How to do crisis comms

A crisis comms survival guide for PRs who who have never done it

There are certain signs that a crisis has kicked off. The main one is your backside goes. It’s unmistakeable.

Even if you’ve never worked on a comms crisis before, you’ll know when it hits. This handy graphic will help. As it says, not every difficult call from a journalist represents a crisis. They should be asking difficult questions.

Is this a crisis - flow chart

Ideally, you’ll have some stuff in place from pre-crisis preparations. This involves looking at threats, how you can mitigate those threats, which tools you have, contacts, sign-offs and more.

But for this, we’re assuming you haven’t done any pre-crisis stuff - or very little - and it’s all booted off quickly.

I’ve worked through a few of these, at the University of Greenwich and, before that, at Millwall Football Club. This is based on what I learned.

TLDR:

• Stay calm

• Stop all scheduled outgoing comms (including social media)

• Get solid info in quickly

• Issue reactive statement quickly (an hour at the latest)

• Be truthful but cautious

• If it’s legally ok to do so, and it’s your fault, say sorry

• Monitor social media

• Have as much done in advance as possible – statement, lines to take etc

• The dangers of copy and paste

• Remember, it will pass

  
  

The first few hours

When it kicks off, you need solid information quickly. The thing with PR is, we’re not always trusted with all the top-table info. In fact, in my experience, we never are. And we need to be. 

You see it in the news when there’s an initial thing and then it keeps dripping out. The Toby Carvery tree felling, where a 400-year-old tree was chopped down, is a good example.

The initial statement said: “We took every necessary measure to ensure all legal requirements were met. We are grateful to our expert contractors for warning us of this hazard so swiftly, allowing us to act before anyone was harmed.

“We are grateful to our specialist arboriculture contractors for warning us of this potential health and safety risk, allowing us to act swiftly to address it.”

This is a statement that is more suited to explaining why a car park is shut - no one's bothered about that, beyond those wanting to use the car park.

But this is an old tree, and we're interested in them - we have an inbuilt affinity with nature. It's called biophilia - it's why we put our hands in ponds or stroke animals. This stuff happens on a molecular level - we can't help it.

It was clear there was more to it than the initial, abysmal, response and the problem wasn’t going to go away, and that’s what happened.

Once the media is on to something they keep going and, it turned out, the tree had hundreds of years left to live. And there were plenty of people happy to talk about it - to fill the gaps that Toby Carvery had left.

It seems unlikely that the PRs who put the initial statement together had access to all the information. 

Eventually, the follow-up came in the form of a letter by the CEO of the company, which was presumably leaked to journalists. It was everything the original should have been - and it acknowledged fault.

I’m not saying acknowledge fault to begin with because, legally, you’d be admitting liability. And you don’t want to do that if it’s going to bite you on the backside later.

But if you’re bang to rights, and there’s unlikely to be a legal issue, it’s generally a good move to say sorry. It’s better to hold your hands up (to a degree) than to have a long battle about what actually happened and people shrieking “LIARS” at you.

Are you in a crisis?

Maybe not. Aggressive, unwanted and/or persistent media enquiries are not necessarily a crisis - but they share some characteristics. And if you prepare for a proper “oh shit” scenario, you’re covered for tamer ones.

Let’s assume you are in the middle of a crisis, along the lines of the Marks & Spencer cyber attack, rather than the Air India crash, which is exceptional. In other words, it’s bad but not “multiple deaths” bad. 

Your problem probably won’t be as bad as Markses - the lead story on the news - but it’s all relative. And if we work toward that level, you’ll be better prepared.

The M&S data breach has all the hallmarks: It’s a beloved UK brand, combined with a balls-up, multiplied by something we are very twitchy about, our data.

The first thing to do is be sure of what’s actually happened. If you’ve had a report of something, or there’s bubbling on social media, you need to establish what definitely happened - not what people are frothing about. 

A lot of the time people get angry, and noisy, at the whiff of anything - social media runs on The Fume. This is where you need the C-Suite/higher-ups buy-in. If they’re sitting on information, it really hurts your work. 

It’s a good move to show them examples of crises gone wrong - during quiet times, not in the middle of the “oh shit” moment. Almost all of these examples will be, at least in part, down to PR teams not having enough to work with. Often coupled with the baffling idea that “it can be PR’d away”. 

One good thing that comes out of a crisis is, the higher-ups see what you do. They see how much more there is to PR than sending out “we’re great, bathe in our glory!’ fluff. 

It’s on

Once you’ve established that the company has, in fact, ballsed up, you need to stop any scheduled communications on other subjects.

You don’t want a social media post going out about the great new cakes in your canteen in the middle of all this.

Set up a Twitter/X search page for your company name (and variations thereof - ie “M&S, Markses, Marks Spencer” etc) and leave it open so you can see what’s being said, as it’s being said. 

Do the same for Facebook, Instagram, TikTok (the last two are not going to have the same volume of posts but people will start doing little comment videos on what they think has happened). 

Also Reddit, as people moan there a lot. There will be wider talk on Reddit so think of your keywords and start following them as well. “Data breach” is on lots of subreddits, as an example.

Follow what’s being said but don’t engage with it initially, beyond directing people to the holding statement you’ve made. Ignore the frothers as it’s not worth the aggro - nothing will be good enough for them. 

Set up real-time alerts on google for your company name, again using variants. 

Get a holding statement out within the hour. You need to get something out because, if there’s a vacuum, there’s plenty of people willing to honk on and fill it. People talk about “controlling the narrative” but all you’re doing here is heading off suggestions of inaction, not knowing, or not caring.

Keep it short. Ideally you have the bones of this in advance. You need to put it on the front page of your website and pinned to the top of social media feeds, quickly. 

For the statement, put it in the name of the most senior person concerned with this. Markses went with the CEO. Unless there’s a compelling reason not to - ie, it’s incredibly specific and you have someone better suited - the CEO is probably the way to go.

Stick with them throughout as the spokesperson, but put together a list of alternatives just in case. We’re not getting into that stage here though. 

In terms of content, don’t offer details and anything that can’t be unsaid. Depending on what it is I would go with:

“At 7am we were made aware of reports of X and are looking into it/investigating. Updates will be posted here.”

If there’s an injury or death reported, include a line about your sympathies and the victims and their families at this tragic time. Do not name anyone - especially someone who has died.

This is not designed to end all discussion. It’s purely there so people can see you are aware of a reported problem and are working on it.

Good phrases to use are:

• Safety is paramount

• We take complaints/incidents such as this extremely seriously

• We are gathering information 

• Our priority is…

• We are working closely with (ie) police etc…

  
  

Once you get more detail in, add it to the statement - check it for accuracy, then get someone else to check the spelling (do this for everything). It can be a balancing act as to whether it’s needed, so monitor what’s being said on social. And remember, Twitter/X storms burn brightly but, usually, briefly.

You also need to let your stakeholders (I hate that word) know. So that could be staff, contractors, visitors to the site that day - have a think and compare diaries for the day to check you don’t miss anyone (there will be some people you don’t need to tell, again it’s a balancing act).

I would email anyone who needs to know - say, staff - and direct them to the statement, saying it will be updated.

As you update the statement, add time stamps so it’s clear what has been said and when. Newest at the top, so the older stuff moves down.

Anything you put out needs to sound authentic and human. Don’t pepper it with exclamations (it’s not a text message) and don’t hide behind jargon. Just keep it simple, factual, and as short as possible. 

If this is a real humdinger, you’ll announce an investigation after the initial flurry (a few days, depending on interest, assuming it’s legally ok to do so). These are great for holding people off. Also they take ages and, by the time you’ve got your conclusions, people have generally moved on. The results will usually be somewhere deep in the company website.

Hello?

The first media enquiries come in. You might get people raging and trying to put you under pressure, but you don’t need to offer anything at this stage, other than acknowledge their call. 

Let them say their piece, then ask for their name, email address, who they’re working for, and the deadline. Direct them to your statement. Don’t say anything else at this stage.

The gist is: We’re aware, we’re investigating, we’ll update.

There’s only me here

If your crisis is something huge - like the examples above or the Heathrow power cut, you’re going to want extra people. If that’s not possible, the stuff below still applies. It just means you’re going to be extra frazzled.

Set aside 15 minutes or so to train the new people to answer the phone. It doesn’t have to be anything too dramatic, you’re basically just telling them to make a note of the things said above. Give them a script saying exactly the same and tell them not to deviate from it. 

Make sure they understand:

• No one is being put through to anyone 

• If the caller keeps pushing, simply repeat the request for their details

• Direct people to the statement

  
  

Make sure those you’ve brought in understand that people can get very aggressive and emotional at times like this. Journalists are working to deadlines, and they may feel you’re holding out on them. 

Don’t be drawn on anything. It’s very easy to get carried away with the excitement of it - especially when you realise after your first few calls that you aren’t actually going to die.

Again, you don’t want to say something that can’t be unsaid. So the best way to avoid that is to not say anything at all, other than to take their details, direct them to the statement (if they ask you to read it, do so - don’t elaborate. If they press, ask if they’d like you to repeat it) and say you’ll get back to them. 

Eventually, they’ll run out of steam. After a terrorist attack by a former student of the university I worked at, I had Panorama screaming down the phone at me saying they’d be down at our place sticking a camera in everybody’s faces. 

I let them yell at me for a good couple of minutes, and then pointed out that the site was open to the public so they were welcome to join us. But if they started harassing people they would be asked to leave and/or the police would be called.

Make sure you have every incoming call and email noted. When you come to emailing people back, make sure there is nothing beyond what you want to say on the email.

Beware of copy and paste - always check what you’ve pasted. Then check it again. I once used an old boss’s computer to apply for a job (can’t remember why, mine might have been broken). Anyway, he came in the next day and hit paste - again, god knows why - and my entire application was on his screen. That was awkward.

Your email would be something along these lines.

Subject: Statement on incident at (VENUE), on (DATE)

The statement itself.

Signed by whoever - ie the CEO (include their name)

Further comment will be made here (WEB PAGE) and here (links to social media).

Thanks,

YOUR NAME

I wouldn’t put any of the email niceties people use, such as a greeting or using their name, and definitely not “I hope you are well”. Just go straight into it.

Contact

You need to have clear sign-off procedures in place, ideally way before this happens.

You need to have updated contact details, including out of office, for everyone senior at your company: so that’s personal mobile and home numbers, non-work email addresses and social media handles for everyone. There are lots of non-phone ways of messaging.

These should be checked every time there’s a handover. So if the rota is weekly, fortnightly, whatever, check that everyone’s details are up to date. Yes, it’s a pain. Yes, you’ll be tempted not to do it this time. But it will kick off when you’ve not checked this stuff for a while. 

You need to get lines to take drafted quickly. You can prepare in advance though. This could be a sector issue which has now got to you. If so, look at other examples of organisations similar to yours that have had a crisis, have a look at what they said and how it went. 

You can find this sort of thing by searching for the name of the brand or the institution or whatever, or even the sector in general, and adding “crisis” or “scandal”, or similar. If it’s specific, such as a data breach, obviously use that word/phrase.

Apocalypse case

It’s a good move to have something in place for if there is a complete power outage, sort of the end-of-the-world thing. An old boss of mine called it the “apocalypse case”. This was a bag or box that had everything in it that we would need if all the systems we had in place broke down.

These included several pens, note pads, fully charged laptop, fully charged PAYG phone, broadband dongle and spare data Sim cards for every network we could think of, fully charged power banks, wind-up radio, wind-up torch. Basically, everything you can think of that you will need to be in contact with the outside world. 

It’s very unlikely you need any of this but we’re planning for the worst case and, only by doing that, have you actually prepared.

Afterwards

This is all the first stages. Once you’re through that, and are making your back-to-normal noises, you’re looking at recovery and pushing any negative stories away from page one of Google. But that’s for another day.

It’s vital you go through everything when it’s all settled down, as soon as possible, while it’s still fresh and you can still “feel” it. It’s called a “wash-up meeting” - another awful phrase. 

But it’s very useful because you’re looking to tighten things up for next time. You want to start practicing this stuff, at least once a year. 

Have solemn-looking head shots available of everyone who might be called on to comment. You probably won’t use them but, if somebody asks for a picture, you’ve got a suitable picture.

In the meantime just remember that, as horrible as it feels when you’re in the middle of the thing, it will pass.

If you need help, get in touch.