Some of the most recognized brands in the world — United Airlines, Boeing, and OpenAI — have faced major crises not because they lacked resources, but because they lacked a clear, actionable plan. The truth is simple: the size of your legal team or marketing budget matters far less than having a ready-to-use crisis communication plan.
For small and mid-sized businesses, this plan doesn’t need to be complex. It just needs to be prepared. This guide provides a practical, step-by-step approach to building a crisis communication plan your team can actually use - before, during, and after an incident, without hiring an expensive agency.
What Qualifies as a Crisis?
A crisis is any unexpected event that threatens your organization’s reputation, operations, financial health, or customer trust. The definition is deliberately broad because modern crises come in many forms, and it is sometimes hard to thoroughly prepare for them all. That's why crisis comms plans are broad, so they can be modified to fit the situation.
The most common mistake small business owners make is either overreacting to minor issues or underreacting to bigger problems. Try and fit crises that come up into one of these three categories:
Level 1 — Immediate Threat
Events that pose a direct risk to safety, legal standing, or business continuity. Examples: data breach, workplace injury or fatality, natural disaster, or harmful product defect.
Response window: within 1 hour.
Level 2 — Reputational Risk
Situations that could cause significant, lasting damage to your brand or customer relationships. Examples: misconduct allegations, public lawsuits, or viral negative social media content.
Response window: within 4 hours.
Level 3 — Monitor and Manage
Smaller disruptions that still require attention. Examples: service outages, clusters of negative reviews, or shipping delays.
Response window: within 24 hours.
By fitting a situation into one of these categories, your first question during any incident shifts from “Is this serious?” to “What level is this, and what’s our plan?”
Step 1: Your Crisis Team
Effective crisis response doesn’t require a large committee. For most small and mid-sized businesses, three core roles are more than enough — provided they are assigned in advance. At smaller companies, one person can be multiple roles.
The Spokesperson
One person, and one person only, should speak publicly for the organization. During Samsung’s Galaxy Note 7 crisis , conflicting executive statements made the situation much worse. A single designated spokesperson prevents mixed messaging and maintains control of the narrative.
The Internal Communications Lead
This person makes sure employees are informed quickly and directly. You do not want your staff wondering what is happening, talking to the media themselves, or posting online. The Internal Communications Lead's responsibility is to keep the company unified and informed.
The Operations Lead
Typically your IT manager, operations lead, or office manager. This role provides the spokesperson with verified facts in real time and coordinates the operational response.
Action Item Today: Store all team members’ personal phone numbers in an accessible, off-network location (a printed sheet of paper and your personal phone notes work great for this). Doing this before a crisis means less time scrambling to communicate with everyone when something happens.
Step 2: Prepare Your 'Dark Room' Materials
In crisis communications, a “dark room” is a secure collection of pre-approved materials ready for immediate deployment. For small businesses, this doesn’t need to be sophisticated — it simply needs to exist.
Holding Statements
A holding statement buys you precious time while you gather facts. When KFC ran out of chicken across hundreds of UK stores in 2018, their witty and transparent full-page ad succeeded because it was prepared in advance. Holding statements typically are not as witty, but poking fun at the situation could help alleviate pressure. Draft 2–3 holding statements for your most probable crisis scenarios. They should be honest, concise, and professional. No fluff.
Stakeholder Contact List
Maintain an updated, prioritized list of who must be notified and in what order — employees, key clients, vendors, legal counsel, insurance providers, and a few media contacts.
Scenario Playbooks
Create simple, one-page decision trees for your most likely crises. Tools like CrisisComs make this much easier with branching workflows, approval processes, and pre-written templates that any team member can follow. If you end up doing it on paper, make sure the right people know where it is.
Step 3: Communicate Internally Before You Communicate Externally
This is one of the most frequently broken rules in crisis management — and one of the most damaging.
Your employees are your first line of defense. If they’re caught off guard, they may unintentionally spread misinformation or appear evasive. Always brief your team first. Again, always brief your team first.
Team — we want you to hear this from us first. [Brief description of the situation.] Here’s what we know so far: [2-3 confirmed facts]. If asked, please direct people to [Spokesperson] at [contact].
Next update by [time]. Thank you.
Step 4: The External Response
Three core principles should guide every public response:
Respond Quickly
Silence creates a vacuum that speculation will fill. Even a short acknowledgment (“We are aware and actively investigating. Full update by [time]”) is far better than radio silence.
Be Transparent
United Airlines’ defensive response to the 2017 passenger incident caused far more damage than the event itself. In contrast, Southwest’s transparent approach the following year preserved trust. Honesty, even when painful, is almost always the better strategy.
Match Your Channel to the Crisis
Respond where the conversation is happening. A viral TikTok issue deserves a response on TikTok. A local news story may need a press release and website statement, or even an appearance on that channel. Meeting people on the right platform demonstrates attentiveness.
The Holding Statement Template
Keep this adaptable template accessible to your spokesperson at all times:
Subject: Update Regarding [Incident]
[Date] | [Time]
We were made aware of [brief, factual description] at [time] on [date].
The [safety / privacy / trust] of our [customers / employees / community] is our top priority.
What we know:
[Confirmed fact one.]
[Confirmed fact two.]
Do not include unverified information.
What we are doing:
Our team is currently [investigating / working with authorities / coordinating with affected parties / resolving the issue].
We apologize for any [disruption / inconvenience / harm] this has caused. We will provide our next update at [specific time] via [channel].
If you have immediate concerns, contact [Name] at [contact information].
— [Name, Title]
Step 5: The Post-Incident Review
The real opportunity for growth happens after the crisis ends. Conduct a focused review within two weeks while details are fresh.
What was the root cause?
Focus on systemic gaps, not individual blame. Turn insights into concrete improvements.
How did our response perform?
Evaluate speed, clarity, internal alignment, and gaps in your plan honestly.
What do we owe our audience?
Follow through on every commitment made during the crisis and communicate those actions publicly. Visible follow-through often rebuilds — and sometimes even strengthens — trust.
Build the Plan Before You Need It
A crisis plan is only valuable if it’s documented, accessible, and practiced. Don’t let it exist only in someone’s head or in an outdated document.
CrisisComs was built specifically for teams like yours — enabling fast, professional responses through smart playbooks, automated workflows, and ready-to-use templates.