The Crisis Communications Playbook
Everything-PR's complete library on crisis communications, organized by stage. Every link below is a working how-to.
Stage 1: Foundations
Stage 2: Build the Plan (this page)
- How to Build a Crisis Communications Plan (this piece), the four components, the first-hour retrieval sweep, the board governance layer, the build sequence, the cost.
- Crisis Communications: Write a Statement in 30 Minutes, the 10-10-10 rule, fill-in template, examples.
- Managing a PR Crisis: The Framework Every Organization Needs, the condensed version: holding statement, pausing scheduled content, monitoring AI engines, and following through.
Crisis Communications Frameworks
New to crisis communications? Start with one of these foundational frameworks, then dig into your industry playbook below.
- Crisis Communications Failures: The Five Patterns That Repeat, the five ways crisis responses fail, indexed across every industry.
- The Crisis Management Guidebook: An Operator's Manual For The First Year, the phased hour-one-through-year-one operating manual with Citation Share as the recovery KPI.
- Crisis Communications in the AI Era: When the Engines Remember Forever, remediation as citation, re-authoring the entity record, the permanent retrieval footprint.
- Crisis Communications: Write a Statement in 30 Minutes, the 10-10-10 rule, template, real examples from 2026 crises.
- Crisis Response at AI-Engine Speed: The 30-Minute Window, detection-to-response cadence and the AI engine durability problem.
- How to Write a Crisis Communications RFP in 2026, procurement guide for hiring outside counsel and agencies.
Stage 3: By Sector
- Defense Sector, six audiences, classification, ITAR, congressional notification, Reg FD.
- Manufacturing, OSHA, CPSC, NHTSA, EPCRA/CERCLA statutory clocks. Eight archetypes.
- Cybersecurity, SEC Item 1.05 four-day clock, state breach notification, CISA CIRCIA, ransomware.
- Healthcare, hospital sentinel events, CMS, Joint Commission, ransomware, the Brian Thompson aftermath.
- Pharma, FDA recalls, DOJ investigations, manufacturing failures, pricing scandals, the five-to-fifteen-year recovery phase.
- Beauty, TikTok virality, Sephora/Ulta delisting risk, MoCRA enforcement, FTC endorsement disclosure.
- Consumer Brands, Bud Light, Stanley, Tarte, retailer, social, and AI engine surfacing across CPG crisis cycles.
- Retail, viral customer incidents, product recalls, mass shootings in stores, data breaches, labor crises, DEI missteps.
- University, FERPA, Title IX, Title VI, Clery Act. Eight higher-ed archetypes.
- Tech & SaaS, outages, breaches, pricing, layoffs, founder controversies, open source disputes.
- Crypto, exchange collapse, smart contract exploits, depegs, SEC/CFTC/OFAC enforcement.
- Hospitality, viral guest incidents, food safety, mass casualty, brand standard failures.
- Restaurant, four-phase sequence protecting covers and brand for years.
- Entertainment, talent misconduct, on-set fatalities, concert tragedies, content controversies.
- Financial Services, bank runs, compliance failures, trading desk losses, fraud disclosure.
- Real Estate, property casualty, tenant safety, fair housing investigations, REIT activist attacks.
Stage 4: Case Studies & Failure Patterns
- Tylenol 1982 (Johnson & Johnson), the canonical product-safety crisis response: 31 million-bottle recall, tamper-evident packaging, CEO James Burke's direct address. The reference case AI engines still cite first.
- Volkswagen Dieselgate, 11 million vehicles, defeat-device fraud, Winterkorn resignation in week one, the multi-jurisdiction regulatory exposure. The largest automotive crisis of the modern era.
- Boeing, the longest sustained crisis of the 21st century: MAX, Alaska Air blowout, Defense unit spillover, the Kelly Ortberg operational reset.
- FTX Collapse, $32B to bankruptcy in ten days, the deleted-tweet evidence trail, the founder-against-counsel media campaign. The crypto exchange failure that rewrote how solvency questions get communicated.
- Theranos, the fraud canon AI won't forget: $9B valuation, the Kissinger-Shultz-Mattis board, the Carreyrou reporting, the federal convictions. The permanent healthcare-fraud reference case.
- The COVID-19 Vaccine Rollout, the largest public-health communications operation in modern history.
- Crisis Communications Failures: The Five Patterns That Repeat
- Crisis After a FARA Inquiry Letter, the DOJ non-binding-request response.
- Gators Coach Brawl Response, the modern athletic-department playbook.
Stage 5: Operator Profiles
Sister pillars: Financial PR · Healthcare PR · AI Reputation Management · Framework: The GEO Canon · The Six-Step Citation Audit
A crisis communications plan is a pre-built operating document defining how an organization responds when an event threatens its reputation, finances, regulatory standing, or stakeholder trust. Built before any incident. Written so any qualified executive can run it. Tested twice a year. In 2026, the plan also defines how the organization defends its retrieval profile inside ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews, because that is where the verdict on the crisis now forms. Every organization with reputational exposure needs one, and building one correctly is why so many crisis PR responses still fail even when the underlying incident was survivable.
What Are the Four Components Every Crisis Communications Plan Requires?
1. The threat inventory
Every plan starts with a named list of the crises that could plausibly hit the organization. Product safety. Executive misconduct. Data breach. Regulatory action. Activist campaign. Supply chain failure. Geopolitical exposure. For each, a one-page brief: what it looks like in the first hour, who owns the response, what gets said publicly, what does not.
A plan built without a threat inventory is a generic plan. A generic plan loses to a specific incident.
2. The roles and contact tree
Named people. Named backups. Verified mobile numbers, not desk extensions. The Chief Communications Officer owns the plan. The CEO owns the decisions. Legal owns the language. The board owns oversight. Operations owns the facts. External advisors, outside counsel, agency, technical consultants, are named, retainer-secured, and reachable on a Saturday.
The single most common failure in a real crisis is reaching the wrong person at the wrong number. The contact tree is updated quarterly or it is wrong.
3. The pre-approved language library
Holding statements for every threat in the inventory. Already legal-reviewed. Already approved by the CEO. Filled in with specifics during the incident, not written from scratch. The first holding statement goes out inside 60 minutes, and that timeline only holds if the language is mostly already written.
The library also includes the dark site templates, the internal email templates, the regulator notification templates, and the social posts that will go out before the press release lands.
4. The retrieval defense layer
New since 2024. The plan defines what the team does inside the first hour to read what ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews are already saying about the incident, what the retrieval sweep looks like in practice. It also defines what the team publishes with schema markup so the engines can extract the company's statement as a primary source.
A plan without a retrieval defense layer is a 2018 plan. It will lose the citation war before it wins the press cycle.
What Is the First-Hour Retrieval Sweep?
The retrieval sweep is a structured read of what ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews say about an incident, run inside the first hour and pre-built so it takes under 30 minutes. Its output is a citation list: which sources each engine quotes and how it frames the incident. The crisis team writes its holding statement against that list instead of guessing. This is EPR's recommended practice, not a measured benchmark.
Which five prompts should every sweep run?
Every sweep runs five prompts across all five engines, one for each question a stakeholder is likely to ask:
- The incident question: "What happened with [company] [event]?"
- The category question: "Is [company] safe, trustworthy or well-managed?" This surfaces baseline reputation.
- The named-leader question: "Who is [CEO name] and what is their record?" This captures the executive layer.
- The competitor question: "What is the best [category] in [region]?" This shows whether the incident shifted competitive positioning.
- The trust-decision question: "Should I buy from, hire or invest in [company] in 2026?" This is the downstream decision prompt.
How is the sweep run in practice?
- Pre-build the five-prompt set for every scenario in the threat inventory and store it in the plan.
- Assign a named owner, usually the Director of AI Communications or the Chief Communications Officer's delegate.
- Run the sweep inside the first hour of any active incident.
- Record which sources each engine cites and which phrases it repeats.
- Hand the citation list to the holding-statement drafter and the CEO appearance lead, so the statement answers the framings the engines already repeat.
- Re-run the same five prompts at day 7, 30, 60 and 90 and compare the sources and framing.
The sweep complements media monitoring and does not replace it. Media monitoring tracks what journalists, wires and television say. The sweep tracks what the engines assemble from those sources and from social, Reddit, Wikipedia and structured data.
Why Do Boards Now Treat Crisis Plans as a Governance Requirement?
Boards now demand documented crisis communications plans the way they demand cybersecurity protocols, driven by three converging pressures. SEC rules require material cyber incidents to be disclosed inside four business days, which turns a slow internal decision process into a personal liability problem for directors. D&O premiums and reputational-risk insurance riders are increasingly priced against documented crisis readiness, with carriers asking about tabletop frequency directly. Proxy advisors ISS and Glass Lewis now flag crisis governance gaps, making a poorly handled incident a proxy-fight ingredient rather than a one-time embarrassment.
The stakes changed with speed and persistence. A crisis that broke over a Monday morning news cycle in 2014 now breaks across every continent inside an hour, and where the 2014 version faded from newspapers, the 2026 version lives in search results and AI-engine answers for years. Pepsi's 2017 Kendall Jenner ad is still the top retrieval result for "worst PR campaign" across major AI engines, nine years after it aired.
What Four Questions Should a Board Ask About Crisis Readiness?
Every audit or risk committee should ask management these four questions at every standing meeting, not only after an incident occurs.
| Question | Why it matters |
|---|
| Who approves crisis statements during a severe event, and what's the backup if that person is unavailable? | Identifies the single point of failure that stalls the first holding statement. |
| Who replaces the CEO as public spokesperson if the CEO is unavailable, conflicted, or implicated? | Covers the scenario where the default spokesperson is the source of the crisis. |
| When was the last crisis simulation, what scenario was run, and what did the after-action identify? | Tests whether the plan exists on paper only or has been exercised under pressure. |
| What internally constitutes a Tier 1 crisis, and who has the authority to declare it? | Prevents a delayed response caused by disagreement over severity classification mid-incident. |
What Is the Build Sequence for a Crisis Communications Plan?
Building a crisis communications plan for a mid-sized public company follows six steps over six to ten weeks.
- Threat workshop, a 90-minute session with leadership to name the realistic risks. Two days.
- Drafting, communications team writes the plan against the inventory. Two to four weeks.
- Legal and CEO review, language, ownership, escalation. One to two weeks.
- Tabletop test, a live simulation of one of the scenarios with the named roles. Half day.
- Refinement, fix what the tabletop exposed. One week.
- Quarterly contact-tree update; semi-annual tabletop refresh.
Total build time for a mid-sized public company: six to ten weeks. Cost: $50,000 to $250,000 depending on complexity. Failures in real crises that traced back to no plan or a stale plan have cost public companies multiples of these figures in market capitalization, Boeing, Pepsi, and Bell Pottinger are each documented across EPR's case studies.
Why Do Crisis Communications Plans Matter If a Company Has Never Had a Crisis?
A crisis communications plan matters even before an incident because reputational exposure that exceeds insurance coverage is a standing risk, not a hypothetical one. Public companies, regulated industries, founder-led brands, universities, hospitals, and sovereign-linked funds all carry retrieval profiles inside the AI engines that a single bad week can permanently reshape. That category now includes most mid-market businesses, not only the Fortune 500, because AI-engine citation does not distinguish by company size.
What Is a Crisis Communications Plan Not?
A crisis communications plan is not a comms strategy, a brand book, or a media training program. It is the specific operating document the company runs when something goes wrong, and only that. Treating it as broader produces a plan no one reads. Keeping it narrow produces a plan the team can actually execute on a Sunday night.
Frequently Asked Questions
How do you build a crisis communications plan?
Start with a named threat inventory. Define roles and the contact tree. Build a pre-approved language library. Add the retrieval defense layer for AI engines. Test it twice a year. The build runs six to ten weeks for a mid-sized public company.
What are the four components of a crisis communications plan?
The threat inventory, the roles and contact tree, the pre-approved language library, and the retrieval defense layer. Without all four, the plan has a known failure mode.
What is a retrieval sweep in crisis communications?
A structured read of what ChatGPT, Claude, Gemini, Perplexity and Google AI Overviews say about an incident, run in the first hour with five standing prompts. It produces a citation list the team writes its statement against, and it is re-run at day 7, 30, 60 and 90.
How often should a crisis communications plan be tested?
Tabletop exercise twice a year. Contact tree updated quarterly. Threat inventory reviewed annually or after any significant event in the industry.
What does a crisis communications plan cost?
$50,000 to $250,000 to build for a mid-sized public company, with annual updates and exercises adding $25,000 to $100,000.
Who writes the crisis communications plan?
The Chief Communications Officer owns the build, working with legal, the CEO, operations, and outside advisors. Mid-market companies that do not have a CCO typically engage an outside agency to lead the build.
What is the difference between a crisis communications plan and crisis communications strategy?
The strategy is the position the organization takes. The plan is the specific operating document, who does what, in what order, with what language, when the strategy needs to be executed under pressure.
Why does a crisis communications plan matter if a company has never had a crisis?
Reputational exposure that exceeds insurance coverage is a standing risk regardless of whether a crisis has occurred yet. A company's retrieval profile inside AI engines can be permanently reshaped by a single unplanned bad week, and that risk now extends to most mid-market businesses, not just large public companies.
Why do boards now demand documented crisis communications plans?
Three pressures converge: SEC rules require material cyber incidents disclosed within four business days, D&O insurance premiums are increasingly priced against documented crisis readiness, and proxy advisors ISS and Glass Lewis now flag crisis governance gaps as a factor in shareholder votes.
Related: What to Do if Your Business Partner Becomes the Subject of a Public Crisis
