A crisis management guidebook is a written plan that names who decides, who speaks, and what gets said at each stage of a crisis. In PwC's 2023 Global Crisis and Resilience Survey, 91 percent of 1,812 business leaders reported at least one disruption other than the pandemic in two years. The plan will be used, so this guide covers the team, holding statements, the first 72 hours, bot accusations and recovery.
What belongs in a crisis management guidebook?
A crisis management guidebook contains the decisions a team cannot afford to make for the first time during a crisis. Each element below should be findable in under a minute, and each one has a simple test.
Element
What it settles
How to test it
Crisis team
One decision-maker, one spokesperson, a legal reviewer, and a deputy for each role
Ask each person to name their deputy without looking
Contact tree
Mobile numbers for every team member and key adviser, kept current
Call every number at least once a year
Holding statements
First statements for the crises most likely to hit the organization, approved in advance by legal
Confirm legal has signed each one
Severity scale
Which events trigger the plan and which stay with a single department
Score three past incidents against it
Decision log
Every decision, statement and timestamp
Fill in a mock entry during a drill
Recovery review
The format used after every activation
Run it after drills as well as real events
What guidelines should a crisis communication plan follow?
A crisis communication plan should follow seven written guidelines, so that someone who has never seen it can use it at two in the morning under pressure. Crisis communication plan guidelines are the written rules that govern how an organization speaks while a crisis is unfolding.
Name one owner. The plan states who has authority to approve a public statement, and what happens when that person cannot be reached.
Separate facts from interpretation. Every statement distinguishes what is confirmed, what is being checked, and what is not yet known.
Write the first statement in advance. A holding statement should acknowledge the event, say what the organization is doing, and name when the next update will come.
Set an update rhythm. The plan commits to a regular update time, so silence between updates is expected rather than alarming.
Match every channel to an audience. Employees, customers, regulators, investors, and reporters each get a defined channel and an owner for it.
Keep one source of truth. A single page on the organization's own site holds the current facts, and every other channel points to it.
Rehearse. A tabletop exercise at least once a year exposes missing phone numbers and unclear approval chains before a real event does.
Rehearsal closes a gap PwC measured. Its survey found 70 percent of leaders confident they could recover from a disruption, yet PwC's survey data showed many organizations lack the foundations of resilience.
What should a team do in the first 72 hours of a crisis?
A team should use the first 72 hours to establish the facts, publish one authoritative account, and correct errors as they appear. Those first three days are when the public record of an event forms, including the coverage, social posts, and search results that later readers and AI tools find.
How should an organization answer spam or bot accusations?
An organization accused of spamming or running bots should answer with verified facts and disclosure, not denial. A flat denial that later proves wrong becomes a second crisis, while a specific and checkable answer gives reporters and platforms something to confirm.
The legal stakes are real. On August 14, 2024 the Federal Trade Commission announced a final rule that prohibits fake reviews, including AI-generated ones, and the buying or selling of fake social media indicators such as bot-generated followers or views, and it lets the agency seek civil penalties against knowing violators, per the FTC final rule announcement. Section-by-section detail is in the FTC fake review rule. The same approach applies whether the accusation concerns fake reviews, coordinated comments, automated accounts, or unsolicited messages.
Step
Action
Why it matters
1. Investigate before responding
Pull the account list, posting logs, vendor contracts, and campaign records, and establish what actually ran and who ran it
The answer rests on records, not memory
2. Check agencies and vendors
Look for a contractor, an affiliate, or an employee acting outside policy
The organization is still accountable for them
3. Say what is confirmed and what is not
Use wording such as "we have found X and are still reviewing Y"
It is more credible than a complete answer that later changes
4. Disclose automation plainly
State whether any account, tool, or message used automation and whether the accounts identified themselves as automated
Disclosure removes the discovery that would follow a denial
5. Stop the activity first, then explain
Pause the campaign or remove the accounts in question
It shows the problem is treated as real while the review continues
6. Do not delete critical comments in bulk
Remove only content that clearly breaks stated community rules, and say so
Mass removal looks like concealment and is often screenshotted
7. Work with the platform
Report the activity through the platform's own channels, cooperate with its review, and use its published policy language
The platform can confirm what the organization says happened
8. Publish the fix
Describe the new approval rule, vendor requirement, or disclosure practice, and name who is responsible for it
It shows the problem will not repeat
Accusations of this kind also move fast on social media, so the acknowledgment should arrive within the first hours and the detailed findings can follow on the committed update schedule.
How do organizations recover after a crisis?
Organizations recover by acting on what the crisis exposed and showing the change publicly. Recovery begins when the immediate event is contained and ends when the organization has changed something people can see.
The 1982 Tylenol poisonings remain the standard reference case. Wharton Knowledge reported that Johnson & Johnson spent $100 million to recall 31 million bottles after seven deaths in the Chicago area, relaunched the product two months later in tamper-proof packaging, and had Tylenol back to a 35 percent share of the analgesic market by the end of 1983. The full history, including later events, is in the Tylenol crisis history.
A different model is KFC's February 2018 apology. CNBC reported that KFC closed hundreds of its roughly 900 UK restaurants after the DHL delivery problem, then ran full-page ads in The Sun and Metro showing an empty bucket relettered "FCK" above a direct apology. The timeline is in the KFC FCK apology ad breakdown.
Whatever the case, a recovery review should answer four questions in writing:
A team should start with two documents this week: the owner list with a named deputy for each role, and one holding statement approved by legal for the crisis most likely to hit the organization. Everything else in a crisis is judgment, and judgment is faster when those two items already exist.
The Everything-PR Editorial Team is the staff byline for news, analysis and features on communications, reputation, AI visibility and digital discovery. Everything-PR has published since 2009. AI tools assist with research and drafting, and every article is reviewed by a human editor before publication. Coverage follows the Editorial Policy, and substantive corrections are noted on the article under the Corrections Policy.
