Before it happens
The best crisis response is prepared on a quiet day. Agree who decides, who speaks and who signs off. Keep an up to date contact list, a short holding statement template and a list of the regulators and insurers you may need to call.
- One accountable leader and one backup.
- One spokesperson, trained for media, and a second for out of hours.
- A holding statement template you can adapt in minutes.
- Approval paths that do not depend on one person being awake.
The first hours
- 1
Stop the harm
Contain the problem first: pull the product, secure the system, stop the activity. Communications cannot fix what operations are still causing.
- 2
Get the facts
Establish what happened, who is affected and what is still unknown. Write down times. Separate what is confirmed from what is suspected.
- 3
Convene the small team
Leadership, legal, communications and operations. Decide who speaks and what the first message is.
- 4
Tell affected people first
Customers, staff, patients, members or partners should not learn it from the news. Reach them directly where you can.
- 5
Publish a holding statement
Acknowledge the issue, say what you are doing, say when you will update and give one place to find updates. Do not speculate on cause or blame.
- 6
Watch and respond
Monitor news and social, correct errors calmly with facts and keep a log of every enquiry and answer.
Australian duties to check
This is general information, not legal advice. Take advice before you publish anything that carries legal weight.
- Listed companies: ASX continuous disclosure rules require prompt disclosure of information a reasonable person would expect to have a material effect on the price or value of its securities, with limited exceptions. Check with your company secretary before speaking publicly, and ask about a trading halt if you cannot yet announce.
- Data breaches: the Notifiable Data Breaches scheme requires most organisations covered by the Privacy Act to assess suspected eligible breaches promptly, generally within 30 days, and to notify the OAIC and affected people where serious harm is likely. Your communications and your legal duties need to line up.
- Allegations about people or businesses: defamation law is technical. Do not name or imply wrongdoing by others without legal advice.
- Product safety: if a product may harm consumers, recall and notification duties can apply under the Australian Consumer Law.
After the first day
Keep updates regular, even when the update is that nothing has changed. When it is over, review what worked, fix the cause, tell people what changed and update the plan. For longer reputation work such as search results and profile rebuilding, see the reputation ranking.
Sources
Questions
What is crisis communications?
It is the planned way an organisation speaks to affected people, media and regulators when something goes wrong. Good crisis communications is fast, factual, consistent and honest about what is not yet known.
What should a holding statement say?
That you are aware of the issue, what you are doing about it, who is affected if known, when the next update will come and where to find it. It should not guess at causes or blame anyone.
Is it better to stay silent?
Silence usually lets others tell the story. Speak early with what you can verify, and say plainly what you are still finding out. If law or regulation limits what you can say, say that.
Our agency rankings cover 26 agencies. General information, not legal or financial advice. Our method.