What Is a Crisis Management Plan?
A crisis management plan (CMP) describes how your business will react to a crisis, including who will be involved and what they will do. The plan strives to minimize harm and restore operations as soon as possible.
Crises come in many forms, but generally they threaten your organization’s operations, reputation, finances, or strategic objectives. Some crises jeopardize lives, health, and safety. The crisis management plan is a key piece of crisis management. To read more about crisis management please visit our "The Essential Guide to Crisis Management" article.
According to a 2018 Deloitte survey of large companies around the world, 84 percent have a crisis management plan, up from 49 percent, according to a similar Deloitte survey on crisis management from 2015.
Importance of a Crisis Management Plan
Having a crisis management plan is critical because, without one, people under stress may make poor decisions and may unintentionally extend or worsen a crisis. Taking swift, constructive action may be the key to your organization’s survival.
In the wake of a crisis, a plan keeps employees focused on an organization’s top priorities and combats fear and uncertainty that can compound the damage. Moreover, the exercise of creating a plan helps you to identify threats, minimize their likelihood, and improve the response.
A strong crisis management plan is also essential because emergencies and disasters are more common than many people realize. In 2019, consulting company PwC interviewed more than 2,000 senior executives around the world and found that 69 percent had experienced at least one corporate crisis in the last five years; in fact, these executives experienced an average of three crises during that same time period.
These crises fell into almost 20 different categories, the most common being a financial or liquidity-related crisis, a technology failure, and an operations failure. Cyber crime, natural disasters, viral social media, and leadership misconduct also featured prominently on the list.
Planning helps a company contain and mitigate the negative effects of a crisis, which can include damage to reputation, loss of operations, and legal or regulatory trouble. A crisis can even close down a company. A quintessential example of a corporate crisis is the case of the Enron Corporation, which collapsed in the early 2000s over a scandal that started with falsified accounting. To learn more, find other examples of poor crisis management and communication and how they could have potentially been avoided.
According to the Federal Emergency Management Agency, 40 to 60 percent of small businesses cease operations after a disaster.
Purpose of a Crisis Management Plan
A crisis management plan prepares an organization to cope with an unexpected calamity in the following ways: It shortens and lessens the impact of a crisis; it protects employees and anyone else affected; it preserves operations and productivity as much as possible; and it safeguards a company’s reputation.
Crisis planning seeks to make your company more resilient and more capable of weathering the long-term effects of a crisis. The PwC study cited above found that organizations that had a crisis response plan in place fared better (after a crisis) by a margin of nearly two to one. In fact, 41 percent of those companies with plans emerged stronger than before, and 39 percent saw their revenue grow as a result.
The CEO and other senior executives at an organization are largely responsible for making sure a crisis management strategy exists. However, crisis management planning is the responsibility of the crisis management leader and their team, along with support from the business continuity, risk management, legal, and other specialized departments. For details on crisis management strategy, see “How to Craft Crisis Management Strategies.”
Developing a Crisis Management Plan: 10 Items to Include
An effective crisis management plan has 10 essential elements. These include a risk analysis, an activation protocol, a chain of command, a command center plan, response action plans, internal and external communication programs, resources, training, and a review.
The crisis management team is largely responsible for creating the crisis plan. All team members have input, and the team also consults other stakeholders, such as the operations staff and senior management. The plan spells out important roles in the crisis response and each person’s responsibilities. For in-depth instructions on how to form a crisis team, see “How to Build an Effective Crisis Management Team.”
“A good crisis plan possesses a variety of elements that prepare crisis team members to effectively perform their duties when a crisis occurs,” explains Deborah Hileman, President and CEO of the Institute for Crisis Management. “You should include team roles and responsibilities, the chain of command, the operations center details, the command system structure, and communication, mitigation, and recovery activities. You should also include protocols that are specific to certain common scenarios.”
Because emergencies are unpredictable — and crises rarely unfold exactly as you’ve rehearsed — your crisis management plan must be flexible and practical. Therefore, make sure that your plan can adapt to changing circumstances and that you can realistically execute it under pressure.
You should cover the following 10 components in your plan:
- Risk Analysis: Outline the scenarios you think your organization could face. Having a more specific sense of these potential occurrences will guide your planning. You do not need to include every conceivable risk, but cover a broad range, such as a natural disaster, a cyberattack, a loss of utilities, a technology failure, the death of a CEO, a shooter in the workplace, a financial crisis, an operational accident, and a product failure.
- Activation Protocol: Be sure to include triggers for the crisis management plan, as the natural first response to an emergency is often paralysis. Using levels of urgency as your criterion, define the circumstances that activate a particular crisis response. In addition, explain how to escalate that response, in the event that a crisis turns out to be more serious than it first appeared. Based on the type or location of the incident, the protocol should also direct your staff on how to respond. And, the protocol should establish some type of communication that signals the end of a crisis.
- Chain of Command: Include a crisis management-related organization chart in your plan, so it’s clear who has final authority and who reports to whom. Making a well-defined org chart supports coordination and consistency, which decentralized organizations sometimes struggle to achieve. Depending on the seriousness of the event, your plan may call for additional layers of command. For example, an emergency at one site may activate the response team and leader at that particular site, but a company-wide crisis may require a headquarters crisis team that has regional teams operating underneath it.
- Command Center Plan: Determine what will serve as the base of operations for the team during a crisis. In addition, indicate what supplies and utilities the team will require. In the event that the first command center is unavailable, you will also need to designate a backup command center. Please see below for complete details on setting up a command center.
- Response Action Plans: Perform detailed planning around how you will respond to various scenarios. This planning includes assigning responsibility for each task. Think of these response actions as modular elements that you should employ as the situation requires. Conceptualizing crises in this way makes your crisis management plan adaptable.
“The best plans use an all-hazard approach, meaning you don’t write plans with a specific crisis in mind, but rather with all potential hazards in mind. Using this method ensures that you’ll have a consistent response and a team that’s always ready, regardless of the nature of the incident,” recommends Regina Phelps, Founder of crisis management consulting firm Emergency Management & Safety Solutions. - Internal Communication Plan: Create systems and backup methods for members of the crisis management team to communicate with each other. Collect contact information for all team members as well as anyone they might need to call upon, including outside consultants and subject matter experts. You must also establish ways to disseminate urgent information to all employees, such as using a notification provider to send texts and automated calls or implementing a method for your employees to check in and report their safety and whereabouts. Determine how you will share sensitive news internally, such as a threat to the company’s viability or a loss of life. In addition, don’t forget to establish a schedule and mechanism for updates.
- External Communication Plan: Define plans for communicating with the public and key external stakeholders. Appoint a spokesperson. Write detailed instructions, including whom you will notify (e.g., media outlets in a particular geographic area). Also, draft holding statements, the details of which you can fill in later, once you have the relevant information. Prioritize your strategic communication objectives and outline talking points. Make sure your plans align with other communication efforts. Be ready to create a special website or telephone line to answer consumer or community questions.
- Resources: Think about everything the crisis management team might need, from hardhats to credit cards and a standby public relations advisor, and line these things up. Information resources will be especially important in a time of crisis. These resources include many kinds of stakeholder agreements, including union contracts, maps of facilities, timelines, flowcharts of key processes and procedures, supplier contracts, benefits information, and more.
- Training: Being able to execute your crisis management plan quickly is paramount, and holding drills and exercises with the crisis management team is crucial to that goal. Rehearsals or even tabletop drills can reveal flaws in the plan, and practice will help the crisis team become comfortable with their individual roles and work together. Make sure to stay current by doing regular training. In addition, provide training to other staff members based on their particular jobs, such as showing a warehouse manager how to use a fire extinguisher, explaining to a production associate how to stop an assembly line, or teaching an executive assistant how to respond to a media phone call.
- Review: Create a structured review process in order to schedule regular follow-up check-ins regarding your plan. As your business or the risk environment changes, you will need to update your crisis management plan. After an actual crisis, the team should analyze what went well and what did not. Identify important lessons, and implement any necessary changes.
Corporate Crisis Management Plan Template
Use this free template to draft your own crisis management plan, including all the elements outlined above. The template offers a crisis management plan example, and also includes space for a risk analysis, the chain of command, communication plans, and more.
Download Corporate Crisis Management Plan Template
For more free crisis management templates, check out “Free Crisis Management Templates.”
Five Steps to Make a Crisis Management Plan
The five steps for drafting a crisis management plan are ground rules and risk assessment; business impact analysis; response and contingency planning; training and coordination; and review. Follow these steps to create a plan with all the essential elements.
Crisis Management Plan Step 1: Ground Rules and Risk Assessment
Once you have established your crisis management team, review your organization’s mission and values, and make sure your plan reflects those goals. Keeping your company’s overall mission and values front and center will ensure that your decisions prioritize honesty, transparency, and respect for lives and communities. Next, be sure to identify your organization’s top strategic priorities in a crisis, such as the ability to continue fulfilling orders.
“A good plan starts by outlining the strategic objectives for an organization that is dealing with a disruption. Create your plan within the context of an all-hazards crisis management framework that clearly prioritizes life safety,” says Bryan Strawser, CEO of Bryghtpath LLC, a crisis management advisory firm. Strawser is also the former leader of the Target Corporation’s crisis management and business continuity function.
Identify all the potential types of crises that your business is likely to face, and then rank them by probability and severity. Your core plan will include responses that apply to the most probable crises.
Determining probability will also require an analysis of your vulnerabilities, because they may play a role in an internally caused or exacerbated crisis. For example, if you have inadequate handling protocols for volatile chemicals, an explosion or fire is much more probable. This process will shine a light on weaknesses and give you an opportunity to address them early on, possibly preventing a crisis from occurring.
The nature of your business will determine the specific risks and vulnerabilities that you assess. However, every organization should start with some standard assessment questions about the overall risk culture and the risks to major functions and processes. Use this template to work through risk assessment questions that apply to virtually any organization.
Download Business Risk Assessment Questionnaire
Once you’ve identified potential risks, you can use the following risk management matrix template to rank them. By evaluating both the potential likelihood of the crisis and the expected severity of the impact, you can prioritize risks for mitigation.
Download Risk Management Matrix Template
Excel | Word | PDF | Smartsheet
Next, you’ll need to create a plan for how to address the vulnerabilities you’ve identified. Use this remediation plan template to keep mitigation work on track by collecting information such as who is responsible, the steps they will take, and the milestones.
Download Remediation Plan Template
For more specialized assessments, such as IT vulnerabilities or facility vulnerabilities, use the templates from “Free Vulnerability Assessment Templates.”
Consider the early action or preparation that could prevent a crisis from blossoming, such as stockpiling materials or doing predictive maintenance. Incorporate these considerations into your crisis management plan.
As part of your risk assessment, identify the typical warning signs for each crisis, so you can be alert to them and respond early. If you are unsure about whether an incident constitutes a crisis, ask the following questions:
- Is this event likely to interrupt normal operations?
- Will the incident reflect negatively on the company or undermine the trust and confidence of customers, regulators, investors, or other stakeholders?
- Will this event draw unwelcome scrutiny from regulators or the media?
- How likely is this event to worsen and what would be the impact?
Some warning signs are clear, event driven, and concrete, like a weather forecast. Others are more subtle and unfold over time.
For example, the financial symptoms of a brewing crisis would be negative cash flow, insufficient operating income to cover operating expenses, a reliance on credit and debt, a declining stock price, and falling sales. The warning signals of a sales crisis include a lack of repeat business, a change in industry fundamentals, and a circumstance in which a majority of revenue comes from one or a handful of customers.
Operational warning signals include recurring problems with equipment, control systems that do not activate soon enough, unexplained anomalies in processes, rising quality-control issues, high turnover among staff, and problems with unions.
Part of the challenge in identifying warning signals is being able to discern them from the everyday problems that may vex an organization. Both individual and organizational biases (such as a preference for information that reinforces existing beliefs and groupthink) can stand in the way of perceiving true crisis signals. Experience and expertise are vital to recognizing the signs of a crisis and interpreting those signs correctly.
For example, regarding the 2010 Deepwater Horizon oil leak in the Gulf of Mexico, BP later said that the operating crew had read signals of the looming disaster, but had interpreted them incorrectly and decided they weren’t serious. This misinterpretation led to a blowout that reached massive proportions.
Crisis Management Plan Step 2: Business Impact Analysis
The next step is performing a business impact analysis (BIA), in which you refine the predictions of likely impacts on your business from the risk assessment. Focus on the most probable scenarios first.
This calculation involves a detailed analysis of a crisis’s financial and other consequences to your business, including disruptions in production, processes, the delivery of services, and other activities. These consequences may include lost sales, regulatory fines, and damage to your reputation.
For instructions and templates to help you perform BIA, see “All about Business Impact Analysis: A Step-by-Step How-To.”
Crisis Management Plan Step 3: Response and Contingency Planning
Response and contingency planning prepares your business to deal with the practical aspects of an actual crisis. In your crisis management planning, this step is likely to be the most significant.
First, determine how your company should respond to the crises you’ve identified as both probable and potentially having the greatest negative impact. Rarely does a crisis unfold exactly the way you planned, so your base plan should be informed by an all hazards approach, meaning that it should be adaptable to a wide variety of circumstances.
A good way to achieve this versatility is to think of your response actions as modules or elements that you can add when necessary. These actions could include the following: shutting down production; calling emergency services; issuing a holding statement; reviewing relevant legal issues; evacuating a facility; communicating with regulators; getting an emergency line of credit; offering counseling; taking security measures; notifying senior executives; turning off utilities; and recalling products. Then, match the most likely risk scenarios with the necessary response elements.
For example, the contamination of a food product would activate the following responses: shutting down production; issuing a holding statement; notifying senior executives; recalling the product; communicating with regulators; reviewing the relevant legal issues; and possibly getting an emergency line of credit.
For instance, while your response to a warehouse flood would obviously be different from that to a food contamination issue, it would include some of the same actions. To create a more complete all-hazards portfolio for this particular case, add other modules, such as putting property defenses in place, relocating moveable assets, contacting an insurance adjuster, and lining up a specialist to repair water damage.
Because novel crises (like a pandemic) require unusual measures, you will generally cover those in annexes. But, even these additional sections will incorporate some of your core response actions, such as activating work-from-home protocols.
You must spell out the actions you identify. Assign specific, realistic roles to teams or individuals. Also, create a detailed timeline during which various sequential actions must occur in order to respond properly to a particular disaster.
For each scenario, think about the cause of the crisis and ways to prevent it. You should also consider the tools and resources you would need for the crisis response, as well as how long the crisis would probably last, how the crisis would affect customers, and how you would respond to that impact. For examples of actual crisis responses, see "The Most Useful Crisis Management Examples: The Good, Bad, and Ugly".
Additionally, consider other potential key stakeholders, whether you would need help from external specialists, and how you would coordinate with other emergency protocols in your organization. Also, if relevant, determine how the crisis would affect your ability to comply with regulatory requirements.
“The plan should outline the escalation and communication of decisions to the executive team and/or the board of the organization, and it should also address how you reach decisions,” notes Strawser. “Finally, the plan should reference applicable industry standards as well as plan annexes that you’ve adopted in order to offer scenario-specific guidance.”
Communication planning is a vital part of the response and contingency step. Identify the best spokesperson for various crises (the CEO or other C-level executive should serve as the public face in very serious calamities). However, in general, the most knowledgeable person concerning the affected function is ideal. If your organization has a dedicated communication representative, they would also make a logical choice.
Draft key messaging and talking points for both internal and external stakeholders, and plan how and when you will communicate during the crisis.
Use the templates in “Free Crisis Communication Templates” to draft a detailed crisis communication plan and to develop plans for specific organizations, such as schools, hospitals, and restaurants.
To learn more about crisis management theory, see "Models and Theories to Improve Crisis Management".
Because most people initially respond to crises with confusion and inaction, it’s crucial to make sure your plan clearly identifies the triggers that activate a crisis response. Also, make sure that you articulate clear signals for returning to normal operation.
Crisis Management Plan Step 4: Training and Coordination
Once you have fully developed your crisis management plan, shift your focus to ensuring that team members and other key staff know how to perform their roles. You should also coordinate with other stakeholders. In addition, be sure to alert suppliers and contractors, so they can support your emergency response.
Provide all crisis management team members with the plan. Print hard copies of the plan and distribute them at the designated command location. Also, make sure to store the plan electronically, so your employees can access it from their mobile devices.
Immediately after you introduce the plan, train everyone so that they are comfortable with their duties and with working together. Then, perform drills and tests on a regular basis (e.g., once a quarter).
Provide your employees with information that is relevant to their respective positions. For example, disseminate the protocol for working remotely and for resuming in-office work. In addition, communicate to your workforce its responsibilities under the business continuity plans.
Make sure that you keep the plan up to date and fresh in the minds of your staff members. Mike Fagel, Ph.D., CEM, veteran crisis management leader/instructor and Founder of Aurora Safety, an emergency response consulting firm, urges companies to support crisis planning by allocating resources to staff, including time for training and financial investment.
“People often come to me and say, ‘Remember us? You helped us with a plan in 2003. You said to train, to budget, and to allocate resources. We should have listened to you. Now, we’re in a crisis. What do we do to get ourselves back on track?’” Fagel says.
“Pointing fingers after the fact does no good. We don’t have time to look in the rear-view mirror. We have to look forward and drive ahead,” he adds.
Crisis Management Plan Step 5: Review and Update
In order to keep your crisis management plan current, schedule a regular review of its contents.
When updating your plan, make sure to incorporate any relevant, recent changes to your business. Consider changes in processes, suppliers, facilities, and staff when making your updates. Crisis management experts recommend reviewing your plan at least once a year.
If you have a crisis, do a review of the response, and incorporate the lessons on strengths and weaknesses into your plan.
Crisis Management Action Plan
A crisis management action plan differs from a base crisis plan by focusing on the sequence of steps in your organization’s response, stabilization, and recovery. While the two plans overlap substantially, an action plan is usually structured around a timeline.
You can also make a crisis management action plan into a stripped-down version of your crisis management plan that focuses on concrete actions, rather than policies, organization charts, etc.
While a crisis management plan is comprehensive, an action plan can act as a quick-start guide. For this reason, an action plan can serve as a highly effective tool during the heat of a crisis by quickly letting you know what you should do next.
Use this crisis management action plan template to record key contact information, plans, and procedures for recovery and restoration.
Download Crisis Management Action Plan Template
Word l PDF l Smartsheet
Crisis Management Plan Checklist
When you finish your crisis management plan, make sure it is clear and complete. Cover all the essentials, and evaluate the plan’s readability and ease of use. You may want to include a crisis management plan executive summary.
Make the plan highly accessible and searchable by incorporating bullets, numbered lists, and an outline or a table of contents.
Then, assess your plan based on this checklist of questions:
- Does your plan reflect your organization’s mission and values?
- Do you have measures to identify crisis warning signs?
- Do you have the contact information for all members of the crisis management team, as well as those for key advisors, stakeholders, and support services?
- Do your crisis scenarios represent a range of the most probable emergencies for your organization?
- Have you identified core response action elements?
- Have you mapped the response actions to the crisis scenarios?
- Have you planned for crisis communication?
- Is there a clear chain of command in the crisis team?
- Have you established a signal to communicate when a crisis has occurred and when the situation is all clear again?
- Does your crisis plan include procedures for assessing the severity of an event and its impact?
- Have you included the training and plans that you need to update?
- Have you identified and set up a command center?
- Have you identified and obtained all the necessary back-up resources?
Establishing a Command Center for Crisis Management
As part of your planning, you need to establish a base from which the crisis management team can oversee the crisis response.
Designate a command center and a backup location for each team. Make sure that one of these locations is an off-site room (separate and apart from your company’s main location). The room should be accessible 24/7 and have power, a network, Wi-Fi, phone connections, and a strong cell signal in order to accommodate all team members.
If possible, select a room that’s close to bathrooms and a shower. Ideally, this location will also have space nearby that you can convert into a lounge or nap area, if necessary.
Equip the center with a conference table, chairs, a large whiteboard, videoconferencing capability, a projector and screen, cable-connected televisions, computer workstations, a network connection, office supplies, bottled water, and nonperishable snacks.
Make Better Decisions, Faster with Smartsheet Dashboards
Empower your people to go above and beyond with a flexible platform designed to match the needs of your team — and adapt as those needs change.
The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed.
When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time. Try Smartsheet for free, today.