Not every serious incident is a crisis, and not every crisis begins with an obvious catastrophic event.
One of the most difficult practical challenges for organizations is deciding when normal incident-management arrangements are no longer sufficient and the Crisis Management Team (CMT) should become involved.
Activating too late can leave the organization without adequate strategic leadership while consequences escalate. Activating unnecessarily can pull senior leadership into situations that operational and business teams are capable of managing.
The objective is therefore not to create an automatic trigger for every situation. It is to establish a structured assessment and escalation process that supports management judgment.
1. What Is the Difference Between an Incident and a Crisis?
An incident is an event that requires a response.
Many incidents, including serious ones, can be managed through established procedures, defined authority, specialist response teams, business management, and existing continuity arrangements.
A crisis is different because the situation begins to challenge the organization’s normal management arrangements.
The issue may no longer be only the operational impact of the event. Senior leadership may need to address uncertainty, competing priorities, significant stakeholder concerns, strategic consequences, difficult trade-offs, or decisions that exceed normal authority.
The distinction therefore depends not simply on how large the incident is, but on what kind of management capability the situation requires.
2. Severity Alone Should Not Determine Activation
Organizations sometimes try to define crisis activation using a single severity scale.
Severity is important, but it is not enough.
A major technical failure may have severe operational consequences while established recovery and business continuity arrangements remain effective. Conversely, an initially small event may rapidly develop into a crisis because of regulatory concerns, reputational exposure, uncertainty, or significant stakeholder attention.
The CMT should therefore not be activated simply because an event has reached a particular technical severity.
The assessment should consider the broader organizational situation.
3. Four Useful Signals of a Potential Crisis
Four characteristics are particularly useful when considering whether normal management arrangements remain sufficient.
Abnormality
Does the situation still fit established procedures and familiar management arrangements?
A situation becomes more difficult when existing plans, authority structures, or response processes no longer provide a clear way forward.
Uncertainty
Are important facts missing while significant decisions still need to be made?
Uncertainty alone does not create a crisis, but the combination of uncertainty and consequential decision-making is an important warning signal.
Pace
Is the situation developing faster than normal coordination, decision-making, or approval processes can manage?
A rapidly changing situation can require a higher level of leadership even before the full consequences are understood.
Visibility
Are employees, customers, regulators, media, investors, communities, or other important stakeholders paying increasing attention?
High stakeholder visibility can introduce consequences and decisions that extend well beyond the original operational incident.
No single signal should automatically activate the CMT. The important question is how these characteristics combine and whether they are beginning to exceed normal management capability.
4. Questions to Ask Before Activating the CMT
- Can the situation still be managed effectively through established arrangements?
- Are consequences extending beyond the affected business or operational area?
- Are significant enterprise priorities or resources in conflict?
- Are decisions required that exceed existing authority?
- Must important decisions be made despite substantial uncertainty?
- Could stakeholder, regulatory, financial, or reputational consequences become significant?
- Is the situation developing faster than normal management processes can respond?
- Is enterprise-level coordination or strategic direction now required?
The more strongly these conditions are present, the stronger the justification for crisis-level leadership.
5. Escalation Does Not Always Mean Full CMT Activation
Organizations should avoid treating escalation as an all-or-nothing decision.
There may be situations where senior leadership needs greater visibility without immediately activating the full CMT.
For example, an organization may:
- increase monitoring;
- notify the CMT Leader or selected members;
- convene a preliminary assessment;
- place CMT members on standby; or
- activate only the leadership and functions currently required.
This allows the organization’s management response to develop proportionately as the situation changes.
However, staged escalation should not become an excuse for delaying activation when strategic leadership is clearly required.
6. Who Should Have Authority to Activate the CMT?
Activation authority should be defined before a crisis occurs.
Organizations should identify who can activate the CMT and who can act when that person is unavailable.
Authority should not depend entirely on one individual.
At the same time, employees and managers throughout the organization should understand how to escalate concerns, even if they do not personally have authority to activate the CMT.
This distinction is important:
Many people may identify and escalate a potential crisis. A defined group of people should have authority to activate the CMT.
7. Activation Is a Management Decision
No checklist can remove uncertainty from crisis activation.
Assessment criteria, thresholds, escalation paths, and warning indicators help leaders make better decisions, but they should support judgment rather than replace it.
When uncertainty is high, organizations should also consider the consequences of waiting.
A CMT can be activated, assess the situation, and subsequently decide that crisis-level governance is no longer necessary. Delayed activation may be much harder to recover from if strategic consequences have already developed.
The goal is therefore not perfect classification.
The goal is to ensure that the organization recognizes when normal management is no longer enough and brings the appropriate level of leadership into the situation.
For professionals seeking a structured learning path, the online crisis management course Mastering Crisis Management with ISO 22361 explores crisis assessment, escalation, activation, leadership, and decision-making in greater depth.
The Professional Crisis Management Toolkit provides editable resources that can support crisis assessment, escalation, activation, governance, decision-making, and exercises.
Independent Resource Notice: Crisis Readiness Pro resources are independently developed by Shalom David and aligned with ISO 22361 principles where applicable. They are not ISO publications and are not affiliated with, endorsed by, approved by, or certified by the International Organization for Standardization (ISO).