Most businesses I talk to don't have a crisis communications plan. Not because they think they're invincible, but because the idea of writing one feels abstract, a bit dramatic, and always less urgent than whatever's due this week. I get it. When things are going well, spending a morning mapping out what you'd do if everything went sideways feels like planning your own funeral.
But after a decade in PR, including a few years in newsrooms before that, one thing has become very clear to me: crises don't announce themselves politely. They arrive on a Friday afternoon, or while you're mid-flight, or the morning your biggest investor is visiting. And the businesses that survive them with their reputation intact aren't the ones with the best lawyers or the deepest pockets. They're the ones who thought about this stuff before the phone rang.
What Actually Counts as a Crisis?
When people hear "crisis communications," they tend to picture the worst-case scenario, a data breach, a workplace death, a front-page scandal. And yes, those count. But most of the crises Payper has helped clients navigate are far more ordinary than that. A disgruntled ex-employee posts something damaging on LinkedIn. A product recall gets picked up by a reporter before you've told your customers. A poorly worded social media post goes viral for the wrong reasons. A key staff member is accused of something publicly.
The common thread isn't severity, it's surprise. A crisis is any event that threatens your reputation and demands a faster, more coordinated response than your normal communications can handle. If you're scrambling, it's a crisis. And the definition keeps widening, because in 2026, roughly 96% of brand crises now spread internationally within 24 hours. What used to be a local problem on page five of a regional paper can become a global conversation before lunchtime.
Why Does Having a Plan Make Such a Difference?
There's a statistic that sticks with me: 73% of brands that invested in crisis management capabilities recovered faster from reputational damage than those that hadn't. That's not because the plan itself is magic. It's because the act of planning forces you to make the hard decisions, who speaks, what we say first, who we call, in calm conditions rather than under fire.
Think of it like a fire drill. You don't run one because you expect the building to burn down tomorrow. You run one so that if it does, nobody is standing in the corridor asking "where's the exit?" The same logic applies to your reputation. The worst time to decide who your spokesperson is, or whether you should comment publicly, or how to reach your top twenty clients quickly, is when a journalist is already on the phone.
Who Should Be on Your Crisis Response Team?
If you're a team of five, your crisis response team is probably three of you. If you're a team of fifty, it's probably still only five or six people. The point isn't to create a committee, it's to name the specific humans who will be in the room when something goes wrong, and make sure each of them knows their role before that moment arrives.
At minimum, you need someone who makes the final call on messaging (usually the founder or CEO), someone who handles media and external communications (your PR person, your agency, or whoever is closest to that function), and someone who manages internal communications so your own team isn't learning about the crisis from Twitter. If you have legal counsel, loop them in, but don't let legal sign-off become a bottleneck that delays your response by hours. Speed matters more than perfection in the first sixty minutes.
At Payper, when we work with clients on crisis preparedness, we always ask them to name these people explicitly and share mobile numbers. Not office numbers, not email addresses. Mobile numbers, because crises don't respect business hours. A contact list that lives in someone's desk drawer is useless at 9pm on a Saturday.
What Should Your Holding Statement Say?
A holding statement is the thing you release while you're still figuring out what happened. It's not your full response, it's your first response, and it buys you time without making you look like you're hiding. Every business should have a template ready to go, with blanks where the specifics get filled in.
A good holding statement does three things: it acknowledges that something has happened, it says you're taking it seriously, and it tells people when they can expect more information. That's it. You don't need to explain everything, admit fault, or speculate about causes. You just need to show that you're awake, you're aware, and you're working on it.
Here's a rough shape that works for most situations:
- Acknowledge: "We're aware of [the incident/the reports/the issue] and are treating it as a priority."
- Reassure: "We're working to understand exactly what happened and are taking steps to [address it/support those affected/prevent further impact]."
- Commit to an update: "We'll provide a further update by [specific time]. In the meantime, anyone with concerns can contact [name/email/phone]."
The instinct for many founders is to say nothing until they have all the facts. But silence in a crisis is never read as caution, it's read as indifference or evasion. The research backs this up: the old 24-hour response window has collapsed to roughly 60 minutes in 2026. You don't need to have all the answers in that first hour, but you do need to have said something.
How Do You Map Your Stakeholders Before Trouble Hits?
When a crisis breaks, most people think about the media first. But journalists are often the third or fourth audience you need to worry about. Before a single reporter calls, you should know how to reach your staff, your investors, your key clients, your board, and your suppliers, roughly in that order.
Stakeholder mapping sounds fancy, but it's really just a list. Write down every group of people who would be affected by, or interested in, a crisis involving your business. Then rank them by how quickly they need to hear from you and how you'll reach them. Your employees should never find out about a crisis from the news. Your biggest client shouldn't hear about a product recall from a competitor. We've seen this with fast-growing companies like Evnex, where the media interest was overwhelmingly positive, but even positive coverage requires coordinating who hears what, and when, across a growing stakeholder base. These are the moments that erode trust permanently, and they're entirely preventable if you've thought about the sequence in advance.
When Farmlands partnered with Payper on their rural wellbeing campaign, one of the reasons the media coverage landed so well was that internal stakeholders, the farmer-shareholders, the staff, the rural communities, were brought along at every step. That same principle applies in a crisis, only the stakes are higher and the timeline is compressed. The organisations that communicate outward in the right order, employees first, then partners, then media, are the ones that hold their people's trust through difficult moments.
Should You Rehearse? (Yes, and It Doesn't Have to Be Painful)
The idea of running a crisis drill makes most small businesses cringe. It sounds like something a corporate consultancy charges $50,000 for, complete with actors and fake news bulletins. But rehearsal doesn't have to look like that. At its simplest, it's a thirty-minute session where you sit down with your crisis team, read out a hypothetical scenario, and walk through the first sixty minutes together. Who calls who? What's the holding statement? Who talks to the media? Who briefs the team internally?
You'll be surprised how many gaps you find. Maybe the mobile number list hasn't been updated since someone left. Maybe nobody is quite sure whether the CEO or the marketing lead is the spokesperson. Maybe your holding statement template references a product you discontinued two years ago. Better to find all of that out over coffee than in the middle of an actual emergency.
Payper is a results-based PR agency, which means we spend most of our time helping clients earn positive coverage. But the clients who've been through a crisis always say the same thing afterwards: they wish they'd done this exercise six months earlier. Running it once or twice a year, even informally, puts you ahead of more than half of all businesses, who have no documented crisis plan at all.
The Social Media Accelerant
Social media is usually where a crisis accelerates, and it's where the temptation to react too quickly is strongest. The rule of thumb is: don't argue, don't delete, and don't go silent. If something is blowing up on social media, acknowledge it there (a short post saying you're aware and working on it), then direct people to your main statement or a dedicated contact point. Trying to manage a crisis entirely through social media replies is like trying to put out a fire one cup of water at a time.
One thing worth noting: whoever manages your social media accounts needs to know the crisis plan exists and what their role is. If your social media is handled by a junior staff member or a freelancer, make sure they know to escalate to the crisis team immediately rather than responding on instinct. Some of the most damaging crisis moments in recent years have come from well-meaning social media managers who replied before the crisis team had even assembled. (If you're wondering how to handle negative press once it's already out there, we wrote a companion piece on what to do when you get bad press that covers the reactive side.)
The Uncomfortable Truth
Every business will face a reputational challenge at some point. It might be minor, a bad review that gets traction, a misquoted comment in the paper. Or it might be serious, a safety incident, a legal dispute, a public accusation. The scale varies, but the principle doesn't: the businesses that come through these moments with their reputation intact are the ones that planned for them, even imperfectly, even informally, even just a little bit.
You don't need a hundred-page document. You need a contact list with mobile numbers, a holding statement template, a clear spokesperson, a stakeholder map, and thirty minutes twice a year to walk through a scenario together. That's it. The whole thing fits on two pages and takes an afternoon to put together. And when the phone does ring at an inconvenient hour, you'll be glad you spent that afternoon.
Get in touch here and we'll give you a straight answer.