A crisis communications plan is the operating control for producing accurate, timely and authorized communication while facts are incomplete and conditions are changing. It should tell the crisis team who can speak, how facts are verified, how messages are approved, which channels are controlled, and how incorrect information is corrected.
1. Define communications command
Name the communications lead, crisis director, legal or regulatory reviewers where required, channel owners and alternates. Define approval authority by message type so routine operational updates do not wait for the same approval path as regulatory notifications or statements involving casualties, liability or market-sensitive information.
2. Separate facts, assumptions and decisions
| Information class | Control | Release rule |
|---|---|---|
| Verified fact | Source and timestamp recorded | May be used in approved messaging |
| Unverified report | Owner assigned to validate | Do not present as fact |
| Working assumption | Explicitly labelled | Use internally unless release is specifically approved |
| Decision | Authority and rationale logged | Communicate to affected audiences according to plan |
3. Build the message workflow
- Capture the event, business impact and latest verified facts.
- Select the affected audiences and required communication objective.
- Draft a short message stating what is known, what action the audience should take and when the next update is expected.
- Route it through the predefined approval path.
- Publish through controlled channels and record the exact released version and time.
- Monitor questions, misinformation, media coverage and stakeholder response.
- Correct material errors through the same channels without silently rewriting history.
4. Prepare holding statements without inventing facts
Pre-approved structures can accelerate the first response, but placeholders must never become fabricated detail. A useful holding statement acknowledges the event, confirms the organization is responding, provides any safe action required from the audience and commits to a next-update time or channel.
5. Control channels and resilience
Record primary and alternate channels for employees, customers, suppliers, authorities, media and the public. Include ownership of websites, social accounts, SMS or mass-notification tools, call centres and internal collaboration platforms. Test how communication continues when identity, email, internet connectivity or the corporate website is unavailable.
6. Set cadence and correction rules
Define who decides update frequency. Silence should be a deliberate decision, not the result of unclear ownership. Material inaccuracies require a traceable correction showing what changed, when and why.
Worked example
A customer-facing digital service fails during a wider technology incident. The first approved message confirms service disruption and the alternate customer channel, while the technical cause remains explicitly unconfirmed. The communications lead schedules updates every 30 minutes, records each published version and monitors contact-centre questions. When investigation disproves the initial suspected cause, no public correction is needed because the unverified cause was never published.
Acceptance checks
- A deputy can execute the process when the communications lead is unavailable.
- Every released message can be traced to verified sources, approvers, timestamp and channel.
- The team can publish through an alternate channel during a primary-channel outage.
- Exercises test approval speed, misinformation handling and correction—not only message drafting.
- Contact lists, credentials and channel ownership are reviewed after organizational change.
Use the stakeholder companion when audience treatment is the problem
This page governs the communications operating process. For stakeholder segmentation, information needs, channel preference, cadence and two-way feedback design, use the Stakeholder Crisis Communication Matrix.
Build a message-control workflow
The plan should define how an observation becomes an approved external statement. Separate source evidence, fact verification, message drafting, legal or regulatory review where required, business approval, channel publication and post-publication monitoring. A communications team may coordinate the workflow, but it should not be forced to decide technical facts or business-risk acceptance. Every material statement should be traceable to an evidence source and an authorized approver.
Prepare for uncertainty explicitly. A holding statement should say what is known, what is being investigated, what affected people should do now, and when the next update is expected. Do not fill gaps with optimistic recovery estimates. If an earlier statement becomes wrong, publish a controlled correction and preserve the superseded version in the incident record.
Channel resilience and audience consistency
Test the channels needed when normal technology is unavailable. Consider the corporate website, contact centre scripts, SMS or notification services, employee channels, regulator routes, supplier contacts and approved social channels. Define an alternate publishing method and an offline copy of essential contact and approval information. The objective is not to publish everywhere; it is to ensure each priority audience receives a consistent instruction through a channel that still works.
Use a message register to prevent contradictions. Record audience, message objective, approved wording, approver, publication time, channel, next review time and correction status. Where different audiences require different detail, maintain a common verified fact base so customer, employee, regulator and media statements do not diverge on the underlying event.
Exercise measurable communications capability
Exercises should inject incomplete facts, changing impact, false social-media claims, unavailable approvers and a failed primary channel. Measure time to first approved holding statement, time to correct a material error, percentage of priority audiences reached, overdue scheduled updates, approval bottlenecks and inconsistent facts across channels. Close findings through named corrective actions and retest them. This turns the communications plan from a document into demonstrated incident capability.
Define update cadence as a control, not a promise
Set the next-update time according to stakeholder need, incident volatility and the team's ability to verify facts. The cadence should have an owner and an escalation rule when the update cannot be issued on time. A scheduled update can state that investigation continues; silence after promising an update creates avoidable uncertainty. For long incidents, use a communications rhythm that aligns with operational briefings so the public narrative and internal decision picture are based on the same verified information.
Preserve an auditable publication trail
Retain the approved message, source facts, approval record, publication channels, timestamps, translations where used, corrections and material audience feedback. During review, compare what the organization knew at each decision point with what it communicated. This distinguishes a reasonable statement made with limited information from an avoidable control failure. The evidence also helps improve templates, approval routes, contact data and channel resilience before the next disruption.
Related BCM.Center resources: Stakeholder Crisis Communication Matrix: Audience, Need, Channel and Cadence.