A crisis management guidebook is a written plan that names who decides, who speaks, and what gets said at each stage of a crisis. In PwC's 2023 Global Crisis and Resilience Survey, 91 percent of 1,812 business leaders reported at least one disruption other than the pandemic in two years. The plan will be used, so this guide covers the team, holding statements, the first hours and 72 hours, bot accusations and recovery.
What belongs in a crisis management guidebook?
A crisis management guidebook contains the decisions a team cannot afford to make for the first time during a crisis. Each element below should be findable in under a minute, and each one has a simple test.
| Element | What it settles | How to test it |
|---|
| Crisis team | One decision-maker, one spokesperson, a legal reviewer, and a deputy for each role | Ask each person to name their deputy without looking |
| Contact tree | Mobile numbers for every team member and key adviser, kept current | Call every number at least once a year |
| Holding statements | First statements for the crises most likely to hit the organization, approved in advance by legal | Confirm legal has signed each one |
| Severity scale | Which events trigger the plan and which stay with a single department | Score three past incidents against it |
| Decision log | Every decision, statement and timestamp | Fill in a mock entry during a drill |
| Recovery review | The format used after every activation | Run it after drills as well as real events |
What guidelines should a crisis communication plan follow?
A crisis communication plan should follow seven written guidelines, so that someone who has never seen it can use it at two in the morning under pressure. Crisis communication plan guidelines are the written rules that govern how an organization speaks while a crisis is unfolding.
- Name one owner. The plan states who has authority to approve a public statement, and what happens when that person cannot be reached.
- Separate facts from interpretation. Every statement distinguishes what is confirmed, what is being checked, and what is not yet known.
- Write the first statement in advance. A holding statement should acknowledge the event, say what the organization is doing, and name when the next update will come.
- Set an update rhythm. The plan commits to a regular update time, so silence between updates is expected rather than alarming.
- Match every channel to an audience. Employees, customers, regulators, investors, and reporters each get a defined channel and an owner for it.
- Keep one source of truth. A single page on the organization's own site holds the current facts, and every other channel points to it.
- Rehearse. A tabletop exercise at least once a year exposes missing phone numbers and unclear approval chains before a real event does.
Rehearsal closes a gap PwC measured. Its survey found 70 percent of leaders confident they could recover from a disruption, yet PwC's survey data showed many organizations lack the foundations of resilience.
For a step-by-step build of the document itself, see how to build a crisis communications plan. For a shorter sequence a team can run during an event, see the 10 steps of crisis communication.
What should a team do in the first 72 hours of a crisis?
A team should use the first 72 hours to establish the facts, publish one authoritative account, and correct errors as they appear. Those first three days are when the public record of an event forms, including the coverage, social posts, and search results that later readers and AI tools find.
Three jobs run at once, each with one owner.
| Job | What the owner does | Output |
|---|
| Confirm facts | Verifies what happened with the people closest to the event | A short list of confirmed, being checked, and unknown items |
| Draft and clear statements | Writes each statement and routes it through legal and the decision-maker | An approved statement and a time for the next update |
| Monitor and correct | Watches coverage and social channels and flags errors | A correction request or update for every error found |
KFC shows the pace. After a delivery change to DHL left its UK restaurants short of chicken, KFC first apologized on Saturday, February 17, 2018, and ran its full-page newspaper ad six days later on February 23, according to CNBC's report on the apology. The full argument for treating these days as a distinct phase is in the 72-hour window in crisis communications.
What does an hour-by-hour crisis response look like?
An hour-by-hour crisis response moves from a holding statement inside the first hour to a corrective record in the first week, then keeps monitoring for months. The timings below are EPR's working guidance, and each stage has one clear output.
| When | Action | Output |
|---|
| Within 60 minutes | Acknowledge the event with a holding statement that expresses concern for affected people and commits to fact-finding | A statement with no speculation, no blame and no legal wording that reads as evasion |
| Within 3 to 6 hours | Put the spokesperson on camera and publish the source-of-truth page | A video on the organization's own channel and a time-stamped page linked from every press response, social post and customer email |
| Within 24 hours | Brief the outside voices most likely to be asked: analysts, customers, partners and regulators | Independent statements that sit beside the organization's own record |
| Within the first week | Publish a corrective record once the facts are confirmed | A structured account of what happened, what did not, what has been fixed and what comes next, with the questions people are actually asking |
| For months afterward | Monitor search results, news archives and AI answers until they match the corrected record | An updated source-of-truth page whenever the public record diverges from the verified facts |
Every reputation event runs on two clocks. The news clock covers statements, briefings and corrections and ends within days. The answer clock starts when search engines, archives and AI tools begin indexing the story and keeps running, so the version of events that wins the long record is often the one that was published in the first week. EPR explains how that long record is managed in its online reputation management guide.
Five mistakes undo a good sequence.
- Apologizing for the wrong thing, such as reading a lawyer-drafted statement that never names what people are angry about.
- Going silent, because silence on the first day becomes the story that others tell.
- Blaming the customer, because defensiveness gets quoted as the organization's response.
- Treating the event as a press problem only, because press cycles end and the record does not.
- Skipping long-term monitoring and assuming search results and AI answers will correct themselves.
How should an organization answer spam or bot accusations?
An organization accused of spamming or running bots should answer with verified facts and disclosure, not denial. A flat denial that later proves wrong becomes a second crisis, while a specific and checkable answer gives reporters and platforms something to confirm.
The legal stakes are real. On August 14, 2024 the Federal Trade Commission announced a final rule that prohibits fake reviews, including AI-generated ones, and the buying or selling of fake social media indicators such as bot-generated followers or views, and it lets the agency seek civil penalties against knowing violators, per the FTC final rule announcement. Section-by-section detail is in the FTC fake review rule. The same approach applies whether the accusation concerns fake reviews, coordinated comments, automated accounts, or unsolicited messages.
| Step | Action | Why it matters |
|---|
| 1. Investigate before responding | Pull the account list, posting logs, vendor contracts, and campaign records, and establish what actually ran and who ran it | The answer rests on records, not memory |
| 2. Check agencies and vendors | Look for a contractor, an affiliate, or an employee acting outside policy | The organization is still accountable for them |
| 3. Say what is confirmed and what is not | Use wording such as "we have found X and are still reviewing Y" | It is more credible than a complete answer that later changes |
| 4. Disclose automation plainly | State whether any account, tool, or message used automation and whether the accounts identified themselves as automated | Disclosure removes the discovery that would follow a denial |
| 5. Stop the activity first, then explain | Pause the campaign or remove the accounts in question | It shows the problem is treated as real while the review continues |
| 6. Do not delete critical comments in bulk | Remove only content that clearly breaks stated community rules, and say so | Mass removal looks like concealment and is often screenshotted |
| 7. Work with the platform | Report the activity through the platform's own channels, cooperate with its review, and use its published policy language | The platform can confirm what the organization says happened |
| 8. Publish the fix | Describe the new approval rule, vendor requirement, or disclosure practice, and name who is responsible for it | It shows the problem will not repeat |
Accusations of this kind also move fast on social media, so the acknowledgment should arrive within the first hours and the detailed findings can follow on the committed update schedule.
How do organizations recover after a crisis?
Organizations recover by acting on what the crisis exposed and showing the change publicly. Recovery begins when the immediate event is contained and ends when the organization has changed something people can see.
The 1982 Tylenol poisonings remain the standard reference case. Wharton Knowledge reported that Johnson & Johnson spent $100 million to recall 31 million bottles after seven deaths in the Chicago area, relaunched the product two months later in tamper-proof packaging, and had Tylenol back to a 35 percent share of the analgesic market by the end of 1983. The full history, including later events, is in the Tylenol crisis history.
A different model is KFC's February 2018 apology. CNBC reported that KFC closed hundreds of its roughly 900 UK restaurants after the DHL delivery problem, then ran full-page ads in The Sun and Metro showing an empty bucket relettered "FCK" above a direct apology. The timeline is in the KFC FCK apology ad breakdown.
Whatever the case, a recovery review should answer four questions in writing:
- What happened?
- What did the organization say, and when?
- What did it get wrong?
- What changes before the next event?
The review feeds directly back into the plan, so the guidebook improves every time it is used. Teams comparing outside support can start with the top crisis PR firms, and teams studying a large-scale case can read the major public relations crisis analysis. For day-to-day response, managing a PR crisis covers the practical sequence.
Where should a team start?
A team should start with two documents this week: the owner list with a named deputy for each role, and one holding statement approved by legal for the crisis most likely to hit the organization. Everything else in a crisis is judgment, and judgment is faster when those two items already exist.
