How to Create a Crisis Management Plan: A Step-by-Step Guide

Rarely does a crisis happen in isolation. A mechanical breakdown can lead to an emergency medical crisis, which then causes a PR crisis, which may escalate into a financial crisis, and so on. The opposite is also true: A rapid response through a crisis management plan can prevent the effects of even the most serious incidents from spreading.

In 2018, Southwest Airlines learned this lesson in an unfortunate way. Shortly after takeoff, Flight 1380 suffered a partial engine failure that set off a series of events leading to the rapid depressurization of the cabin and fatal injuries to a passenger. The plane was in one of the worst possible situations, with hundreds of passengers’ lives at risk. How the crew and airline executives responded prevented a much more significant crisis.

What Is a Crisis Management Plan?

A crisis management plan is a document that outlines how a business will navigate through emergency situations from start to finish. It contains the different risk management strategies you might use, as well as the step-by-step action plans you might deploy in response to the crisis.

Like other emergency management plans, a crisis management plan is meant to mitigate any potential risks from a crisis, especially those that threaten the success and health of your company.

Steven Kuhr is a crisis and emergency management leader with decades of experience spanning public service and private sector roles. On an episode of The Employee Safety Podcast, he explained why these plans can be so effective at helping organizations prepare to navigate a crisis. “The crisis management plan itself has a number of components, like incident recognition, situational awareness, and social intelligence to help understand risks. If we’re not talking about those things, we’re not understanding what the threats to our organization are.”

Types of Crises: What to Prepare For

From IT outages to outbreaks of COVID-19—both internal and external factors can lead to a business crisis. The resulting damage depends on the severity of the crisis itself as well as your organization’s level of preparedness.

Given the unique characteristics of different industries, it’s difficult to narrow down the list of potential crises that could strike businesses at large. The best way to know which different types of crises you may face on a given day is to conduct a threat assessment to determine your business’s vulnerabilities. You can also do a business impact analysis to better understand the short- and long-term effects that are likely.

Here are some examples of crisis types businesses might encounter that can escalate. For more details on the business impacts of each crisis type, follow this link to the bottom of the page.*

The 4 Phases of Crisis Management

For many organizations, crisis management begins once an incident has been reported and key stakeholders convene to determine the appropriate short-term response. However, organizations that are best equipped to navigate a crisis begin planning long before it takes place.

They are also prepared for many types of threats; every crisis type requires different preparations, responses, and recovery strategies. However, a similar planning process can prepare you for virtually all hazards, so you can work from a template and adapt your strategy from there. Our Crisis Management Plan Template includes pages you can duplicate and complete for the crisis types you identify as organizational risks.

To organize your efforts, you can view your plan from the four key stages of a crisis: pre-crisis, latent crisis, acute crisis, and post-crisis. The goal of any crisis management strategy is to get from phase one to phase four as quickly as possible, so let’s examine how to do so.

Phase #1: Pre-crisis

Think of this as your crisis management planning phase. Spend this time thinking through all the potential crisis scenarios that could occur—as a result of internal and external forces—and examine how you’d respond. Try to fit each scenario into a corresponding crisis type or category. Create a crisis management communication playbook and templates for each category and determine who within your organization will most likely be impacted if the crisis strikes to help prioritize who should be notified and in what order.

Additionally, you’ll want to build your crisis team in the pre-crisis phase. Designate a crisis manager for each scenario and ensure each team member’s contact information is up to date. Consider which individuals from relevant business groups (e.g., business continuity, disaster recovery, HR, PR, etc.) should be involved and their respective roles and responsibilities.

Phase #2: Latent crisis

You’ve identified the early signs of a crisis beginning to unfold, and it’s time to put your crisis communication plan into action. In this phase, you need to focus on preventing the crisis from expanding in size and begin engaging stakeholders as quickly as possible. Remember that you may not have all the answers as the situation unfolds, but you can set the expectation that you will update stakeholders as more information becomes available. Be as proactive as possible in the latent phase to get ahead of the crisis.

Phase #3: Acute crisis

If you successfully contained the crisis during the latent phase, then you don’t need to worry about the acute phase. The acute phase occurs when the crisis continues to develop. Most often, containing a crisis is out of your control, as in the case of a natural disaster or other unforeseen external events. In the acute crisis phase, react to new information as quickly as possible, and keep stakeholders aware of your response with up-to-date messaging. Think through all the various communication channels you can use to disseminate information and leverage a mass notification system to ensure all team members are constantly informed. Lastly, set up a monitoring system to ensure you consistently receive updates on the situation at hand.

Phase #4: Post-crisis

When a crisis passes or subsides, your crisis management work is just getting started. Even if there is no additional information to immediately share, it’s important to remain in contact with your employees, customers, and other impacted stakeholders to demonstrate you are being proactive—particularly during crises that impact their safety. Again, make sure you have a reliable, two-way communication system in place that allows you to get the word out quickly when a crisis occurs.

Finally, work with your crisis management team to conduct an after-action review and analyze how your crisis management plan played out during a real emergency. How did your crisis communication plan perform? Did your audiences have any lingering questions or concerns that you neglected to answer? Integrate any lessons you learn into your crisis management process for future planning.

The Role of Crisis Management in Business Continuity

The role of crisis management is to ensure business continuity. Every business will face a crisis at some point that threatens its ability to operate. Business resiliency is defined by how well your plans stand up when tested. The crisis management plan addresses the immediate impact of the disaster, while the continuity plan ensures that the business can continue to operate even as the crisis unfolds. Together, these plans minimize the loss and damage from the disaster.

7 Steps to Create Your Crisis Management Plan

Every organization has a duty to protect its employees and ensure business continuity. In a crisis, your people rely on you for safety, and your operations need to keep running. Here’s how to create a plan that safeguards your team and maintains business operations.

#1: Start with risk identification and impact assessment

Business crises will vary depending on your organization’s industry, size, and location. While there may be obvious threats to your company (e.g., hurricanes for coastal businesses, a tornado for organizations in the Midwest, and winter storms for those in the Northeast), it’s important to envision worst-case scenarios so your team can plan to meet even the most unexpected challenges that could harm your people and set your business back. The best way to do this is to perform a threat assessment and an impact assessment to measure those threats.

The threat assessment is done to determine the likelihood of specific types of crises affecting your business. For example, for a business on the coast in Florida, there is a high likelihood (almost certainty) that it will eventually be impacted by a hurricane. On the other hand, an active shooter situation may be considered a low-likelihood event.

The likelihood of these threats can then be measured against their impact. In the previous example, let’s say the business is a real estate office. The realtor is familiar with hurricanes and has developed a crisis management plan that involves shifting business activities to unaffected branches and sending employees home ahead of the storm to work remotely. As a result, the impact of the hurricane is low to moderate.

Now, consider the real estate office facing a less likely threat, such as an active shooter situation. The lives of workers and customers are at risk, and such an event would also cause financial and PR damage. As a result, the impact is high.

Knowing which threats are most likely, as well as which have the highest impact, helps you prioritize your planning and responses.

#2: Build your crisis management team

When building your crisis management team, consider filling key roles that are essential for an effective response. These roles might include an Incident Commander to lead the response, a Communication Coordinator to manage internal and external updates, a Safety Officer to assess hazards, and a Medical First Responder to provide immediate care.

Other important roles could be an Evacuation Coordinator for overseeing safe evacuations, an Operations Manager to maintain business functions, and a Documentation Specialist to record the incident for future analysis.

#3: Establish response strategies for potential threats

In step one, you mapped out your threats and their potential impact on your business. Now it’s time to create response plans tailored to each scenario. Returning to the real estate office example—in a hurricane, the response would include things like instructing employees to work remotely, securing backups of key data and files, and preparing the office itself for the hurricane well before it makes landfall.

For an active shooter situation, the response includes ensuring that employees understand how and when to take action, based on real-time information. It also involves coordination with first responders, such as law enforcement and emergency medical teams, to ensure a swift and effective response.

Every crisis type requires a series of tailored steps based on what is needed to keep employees safe and the business operating. Equally as vital is making sure employees know what these steps are and how to follow them.

#4: Create a tech-driven communication strategy

Every single crisis scenario, regardless of type, requires seamless communication with both internal and external parties. Clear, coordinated communication is essential for ensuring safety, minimizing confusion, and maintaining trust. Internally, employees must be kept informed about evolving situations and the actions they need to take. Externally, clients, partners, and stakeholders need timely updates to understand how the crisis may affect them and what steps are being taken to address it.

It’s also crucial to have reliable communication channels in place. Contingency plans should include alternative methods of communication if primary systems fail. Using reliable software solutions to streamline this process can ensure that, even in the face of technical difficulties, critical messages are delivered promptly.

#5: Conduct regular training and drills on your emergency response

Regular training and testing are crucial to build crisis management skills and ensure your team is fully prepared when the time comes. All of the roles established in step two require in-depth training on their responsibilities to ensure the plan is executed seamlessly. It’s important to remember that even the best plan can fail if the people behind it aren’t able to respond effectively in the moment. The only way to support this is through regular training.

Conducting tabletop exercises and other low-stakes simulations allows your team to get familiar with their roles and identify any potential issues. Meanwhile, full-scale emergency drills can test your entire team’s adherence to the crisis response plan, giving you insight into how your business performs under pressure. Prioritize training based on the threats with the highest likelihood and/or most significant impact on your business.

#6: Establish recovery protocols

Recovery protocols move you out of crisis management and into business continuity management as you begin supporting the long-term stability of your operations. This phase is all about restoring normalcy, addressing any lasting impacts, and ensuring your team and processes are back on track. It’s not just about getting through the immediate aftermath but setting your business up for sustained success moving forward.

#7: Complete a post-crisis evaluation

Finally, it’s not enough to create a plan and lock it in place. To truly understand your organization’s response procedures, you need to continuously evaluate your plans. This is where after-action reviews (AARs) come into play. Regularly conducting after-action reports after each crisis or drill gives you valuable insights that help fine-tune your approach. Revisiting and updating your crisis management and business continuity plans every few months based on those insights keeps you ahead of potential issues, closes any gaps, and ensures your team is always prepared for whatever comes next.

The Role of Communication in Crisis Management

Communication can make or break your organization’s ability to overcome a crisis. From a “big picture” perspective, there are three themes that drive the need for an effective communication strategy during challenging times.

Duty of care

Managing your duty of care requires a plan for internal communication. Your duty of care is your legal and moral responsibility to protect your employees from harm while at work centers primarily on your internal communication. Because communication is so critical to maintaining safety during a crisis, this means you have a legal and ethical duty to communicate effectively with your employees during an incident. You are also legally obligated to inform them of any dangers or risks associated with their duties, such as notifying employees of flooding in their area and ensuring they are not putting themselves at risk by driving to the office.

Taking that duty of care seriously is what prepared Southwest employees to tackle the challenges of Flight 1380. Southwest is well known for its positive workplace culture and strong values. The employees involved in that flight attributed much of their ability to respond and navigate the crisis to the company’s culture of making employees feel valued.

Controlling the narrative

Meanwhile, controlling the narrative is about how you handle external communication. With technology at our fingertips, expectations for organizations are higher than ever. Fifteen to twenty years ago, there was no iPhone, no social media, and no way to access information about an incident on-demand 24/7/365. Now, external stakeholders can get up-to-the-minute, near-real-time information on events affecting the company. Whoever shares their information first is likely the first one the public will listen to. In the Southwest case, CEO Gary Kelly took control by admitting fault and apologizing for the accident almost immediately. Statements to the press focused on what was being done to help those affected, rather than shifting blame.

If you can’t communicate, you can’t recover

Ensuring the rapid flow of accurate information is even more critical during a crisis. Rarely does everything go according to plan during an emergency, which is why crisis response leaders need the ability to communicate information and receive feedback from employees. Having a simple, reliable way to follow up with employees during critical events and reach the crisis response team is the best way to ensure your business can weather any emergency.

Studies show that during a crisis, information is as important to people as food or water. Not only can accurate information mean the difference between life and death, but it can also provide reassurance that response and recovery are truly underway.

Proactive Crisis Communication for Safeguarding Your People and Operations

Every organization, regardless of size, will experience a crisis at some point. However, with a strong emergency communication plan and modern technology tools, leaders can influence positive outcomes and prevent these incidents from escalating. While not every crisis will threaten the safety of your people, they all pose risks to your operations and reputation.

During any type of crisis, you need a reliable emergency notification system at hand. AlertMedia allows you to go a step further and communicate with your people via multiple channels like text, mobile app, phone calls, email, and even business communication platforms like Slack or Microsoft Teams—all at the same time. Taking a proactive approach to communication during a crisis can help de-escalate threats, ensure employee safety, and keep your business up and running no matter what obstacles are thrown your way.

* Business Impacts of Various Crisis Types

Financial crisis

When a company falls short of financial expectations or faces unexpected costs, it shakes investor confidence and can force tough decisions like layoffs or budget cuts. The ripple effect includes a drop in stock prices, challenges in securing funding, and stunted growth.

Personnel crisis

Whether it’s a high-profile employee scandal or a mass walkout, personnel issues can hurt a company’s morale and image. The fallout often includes legal headaches, damaged team spirit, and a tarnished reputation that’s hard to rebuild.

PR crisis

Bad press can quickly snowball, tarnishing a company’s reputation and driving customers away. The damage control can be costly, leading to lost sales, boycotts, eroded trust, and a long road to repairing public perception.

Technology crisis

When critical systems go down or a cyberattack hits, it can bring business to a standstill. The impact is immediate: lost revenue, potential data breaches, and the urgent need to invest in stronger tech defenses.

Workplace injuries and accidents

Accidents at work are more than just a safety issue—they can lead to legal battles and hurt a company’s reputation. The aftermath includes fines, higher insurance premiums, and a potential loss of trust among employees.

Workplace violence

Violence at work doesn’t just harm those involved; it shakes the entire organization. The consequences often include physical and psychological harm, legal liabilities, a frightened workforce, and difficulty in attracting new talent.

Severe weather

When extreme weather strikes, it can disrupt operations and damage facilities, leading to costly repairs and delays. The business impact is felt in production slowdowns and supply chain hiccups that frustrate customers.

Natural disasters

Disasters like earthquakes, tsunamis, or hurricanes can devastate infrastructure and halt business. The financial burden includes repair costs, potential loss of inventory, and significant operational downtime.

Environmental crisis

An environmental mishap, like an oil spill, can lead to heavy fines and a backlash from the public. The potential impact includes costly cleanup efforts, legal fees, and a hit to the company’s reputation.

Supply chain crisis

When the supply chain breaks down, it creates a domino effect that delays production and disappoints customers. The result is lost revenue, increased costs, and strained relationships with clients.

Civil unrest and demonstrations

Protests or civil unrest can disrupt business operations and pose safety risks. The impact can include operational delays, damage to property, and a negative public image that lingers long after the crisis ends.

Labor strikes and union actions

Strikes can grind operations to a halt and spark public debate about company practices. The consequences often include significant financial losses, a hit to the brand’s image, and prolonged service interruptions.

Product recall

A recall due to safety concerns can be a costly and reputation-damaging event. Beyond the immediate financial burden, it shakes customer confidence and can tarnish the brand for years to come.

Economic crisis

Economic downturns squeeze companies, forcing them to rethink strategies and often downsize. The result is tighter margins, decreased profitability, and tough decisions that impact employees and customers alike.

Health crisis

Health emergencies, like pandemics, can turn business operations upside down. The challenges include keeping employees safe, managing disrupted supply chains, and dealing with lost revenue as the situation evolves.

Data breaches and privacy violations

When customer or company data is compromised, it’s not just a technical issue—it’s a trust issue. The fallout includes regulatory fines, legal battles, and a tarnished reputation that’s hard to rebuild.

Intellectual property theft and corporate espionage

When a competitor steals proprietary information, it’s a blow to a company’s competitive edge. The impact includes financial losses, legal challenges, and the need to rebuild what was stolen.

Mergers and acquisitions issues

Failed mergers or rocky integrations can lead to financial loss and shake up the workforce. The aftermath often includes lost business opportunities, internal chaos, and damage to the company’s reputation.

Fraud and corruption

Scandals involving fraud or corruption can bring a company to its knees, both financially and reputationally. The impact includes legal repercussions, regulatory fines, and a loss of trust that can take years to recover from.