A crisis management plan should help an organization act when normal management arrangements are no longer sufficient.
It should not attempt to predict every possible crisis or provide a detailed script for every scenario. Crises are characterized by uncertainty, incomplete information, time pressure, changing consequences, and difficult decisions.
A useful plan therefore provides structure rather than a script.
It should establish who leads, how a potential crisis is assessed and escalated, how decisions are made, how information is managed, how stakeholders are communicated with, and how the organization moves from response toward recovery.
1. Purpose, Scope, and Objectives
The plan should begin by explaining what it is intended to achieve and when it applies.
This includes the purpose of the crisis management arrangements, the organizational scope covered by the plan, and its relationship with other response arrangements such as incident management, business continuity, emergency management, cybersecurity response, and disaster recovery.
The objective is not to duplicate those plans. It is to establish the strategic management layer that connects and directs the organization when a situation requires crisis-level leadership.
2. Crisis Management Governance
A crisis is not the time to determine who has authority.
The plan should identify the Crisis Management Team, its leadership, core members, alternates, supporting roles, and relevant specialist advisers.
It should also establish decision authority and escalation paths.
At minimum, people should understand:
- Who can activate the Crisis Management Team?
- Who leads it?
- Who can make significant decisions?
- Who can approve external communication?
- Who assumes responsibilities when key people are unavailable?
Clear governance reduces hesitation and conflicting authority when time matters.
3. Crisis Assessment and Activation
Not every incident requires crisis-management activation.
The plan should therefore establish a practical method for assessing situations and determining when escalation is necessary.
Useful indicators may include the severity and potential consequences of the event, uncertainty, speed of development, impact across several parts of the organization, stakeholder attention, regulatory exposure, reputational consequences, and whether normal management arrangements remain sufficient.
Activation criteria should support judgment rather than replace it.
The purpose is to help leaders recognize when an operational incident is becoming a strategic organizational problem.
4. Situational Awareness
Crisis leaders need a reliable picture of what is happening.
The plan should establish how information will be collected, validated, consolidated, and presented to the Crisis Management Team.
A useful situation picture should distinguish between:
confirmed facts; assumptions and unverified information; known impacts; emerging risks and potential consequences; actions already underway; decisions required; and important information gaps.
- confirmed facts;
- assumptions and unverified information;
- known impacts;
- emerging risks and potential consequences;
- actions already underway;
- decisions required;
- important information gaps
This is especially important because crisis decisions frequently have to be made before all the facts are available.
5. Strategic Objectives and Decision-Making
A Crisis Management Team should not become another operational response team.
Its role is to establish direction.
The plan should provide a simple process for defining crisis objectives, setting priorities, evaluating options, making significant decisions, assigning actions, and reviewing decisions as circumstances change.
Important decisions should be recorded together with their rationale, particularly when they involve significant risk, competing priorities, or incomplete information.
A decision log is therefore one of the most useful practical tools within the crisis-management process.
6. Crisis Communication
Communication should be integrated into crisis management rather than treated as a separate activity.
The plan should identify key stakeholder groups and establish responsibilities for internal and external communication.
It should define how messages are developed, reviewed, approved, and distributed, while allowing the organization to communicate quickly when circumstances demand it.
Good crisis communication should help stakeholders understand:
What is known? What remains uncertain? What is the organization doing? What should stakeholders do? When will further information be provided?
Communication should remain aligned with the decisions and priorities of the Crisis Management Team.
7. Coordination with Operational Teams
Crisis leadership depends on effective operational response, but the two should not be confused.
The plan should explain how the Crisis Management Team interacts with incident-response teams, business continuity teams, IT and cybersecurity teams, facilities, HR, communications, legal advisers, and other relevant functions.
Information needs to move upward to support strategic decisions, while priorities and decisions need to move back down to the teams responsible for implementation.
Without this connection, crisis leadership can become detached from operational reality.
8. Recovery and Transition
crisis does not end simply because the immediate incident has been controlled.
The plan should establish how the organization will determine when crisis-level governance is no longer required and how responsibilities will transition back to normal management or to longer-term recovery arrangements.
Recovery may involve operational restoration, stakeholder confidence, employee considerations, financial consequences, regulatory commitments, reputation, and unresolved actions.
The transition should therefore be deliberate rather than assumed.
9. Exercises, Review, and Improvement
A crisis management plan should be exercised before it is needed.
Exercises help determine whether roles are understood, escalation works, information reaches decision-makers, communication processes are usable, and leaders can make decisions under pressure.
After exercises and real crises, lessons should be translated into specific improvements with owners and deadlines.
The objective is not simply to maintain an updated document.
It is to strengthen organizational crisis management capability.
A Plan Should Enable Action
The most effective crisis management plans are not necessarily the longest.
A plan should be accessible, practical, and usable under pressure. It should provide enough structure to establish control without attempting to prescribe every action leaders might need to take.
The plan provides the structure. People provide the judgment.
For professionals seeking a structured learning path, the online crisis management course Mastering Crisis Management with ISO 22361 explores crisis planning, leadership, assessment, decision-making, communication, exercises, and improvement in greater depth.
The Professional Crisis Management Toolkit provides editable templates and working tools that can support the development and implementation of practical crisis management arrangements.
Independent Resource Notice: Crisis Readiness Pro resources are independently developed by Shalom David and aligned with ISO 22361 principles where applicable. They are not ISO publications and are not affiliated with, endorsed by, approved by, or certified by the International Organization for Standardization (ISO).