7 Key Tips for Communicating in a Crisis

Martin Brazier
|
Senior Consultant at URM
|
|
PUBLISHED on
12
September
2025
SUMMARY

In this blog, we explore the importance of crisis communication as a key part of crisis management and business continuity planning.  It explains the risks of poor communication, outlines the benefits of proactively creating a crisis communication plan, and provides 7 practical tips to help organisations prepare, deliver and evaluate effective crisis communication.

What is a crisis?

A crisis is an event that disrupts normal organisational operations and critical business processes.  The range of events leading to a crisis are seemingly endless, from natural disasters through utility and IT failures to product recalls and public relations incidents.  Incidents vary in severity and duration, can be short-lived or last longer than expected, and rarely occur at convenient times!

Due to this unpredictability, organisations need to prepare in advance ensuring business continuity, crisis, and incident management plans in place to respond effectively and return the organisation to normal operations.

What is crisis communication and how does it fit into business continuity planning?

When a crisis occurs, you will need to ensure that staff, stakeholders and customers know what is happening and are provided with the assurance that your organisation will recover.  Time can be of the essence, so it is important that your organisation is prepared.

Crisis communication can be referenced from your business continuity plan (BCP) but, typically, is found within a crisis management plan (CMP) as a separate, linked plan, depending on your organisational complexity and regulatory and reputational risk.  It involves communicating with internal and external stakeholders to provide accurate and timely information in such a way that helps to meet stakeholder needs, aid incident recovery, and minimise impact.

Your crisis communication plan (CCP) should include flexible communications strategies and identify a trained team, with roles and responsibilities for managing communications as part of the wider BC effort.

Why is it important?

Crisis communication can be argued to be the single most important element to get right during a crisis.  One of the ways of identifying its importance is to consider what would happen if it isn’t executed well; poorly managed and ineffective communication can prolong a crisis, make its effects worse and result in even greater impact, damaging trust, reputation, brand identity and organisational effectiveness.  Remaining silent about an incident is never the best option, as inaccurate assumptions, fears and falsehoods can spread quickly in an information vacuum, especially on social media.  A crisis will often occur at the least convenient moment, and events can unfold at an alarming rate.  In some cases, regulatory or legislative requirements can loom quickly, such as the 72-hour requirement to inform the Information Commissioner’s Office (ICO) of a personal data breach.  As such, having a CCP in place can help you to react quickly and get the correct messages out to the appropriate people at the right time.

Delivered well, crisis communication can actually have a positive impact on brand and customer loyalty.

7 Top Tips

So, what are the key things to consider about effective communications in a crisis?

1. Get organised

Thorough preparation is the foundation of effective crisis management in general and crisis communication in particular.  The planning process should include the identification of critical risks, vulnerable operations, and key internal and external stakeholders.  These insights can be used to develop realistic crisis scenarios and pre-prepared communication strategies.  It is crucial that the communication plan is fully aligned with the wider crisis management framework and its decision-making structures; if communications are developed in isolation, confusion and errors are far more likely during a real incident.  

A CCP will specify who needs to receive communications, what their needs for information are likely to be, and the communication channels likely to be most appropriate for each audience, with an alternative channel in case some channels are unavailable.  Having draft version of holding statements already prepared can bring significant time-saving benefits, as holding statements will need to go out immediately when an incident occurs so that your organisation communicates proactively and is able to establish control of the narrative.  Specialised templates may be required in some scenarios, such as for informing the Information Commissioner and data subjects of a data breach.

2. Agree your storyline

The point of crisis communication is to provide guidance, unity and support in times of disruption and stress.  It is vital that everyone in your organisation’s crisis communication team speaks as one, from the leadership to the staff members.  This will mean appointing someone at a senior level to provide final message sign-off, and everyone in the team should look to that individual for the final word.  It is also vital to inform everyone not to send out their own, unofficial messages, talk to the press without prior approval, or post about the incident on social media, as this could lead to confusion and misinformation at a time when clear, consistent communication is most needed.

3. Always be open and honest

As crisis communication is about building trust and confidence, it is important to inform people of what you know, when you know it, but it is never a good idea to guess at outcomes or mislead.  

Communications need to be front and centre where the recipient can find it easily, not partially hidden in the hope that they won’t see it.  Stakeholder trust is built through effective and open communication, not merely by showing later that the requirements were technically fulfilled on paper.

You should also ensure that staff can be updated quickly and that explanations are provided of why actions are being taken and the reasons behind external messages.

4. Set the right tone

The tone of the message is as important as the message itself.  Language should be professional and empathetic, clear and straightforward.  Jargon and technical terms should be avoided in favour of plain language. The goal is to make the message understandable yet consistent with your brand and business values.

5. Have flexible and backup communication channels

A single communication channel is unlikely to reach all intended recipients, and depending on the crisis, some channels may not be available if the crisis involves an IT or power outage.

A good crisis communication plan will include preferred channels to each stakeholder group, but it should also include backup channels.  Some of those backup channels may not be ideal but could be the only ones available at the time.

Email can reach everyone.  Internal and external email groups and templates can be pre-prepared ready for use in a crisis.

Text messaging and instant messaging applications such as WhatsApp can be used to reach people quickly and whilst any message needs to be short, it can point to further information elsewhere, such as a website, or to promise further information later.  Be aware that any message to a WhatsApp group is likely to spark a conversation and speculation, so you will need to monitor the groups and prepare to intervene if necessary.

6. Feedback is key

During a crisis, the temptation can be to cut the organisation off from unwanted distractions while the crisis is managed.  However, stakeholders will have questions and feedback, and some, such as suppliers, may be able to offer help to ameliorate the crisis or aid its recovery.

This will draw resources from the crisis communications team, but it is important that stakeholders do not feel as though they are being ignored, so a response – even a holding response while facts are being gathered – is better than no response at all.

One aspect to consider are the consequences of communications to allow for these consequences in messages and plan for them if feasible.  For example, are customers likely to go to another supplier or cancel orders?  Might they invoke penalties in contracts?  Could they lodge a complaint with the organisation or a regulator?  Is there a case for legal action?  Could there be an influx of requests for information such as freedom of information (FOI) requests to public bodies or data subject access requests (DSARs) under data protection law? All of these could occur when the crisis is still being managed, which is the time when distractions are most impactful or costly, so it is important to consider this at the planning stage and determine lines to take in communications to delay or respond to adverse consequences.

7. Evaluate and improve

Once a crisis is over, it is vital that the communication continues, especially within the internal team.  This will help you decide whether the crisis management response and the crisis communications were effective and relevant, which can lead to improvements for the future.

There are numerous ways that assessments or evaluation can be undertaken.  Information can be gathered by including feedback into managers’ team meetings and one-to-one meetings with their staff, and a staff survey can also be conducted to establish whether information was clear and timely, whether it was easy to understand, and which communication channels worked best.

A survey with customers can be effective in some cases, but other tactics to receive feedback might include conversations with account managers or analysing correspondence and complaints.

How URM Can Help

With our ISO 22301-aligned approach, URM can provide BC services and guidance that are informed by recognised best practice, as well as extensive practical experience.  Our consultants can offer a range of business continuity consultancy services to help you enhance your organisation’s BC capabilities; for example, if you would benefit from assistance with your business impact analysis (BIA), we can provide BIA support where we assist you to establish your BIA methodology, providing you with a clear picture of what you will need to recover first during disruption, how quickly, and to what level.  You can also leverage our BIA tool, Abriska® 22301, which simplifies the BIA process and helps you create your BCP.

Having conducted the BIA, URM can also help you to develop and implement bespoke BCPs or CMPs, which are always developed with your organisation’s unique needs in mind.  Once these have been developed, we can offer tailored BC exercise services where we devise challenging, bespoke scenarios to exercise your BCPs and CMPs and provide a report on your team’s response, including any recommendations for improvement.  

If you are looking to certify to ISO 22301, URM can guide you through the entire process, from conducting a BC gap analysis to providing implementation and remediation support, and ensure you are prepared for a successful certification assessment.

Martin Brazier
Senior Consultant at URM
Martin is a highly experienced and knowledgeable GRC consultant at URM specialising in data protection. He holds BCS Certificates in Data Protection and Freedom of Information and achieved Certified Information Privacy Professional (Europe) (CIPP/E). He also holds BCS Certificates in Information Security Management Principles, Business Continuity Management and Information Risk Management.
Read more

Test your plans with realistic BC exercises tailored to your organisation’s unique risks

Strengthen your response with challenging, scenario-based BC exercises. URM will assess your team’s performance, identify gaps, and provide actionable insights to help improve resilience and readiness for real-world disruption.
Thumbnail of the Blog Illustration
Business Continuity
Published on
5/4/2024
How to Develop a Robust Business Continuity Plan

URM’s blog discusses the key steps to take in order to develop robust and effective business continuity plans which will enable you to recover from disruption.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
16/1/2025
DORA - The Digital Operations Resilience Act

URM’s blog discusses the EU’s Digital Operation’s Resilience Act (DORA), explaining who it will apply to, its requirements, how it will be enforced, and more.

Read more
Thumbnail of the Blog Illustration
Business Continuity
Published on
23/11/2023
Conducting a Business Impact Analysis (BIA) as Part of Your Organisation’s Business Continuity (BC) Planning

URM’s provides detailed guidance on how to conduct a business impact analysis (BIA) and ensure your business continuity plans are based on a solid foundation.

Read more
The guidance and support we’ve received from URM during the process for both certifications have been exceptional, putting us at ease and providing clear and concise explanations and advice to ensure we met all the necessary requirements. We would not hesitate to recommend them.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.