Prevention is better than cure, but when it comes to crisis management, businesses are often only willing to seriously tackle issues when they become a major operational and/or reputational threat.

Of course, a huge amount of time and resources could be saved if these issues were better prepared for, headed off earlier, or even prevented from happening altogether. But how do businesses get into the crisis mitigation and prevention game?

Fundamentally, this work is built around collaborative risk mapping.

Building a Crisis Management Team

For most large organisations, this starts with the legal and/or risk function, which should have the best overview of operational and regulatory risks. This knowledge forms the baseline of risk mapping and assessment.

A representative from the finance team can provide a horizon scan of any issues around overall or business unit performance and profitability. Importantly, any crisis management (or better yet, crisis prevention) team should also include a senior representative from the HR team, with insights into ongoing investigations into inappropriate behaviour, recurring complaints in a specific area of the business, potential rounds of redundancies, or other personnel-related concerns. An IT representative should be a part of the group to cover the all-important cyber risks, outages and security measures.

And of course, the team should also include a senior communications representative. If internal and external communications are managed by separate teams, representatives from both functions should actively participate.

This cross-functional group will form the core of any serious crisis preparedness team, meeting at least once a quarter to discuss and assess the severity of risks in key categories, steps to mitigate these risks, and plans to manage potential fallout. 

Of course, there are also crises for which businesses will have little or no prior knowledge, such as natural disasters, major geopolitical shifts, terrorist attacks, or even war. For these unpredictable scenarios, proactive preparation is just as critical. But aside from the regular meeting of the crisis team, how best can companies prepare in an uncertain and destabilised world?

Annual Tabletop Exercises 

One essential aspect of crisis preparation is conducting annual tabletop exercises. These exercises simulate different types of crises and test the organisation’s response mechanisms in a controlled environment. These simulations help identify gaps in your current crisis management plan and provide an opportunity for teams to practice communication, decision-making, and collaboration under pressure.

The scenarios should include a mix of operational crises, such as a major accident or supply chain disruption, and reputational crises, such as an employee scandal or backlash over a product or service failure. Each session should be documented, with clear lessons learned and updates to the crisis management plan as needed.

Messaging Audits

Another key component in crises preparedness is auditing your organisation’s messaging, which can also be helpful in identifying operational weaknesses – if your organisation doesn’t have a good answer for something, it could be because you don’t have clear policies or enough investment in a given area. 

Ensure that your internal and external communication frameworks are robust, clear, and adaptable. This includes:

• Pre-drafted statements for various types of crises, such as cyberattacks or public allegations.
• Regular reviews of your social media policy and crisis response guidelines.
• A clear escalation process for approvals to avoid delays in messaging.

Auditing messaging also involves ensuring that spokespeople are well-trained and prepared to address the media during high-stress situations. Media training should be refreshed regularly to keep communication skills sharp.

Operational vs. Reputational Crises

An operational crisis could involve a major accident, natural disaster, or another event that disrupts day-to-day business activities. These crises demand swift logistical responses to minimise downtime and ensure safety.

Reputational crises, on the other hand, threaten your license to operate in terms of customer or client acceptance and association. These are often more complex and can have long-term implications if not handled correctly. Examples include allegations of unethical behaviour, data breaches exposing customer information, or environmental violations. Communicators are often best placed in the organisation to assess the extent to which reputations may be impacted by various scenarios.

Building a Culture of Preparedness

Beyond formal planning, organisations must foster a culture that prioritises risk awareness and preparedness. This includes:

• Encouraging employees at all levels to report potential risks without fear of retaliation.
• Embedding crisis preparedness into leadership training programs.
• Continuously monitoring external trends, such as regulatory changes or industry developments, to stay ahead of emerging risks.

An Investment in Reputation

Crisis prevention and management are not one-off tasks but ongoing processes that require consistent attention and cross-functional collaboration. By investing in risk mapping, regular exercises, messaging audits and a culture of preparedness, businesses can not only mitigate potential crises but also position themselves as resilient and trustworthy in the eyes of stakeholders.

- John McGuinness, Director, Leon Communications