Crisis communication plan: a practical template for PR teams before things go wrong
Build a crisis communication plan that works before you need it. This guide covers all six components PR teams need, with a step-by-step build process.
A crisis communication plan is the document your team reaches for when there is no time to think. If it does not exist before the crisis starts, you are writing it under pressure, which is exactly when mistakes get made.
Most PR teams know this. Most still have not built one. The gap is not knowledge; it is the assumption that the checklist you drafted after the last incident is good enough, or that the plan sitting in a shared drive folder from 2021 still reflects how your organization communicates. It rarely does.
This guide covers what a crisis communication plan needs to contain, how to build one that your team will actually use, and how to maintain it so it does not go stale before you need it. It is written for brand and communications teams, not operations or legal departments, though both will need to be involved.
Table of contents
Jump to each section:
- What a crisis communication plan actually is and what it is not
- Why most brands are unprepared when it matters
- The six core components of a crisis communication plan
- How to build your plan before a crisis hits
- Testing and maintaining your plan
- What good crisis response looks like in practice
What a crisis communication plan actually is and what it is not
A crisis communication plan is a pre-built framework that tells your team who does what, who says what, and through which channels, before anyone knows what the crisis is. It is not a response script. It is not a press release template. And it is not the same as your PR crisis checklist, which covers the sequence of actions in the first 24 hours once a crisis is underway.
The plan is everything that makes the checklist work under pressure: the team structure, the scenario library, the pre-approved holding statements, the stakeholder contact map, and the escalation rules that determine when a situation crosses from an issue into a crisis requiring a formal response.
Done correctly, a crisis communication plan is a living document your team reviews at least twice a year, not a PDF that gets filed after the last incident. The distinction between an issue and a crisis is also worth pinning down before you build the plan. An issue is a problem that can be handled through normal channels with normal response times. A crisis is an event that threatens your organization's reputation, operations, or safety and demands an organized, coordinated response that cuts across normal team boundaries.
Why most brands are unprepared when it matters
The planning gap is real and well-documented. According to the Business Continuity Institute's Emergency and Crisis Communications Report 2025, lack of response from staff remains the leading reason crisis communication plans fail, ahead of technology failures and external disruptions. The same report found that while 75% of organizations carried out crisis training at least once in 2024 and more than 80% exercised their plans, "outdated contact information and poor internal coordination" continue to cause breakdowns when plans are activated.
This is the failure mode that matters most for communications teams: the plan exists, but it does not work because the people in it have not practiced it, the contact list has not been updated, or the scenario assumptions no longer match how the organization communicates.
A separate signal comes from consumer behavior research. Morning Consult's March 2025 survey of 4,410 US adults found that what consumers most want from a brand in a crisis is an apology and an admission of wrongdoing, followed by an update to operating procedures. Social media is their preferred channel for hearing from brands, by a double-digit margin over every other channel. Gen Z respondents, specifically, prioritized a thoughtful response over a fast one at nearly twice the rate.
The implication for PR teams is specific: speed without preparation produces reactive, inconsistent messaging. A thoughtful response is only possible if the thinking has already been done.
Astronomer, the US data and AI startup, demonstrated this cost in July 2025. When CEO Andy Byron and the company's chief people officer were caught on a stadium kiss cam at a Coldplay concert in Boston, the video went viral on TikTok and X within minutes. Astronomer had no holding statement ready.
Patrecia Meliana
According to Axios, the company's eventual delay in issuing any statement was partly due to Byron's slow resignation and exit negotiations. But the decisive failure came much earlier: in the first hour, while leadership decisions were still being made, there was nothing official to fill the information vacuum. Fake press releases, fabricated CEO apology videos, and made-up resignation letters circulated widely and were picked up by news outlets before Astronomer said a word.
Muck Rack data cited in Axios showed more than 22,000 news articles were written about the company in 24 hours. By the time the real statement arrived, many readers could not tell what was authentic.
A holding statement does not require decisions or facts. It just needs to exist before the crisis does. Something as simple as "we are aware of a video circulating online and are addressing this as a leadership matter" closes the vacuum and removes the fuel for fabricated content. That statement can be drafted, approved, and ready to publish in under an hour, but only if a leadership misconduct scenario is already in the plan.
Tommy Prayoga, Head of Agency at digital PR service provider Content Collision, puts it this way: "A crisis communication plan is not about having the perfect answer ready. It is about making sure the right people can move together quickly without waiting for direction that may not come in time. The plan removes the decision paralysis so the team can focus on the actual problem."
The six core components of a crisis communication plan
Use this as a template. Each component should exist as a distinct, named section in your plan document.
Crisis response team roster
Name every member of the core crisis team, their role, and their direct contact information (phone and messaging app, not just work email). Include primary and backup contacts for each function: communications lead, social media lead, legal, operations, customer service, and an executive sponsor who can authorize messaging decisions. Assign one person as overall crisis coordinator.
Scenario library
Document at least five to eight realistic crisis scenarios for your organization. Categories should include product or service failures, data breaches, leadership misconduct, regulatory or legal events, and social media escalations.
For each scenario, note: the likely trigger, the affected stakeholders, the first communication channel, and any legal or regulatory constraints on what can be said publicly. The scenario library prevents the team from starting from zero when a real event hits.
Holding statements
Pre-approve a set of generic holding statements that can be published immediately while the full response is being prepared. A holding statement acknowledges awareness of the situation, confirms the team is investigating, and tells stakeholders where to expect updates.
It buys time without committing to positions the organization cannot yet defend. Examples: a data incident holding statement, a product issue holding statement, a personnel matter holding statement.
Stakeholder contact map
List every audience that needs to hear from you during a crisis, in priority order: employees, customers, partners, media, investors, and regulators. For each, document the preferred communication channel, the responsible sender, and any timing constraints. Employees should almost always be informed before any external communication goes out.
Escalation protocol
Define clear triggers that move a situation from monitoring to active response. Include severity levels (low, medium, high) with examples for each, and specify who has authority to escalate from one level to the next. This prevents the situation where individual team members are uncertain whether to act or wait for direction.
Post-crisis review process
Specify how the team will conduct a debrief after each activation. Name a facilitator, set a default timeline (within two weeks of resolution), and document the questions the review will address: what the plan got right, what it missed, what needs to be updated before the next event.
How to build your plan before a crisis hits
Building the plan from scratch takes a workshop, not a drafting session. The goal is to get the right people in the room and walk through realistic scenarios together, because the plan's value comes from shared understanding, not from the document itself.
A practical build sequence looks like this.
Start with a risk audit. Before writing a single line, identify the five to ten most likely crises your organization could face. Pull in legal, operations, and customer service alongside communications. Each team sees different risk vectors: operations spots product and supply chain exposure, legal identifies regulatory risk, and customer service often knows about service failures before they surface publicly.
Build the team roster first and get sign-off from every name on it. A plan that lists people who have not agreed to their roles will not hold under pressure. Confirm that every person knows they are on the team, what their activation trigger is, and what their communication channel is when the plan goes live.
Draft the scenario library collaboratively. Avoid the instinct to write scenarios from a communications perspective only. The most useful scenario library is built by asking each function what would happen to them in a specific crisis, then mapping the communication implications of that.
Pre-approve the holding statements through legal and leadership before you need them. This step is the one most organizations skip, and it is the most valuable. A holding statement that has already cleared legal review can be published in minutes. One that has not will take hours during the most time-pressured moment your team will face.
Enricko Lukman
Testing and maintaining your plan
A plan that has never been tested is a theoretical plan. It may look complete on paper but will not perform under the cognitive load of a real crisis.
The BCI's 2025 research found that the organizations with the strongest crisis readiness ran tabletop exercises at least twice a year, updated contact information on a rolling basis, and assigned one named owner to maintain the plan rather than treating it as a shared responsibility that belongs to everyone and therefore no one.
A tabletop exercise is a structured simulation where the team walks through a hypothetical scenario in real time, making decisions at each stage as if the crisis were happening now. It does not require live systems or simulated media pressure. It requires a facilitator, a realistic scenario, and honest conversation about where the plan breaks down.
Run one full tabletop per half-year minimum. After each exercise, update the plan to reflect what you learned. Assign every update a named owner and a completion date.
Schedule a contact-list review every quarter. Phone numbers change, people leave, and the legal contact from your last plan may no longer be with the firm. Outdated contact information is, per the BCI data, one of the two most common causes of plan failure in organizations that have a plan.
What good crisis response looks like in practice
The reference case that communications professionals most often cite is Bumble's response to backlash over its 2024 celibacy-themed brand refresh campaign. Within one week of the backlash surfacing, Bumble had removed all campaign assets, published a public acknowledgment on Instagram taking responsibility for missing the mark, made donations to women's organizations, and offered its remaining outdoor media inventory to those same groups.
The response worked not because it was fast, but because it was coherent across every action, channel, and stakeholder in a short window. That kind of coherence does not happen under pressure without prior structure.
CrowdStrike's response to its July 2024 Falcon sensor outage offers a comparable illustration on the product crisis side. When a faulty configuration update caused 8.5 million Windows systems to crash globally, CEO George Kurtz gave televised interviews within hours, acknowledged the company's fault directly, and published a Preliminary Post Incident Review within five days, followed by a full 12-page root cause analysis on August 6.
The UK Financial Conduct Authority's post-incident review of how affected firms responded noted that "firms who had pre-defined communication plans were able to use these to respond quickly," and that organizations with pre-approved communication templates recovered their stakeholder communication posture faster than those without.
The CEO appearing on television within hours of a global outage does not happen by improvisation. It requires a pre-built product outage scenario, a pre-authorized spokesperson protocol, and a holding statement that has cleared legal before the crisis starts.
The lessons from past PR failures point consistently to the same root cause on the other side: no shared understanding of what a crisis response looks like before one is needed. The Dolce and Gabbana 2019 response, the Balenciaga 2022 response, and the Astronomer case in 2025 share the same structural gap: the organization had to build its response from scratch under scrutiny.
The crisis communication plan does not guarantee a perfect response. It removes the structural obstacles that make a good response impossible.
