Updated October 28, 2026.
Short answer: Business crisis management is the work of preparing for, responding to and recovering from events that threaten operations or reputation. Most failures happen before the crisis: no named decision-maker, no pre-approved first statement and no agreed facts. A good plan fits on a few pages, names who decides in the first hour, and is rehearsed at least once a year.
How common are business crises?
PwC’s 2023 Global Crisis and Resilience Survey of 1,812 business leaders in 42 countries found that 91% of organizations had experienced at least one disruption other than the pandemic in the previous two years, an average of three and a half disruptions each. Three quarters said their most serious disruption had a medium or high impact on operations. Yet only about a third had plans and programs in place to manage a similar event.
The gap between confidence and preparation is the core problem. Most companies believe they will cope; few have written down how.
The four phases of crisis management
| Phase | What it covers | Output |
|---|---|---|
| 1. Prevention and readiness | Risk mapping, the crisis team, holding statements, contact lists | A short crisis manual and a rehearsal date |
| 2. Detection | Monitoring that catches problems early: customer service tickets, social listening, staff escalation | Clear triggers for when an issue becomes a crisis |
| 3. Response | Decisions, communication and operational fixes in the first hours and days | A first statement within hours, then regular updates |
| 4. Recovery and learning | Restoring operations and trust, then reviewing what happened | A written review and changes to the plan |
Step 1: Map the crises you can predict
Most crises are not surprises in kind, only in timing. List the realistic scenarios for your business and rate each by likelihood and impact. For most companies the list includes a data breach or cyberattack, a product or service failure, a supplier collapse, the loss of a key person, a damaging post by an employee or executive, and a legal or regulatory action. PwC’s respondents named cyberattacks, supply chain disruption and staff recruitment and retention as the disruptions they worried about most.
Step 2: Name the crisis team and the decision-maker
A crisis team usually has five roles: a leader who makes final calls, an operations owner who fixes the problem, a communications owner, legal counsel and someone who keeps the log of decisions and facts. In a small business one person may hold two roles. What matters is that everyone knows who decides when the team disagrees, and who stands in if that person is unreachable.
Step 3: Write holding statements now
A holding statement is a short first response you can publish before you know everything. It acknowledges the situation, says what you are doing and when you will update. Draft one for each scenario on your list and get legal approval in advance, so that in the first hour you only fill in the specifics.
Example: “We are aware that [what happened] has affected [who]. Our team is [action being taken] and we will share an update by [time]. Customers who need help now can reach us at [channel].”
Step 4: Respond in a way that matches the crisis
Crisis communication research gives a useful rule of thumb. W. Timothy Coombs’ Situational Crisis Communication Theory groups crises by how much responsibility the public assigns to the organization:
- Victim crises (natural disasters, product tampering, false rumors): the company is seen as having little responsibility. Inform people and show care for those affected.
- Accidental crises (technical failures, unintentional harm): moderate responsibility. Explain what happened and what you are changing.
- Preventable crises (misconduct, known risks ignored): high responsibility. Take responsibility, apologize clearly and offer corrective action or compensation.
The most common mistake is using a “victim” response for a preventable crisis: deflecting blame when the public already believes the company is at fault.
Step 5: Communicate in the right order
- People directly affected: customers, patients, passengers, users.
- Employees: they will be asked questions and should not learn the news from social media.
- Regulators and partners where there is a legal or contractual duty.
- The public and the media.
Use one source of truth, such as a page on your site, and update it on a stated schedule even when there is nothing new. Silence is read as either incompetence or concealment.
Two brand responses worth studying
Johnson & Johnson, 1982. After seven people in the Chicago area died from Tylenol capsules laced with cyanide, the company recalled roughly 31 million bottles and later reintroduced the product in tamper-resistant packaging. It was a victim crisis, but the company acted as if public safety outranked short-term cost, and the brand recovered.
KFC UK, 2018. When a change of delivery partner left hundreds of restaurants without chicken, KFC ran a full-page newspaper apology showing an empty bucket with the letters rearranged to “FCK”. It owned an operational failure with humor that fit the brand, and the ad became a widely cited example of an apology that sounded like a person rather than a legal department.
Step 6: Review and rehearse
After every crisis, and at least once a year without one, run a short review: what did we know and when, which decisions took too long, which statements needed correcting. Then run a tabletop exercise on a scenario from your list. Plans that have never been rehearsed tend to fail on simple things such as outdated phone numbers or unclear sign-off.
A one-page crisis plan checklist
- Top five crisis scenarios, rated by likelihood and impact
- Crisis team with named roles and deputies
- 24/7 contact list, stored somewhere accessible if company systems are down
- Pre-approved holding statement for each scenario
- Monitoring triggers that escalate an issue to the crisis team
- Order of communication and the owner for each audience
- Date of the next rehearsal
Bottom line: Good crisis management is mostly preparation: agree roles, approval paths and holding statements before you need them. Rehearse your crisis management plan once a year, and review crisis management lessons after every incident, however small. The brands that handle crisis management well are the ones that practised.
Frequently asked questions
What is the difference between crisis management and crisis communication?
Crisis management covers the whole response: operations, legal, finance and communication. Crisis communication is the part that informs and reassures the people affected.
How fast should a company respond publicly?
Within hours, not days. The first statement does not need every fact; it needs to show you know, care and are acting.
Should a small business have a crisis plan?
Yes. A small business has fewer people to absorb the shock. A two-page plan with a named decision-maker and a contact list is enough to start.
Sources
- PwC Global Crisis and Resilience Survey 2023
- Coombs, W. T. (2007). “Protecting Organization Reputations During a Crisis: The Development and Application of Situational Crisis Communication Theory.” Corporate Reputation Review, 10(3).
Related: Brand storytelling techniques · Building a community around your brand
