be Afraid to Invest In Crisis Comms

It’s always frustrated me that organizations refuse to invest in crisis communications – usually on the basis that “it’s not likely to happen” or “if something happens, we’ll deal with it then.”

On a pure financial basis, crisis management is the equivalent of fabulously under-priced insurance. A single crisis can cost a brand millions (if not billions) in enterprise value – not to mention lost sales, churned customers, reputational damage, legal fees, and more. Put simply: crises are staggeringly expensive.

Hot Paper Lantern, a boutique PR/crisis communications agency, recently shared their findings on a study of 80 companies going through 105 unique crisis events. From this data, they developed a crisis response index that measured the impact of a crisis situation on stock prices, based on the speed + quality of the response:

Response within Hours = 4% Decline
Response within Days = 10% Decline
Response within Weeks = 14% Decline

When you’re faced with data like that, the cost of a crisis communications engagement looks pretty attractive. Again, I hope this is an issue that you bookmark now and never come back to again.

That’s all for this week. I’m headed to SMX Munich to talk about PMAX on Tuesday, so if you’re there, I’d love to say hi.

Until next week,

Cheers,

Sam

Related Insights