In March 2018, The New York Times, The Guardian, and The Observer jointly revealed that millions of Facebook users’ data had been harvested by third-party apps through a legal loophole four years earlier.
This data was then used by Cambridge Analytica, a digital consulting firm, to target and profile U.S. voters during the 2016 Trump presidential campaign.
Who was legally in the right or wrong is a discussion best left to legal professionals. But the event served as a case study of how these types of crises can unfold, the damage they can cause, and how companies choose to respond.
“Crisis communications” refers to how an organization manages its response to an incident that could harm its reputation, people, finances, or both. But more than that, it’s about shaping how others perceive and respond to the incident.
At its core, it’s about controlling the narrative. It’s marketing with a protective edge. And there’s no way around it, whether you’re in the gardening business or responsible for safeguarding the sensitive data of millions.
This PR.co white paper outlines the fundamental principles of crisis communication, examines crises through real-world case studies, and ultimately demonstrates how to manage a crisis effectively to minimize its impact.
Table of Contents
The Basics of Crisis Communications
A well-structured crisis communication plan is typically divided into three key phases. Each plays a distinct role in managing risk and shaping public perception.
- The pre-crisis phase focuses on preparation. This is when you establish protocols, train spokespersons, and identify potential vulnerabilities.
- The during-crisis phase is about rapid, clear, and coordinated communication to contain the fallout and maintain trust.
- The post-crisis phase involves reflection, accountability, and reputational and operational recovery.
Together, these phases provide a framework to navigate uncertainty with clarity and control.
Different Types of Crises
Crises come in all shapes and sizes, from global events like the COVID-19 pandemic, which disrupted most organizations worldwide, to incidents with important legal implications, such as data breaches.
These events often result in reputational harm and financial fallout, particularly for public companies where shareholder value may be directly impacted.
Let’s look at the different types of crises a company can face:
Pre-Crisis: Preparation
Crises feed on disorder and confusion. This is why it’s crucial for the PR team to identify the individuals who will step up when needed.
Each person must understand their role within the communication plan, and the plan’s flow should be clearly mapped out.
Does the executive team convene first? Who drafts the initial media response? Who serves as the spokesperson? At what stage does legal counsel become involved?
When planning for these scenarios, it’s best to prepare for the worst. This means that, when a crisis hits, the team is ready to respond with speed and cohesion.
Draft Your Crisis Communication Plan
The first step is to create your crisis communication plan. Follow these steps to set your team off on the right track:
1. Assemble a Crisis Response Team
The crisis communications team serves as the nerve center of your broader crisis management protocol. When you assemble this team, it’s essential to identify key personnel and clearly define the role each of them will play.
-
Spokesperson(s): This is the public voice of the company during the crisis. Their role is to deliver clear and consistent messages to the media, stakeholders, and the public. (See our FAQ section for info on how to handle difficult questions.)
- Communications Lead: This person is tasked with drafting all communications after they’ve consulted with executive leadership and legal counsel. This role ensures messages are accurate, timely, and aligned with the company’s overall strategy.
- Legal Counsel: As a rule, no external communication should be released without legal review and approval. Legal counsel will likely be involved in every step of the crisis communication process to ensure compliance and mitigate liability. Identify who will fulfill this role.
- Executive Leadership: While input is gathered from all crisis communication team members, final decisions rest with executive leadership. Their role is to weigh legal, reputational, and operational considerations to determine the company’s course of action.
▴ President George W. Bush talks on the phone while his senior staff huddle on Air Force 1 after 9/11.
2. Communication Protocols
Stakeholders must know precisely who the first point of contact is once the proverbial red buzzer is triggered. This includes clarity on who calls the first meeting, who has the final say on decisions, how the approval process works, and what the escalation procedure entails.
A clear chain of command and communication structure prevents confusion and delays at the most critical moments.
3. Emergency Procedures
In a crisis, the goal is to leave as little as possible for individual team members to figure out on the fly.
Document emergency procedures in detail, and ensure all stakeholders have access to them. This includes having pre-prepared statements, press releases, and internal updates for every plausible scenario.
Think of it like the emergency number posted on your fridge. When panic strikes, you don’t want to search for instructions—you want to know exactly where they are.
4. Training and Testing
Crisis communication training isn’t a one-off exercise but rather an ongoing investment in your organization’s resilience. The goal is to build muscle memory so that when a crisis hits, everyone knows what to do, how to communicate, and who’s in charge.
Ensure you have regular training and testing sessions in place.
5. Create a Crisis Communications Playbook
Start with thorough documentation. Your crisis plan should be accessible, easy to follow, and tailored to the specific roles involved.
Include:
- Contact Trees: These outline who needs to be informed, in what order, and through which channels, ensuring rapid and efficient communication.
- Communication Templates: Pre-drafted templates help teams to respond quickly and consistently across channels, which cuts the risk of errors or mixed messaging. See our example in the FAQ section below.
- Escalation Protocols: Escalation protocols define when and how an issue should be escalated to senior leadership or specialized teams based on its severity and impact.
- Pre-Approved Messaging Frameworks: Messaging frameworks, such as CAPS (Concern, Action, Plan, Support), can guide the tone and structure of your responses to ensure empathy, accountability, and clarity under pressure.
During a Crisis: Action
When a crisis hits, speed, clarity, and control are everything. This is the moment your preparation is put to the test. The actions taken in the first hours and days can significantly influence public perception, stakeholder confidence, and long-term brand reputation.
In this section, we outline the critical steps to take during a crisis.
Your Crisis Response Playbook
Step 1: Detect and Verify the Issue
Verify that the incident is indeed real and requires the implementation of the crisis communication plan.
Social media rumors, internal Slack messages, or an alert from your IT system may raise a red flag. However, always verify the information through credible internal sources first. Designate a person to assess alerts and escalate only what’s legitimate.
Step 2: Classify the Severity
Not every incident deserves DEFCON 1 (the highest state of alert in the U.S. military’s Defense Readiness Condition system).
Use a tiered system to understand how serious the situation is:
- Level 1: Local or limited impact.
- Level 2: Regional or reputational risk.
- Level 3: High-impact, enterprise-wide.
Each level triggers different stakeholders and urgency levels. Check that your team can differentiate between a Level 1 and Level 3 crisis.
Step 3: Activate the Crisis Team
Alert your crisis response team, assign clear roles, and initiate your playbook.
It pays to have an assigned group chat on your internal messaging platform, like Slack or WhatsApp, for these kinds of emergencies.
Step 4: Craft your Messaging
This is where preparation pays off. Use your pre-approved templates to craft consistent, clear messaging for each audience, including internal teams, the public, the media, customers, and partners.
Keep it human. Be transparent. Focus on facts, empathy, and the actions you’re taking.
The CAPS method mentioned earlier is a trusted communication tool in public relations. In practice, a statement using the CAPS formula could read as follows: “We’re aware of the issue, we’re investigating it, here’s what we’re doing, and here’s how you can stay informed.”
▴ New Zealand Prime Minister Jacinda Ardern addresses the nation with compassion and resolve after the Christchurch mosque attacks.
Step 5: Choose the Most Appropriate Channels
Distribution is just as important as the message itself, and the communication channels you choose will depend on your audience. An effective crisis response hinges not only on what you say but also on where and how you say it.
Different stakeholders rely on various channels for information. Each platform carries its own strengths, limitations, and expectations.
Here are the different kinds of communication channels to consider:
- Internal comms: Email, Slack, the intranet.
- Customers: Company website, email blast, social updates.
- Media: Press releases, spokesperson briefing.
- Regulators/Investors: Direct outreach with legal review.
Skip to our FAQ section for more info on how to communicate on the correct channels
Step 6: Monitor, Respond, and Adapt
This last step is all about listening and being able to adapt to control the reaction—in other words, controlling the narrative.
Monitor media coverage, social sentiment, customer feedback, and competitor response, and adjust your messaging if necessary. Stick to the facts.
Post-Crisis: Evaluation
How a company handles the aftermath of a PR crisis can define its long-term reputation. In this phase, it’s important to monitor public sentiment and media coverage to assess how the response is received.
Ongoing communication with stakeholders and affected audiences helps rebuild trust and demonstrate accountability.
It’s also important to take account of what worked in the crisis communication plan, what didn’t, and how the plan can be improved.
The Aftermath Playbook
You have a playbook for the pre-crisis phase, so there should also be a step-by-step guide for what happens once the dust has settled.
A crisis rarely has a clearly defined beginning and end, and it often takes years of managing negative press and rebuilding reputation to restore the company to its pre-crisis standing.
Here’s what to do in the aftermath:
- Monitoring and Analysis: Track media coverage, social media conversations, and public sentiment to understand the ongoing impact of the crisis and identify any emerging issues.
- Stakeholder Follow-Up: Maintain open lines of communication with customers, employees, partners, regulators, and investors by providing updates, answering questions, and addressing any lingering concerns.
- Internal Review and Debrief: Conduct a thorough “post-mortem” to evaluate the crisis response—what went well, what failed, and the lessons learned.
- Updating Protocols: Revise your crisis communication plans, policies, and training based on insights from the debrief to better prepare for future incidents.
- Rebuilding Reputation: Implement long-term reputation management strategies, including positive storytelling, community engagement, and transparency initiatives. This last point is worth unpacking even further.
A textbook example of effective crisis aftermath management is Johnson & Johnson’s response to the 1982 Tylenol tampering case. After seven people died from cyanide-laced Tylenol capsules—tampered with by an unknown individual after the products had left company control—Johnson & Johnson, a pharmaceutical and healthcare company, took immediate and decisive action. Despite not being at fault, they voluntarily recalled over 31 million bottles nationwide, demonstrating a clear commitment to public safety over profit. Their response set a new industry standard: they introduced tamper-evident packaging, launched public safety campaigns, and worked closely with authorities, regulators, and the media to rebuild trust. Within a year, Tylenol had regained its position as America’s leading over-the-counter painkiller—proof that putting ethics first can lead to long-term brand resilience.
▴ In the wake of the 1982 Tylenol poisonings, Johnson & Johnson took swift action—issuing urgent media warnings and launching a nationwide recall of over 31 million bottles, setting a new standard for consumer safety.
How To Rebuild an Organization’s Reputation
This is a long-term effort that requires strategic, authentic, and sustained action.
Here are the key initiatives the company could undertake to restore trust and credibility:
- Demonstrate Change
After the apology, the natural next question is: what now? Words alone won’t repair a damaged reputation.
Stakeholders will look for concrete, visible actions that show the company isn’t only listening but evolving. You may have to overhaul internal policies, introduce new leadership, or implement stricter oversight measures.
- Maintain Transparent Communication
Rebuilding trust is a process, not a single statement. This is why transparency is critical in the weeks and months that follow a crisis.
Clear, consistent updates about your progress—even when the news is difficult or incomplete—show that the company is committed to accountability.
Whether through press briefings, social media, or investor updates, the goal is to replace speculation with clarity and maintain control of the narrative.
- Rebuild Internal Culture
While much of the public attention may focus on external reactions, the internal audience is just as important.
Employees are the heartbeat of any organization, and in the aftermath of a crisis, they need to be re-engaged and reassured. This could mean hosting town halls, investing in internal communications, or taking deliberate steps to rebuild morale.
- Reconnect With the Community
A damaged reputation can distance your company from your customers, partners, and the broader community. Demonstrate a renewed commitment to the people who matter most to close this gap.
- Leverage third-party endorsements
Sometimes, the most powerful way to restore credibility is through the voice of someone else. Independent validation—whether from regulators, NGOs, respected industry figures, or even former critics—can help to rebuild a company’s standing.
- Tell a new story
Once the immediate damage is under control and the rebuilding process has begun, the long-term goal is to reposition the brand. This is where storytelling becomes a powerful tool.
Shape a new narrative around the company, highlighting leadership, responsibility, and lessons learned.
Crisis Communications Toolkit: Software, Tools, and Resources
Effective crisis communication requires the right tools, infrastructure, and resources to ensure a timely and effective response.
Today’s crisis comms professionals rely on a wide range of software platforms and resources to respond swiftly and strategically. This includes real-time media monitoring, streamlined internal coordination and workflows, and spokesperson training.
Below is a list of tools that can help PR teams stay prepared, aligned, and in control:
Media Monitoring and Sentiment Analysis
These tools help track brand mentions, public sentiment, and media narratives in real-time:
Our pick: PR.co
Not to toot our own horn here but we really do feel like we’ve fixed what’s broken in media monitoring.
No more vanity metrics, messy dashboards, or alerts you don’t need. PR.co’s Media Monitoring gives you clean, curated insights—automatically matched to your press releases, enriched with context, and ready to share.
And the best part? It’s priced to be accessible—finally, a powerful media monitoring tool that doesn’t break your budget.
Other options:
- Meltwater: Real-time media monitoring, social listening, and media outreach in one platform.
- Cision: Comprehensive media intelligence and PR software that includes monitoring, distribution, and analytics.
- Brandwatch: Advanced social listening for tracking public sentiment and spotting early warning signs.
-
Talkwalker: Great for visualizing data trends across news, social media, blogs, and forums.
2. Social Media Management
Manage multi-channel communication, schedule updates, and respond quickly to stakeholder concerns with the following tools:
Our pick: Sprout Social:
This tool offers detailed social reporting and team workflows ideal for coordinating PR responses.
Other options:
-
- Hootsuite: Helps PR teams schedule social content, monitor brand mentions, and assign team roles during a crisis.
- Crisp: Real-time, AI-powered customer support and social monitoring tool for crisis alerting and response.
- Hootsuite: Helps PR teams schedule social content, monitor brand mentions, and assign team roles during a crisis.
3. Documentation and Knowledge Management
The below tools provide a central place to store and update your crisis plans, escalation protocols, FAQs, and templates:
Our pick: Notion:
A versatile workspace for hosting crisis comms plans, decision trees, and real-time updates.
Other options:
- Confluence: A robust documentation platform with access control and update logs.
- Google Workspace: A platform for simple, cloud-based collaboration on messaging drafts and live documents.
Honorable mention:
PR.co: A well-structured newsroom and central hub for your organization’s communications, housing everything from breaking news updates and opinion pieces to milestones, mission statements, and blog content. PR.co allows you to reach your target audience directly through an accessible, shareable, and easy-to-manage platform.
4. Professional Resources
- PR.co’s Pioneer Academy: Years of practical crisis comms knowledge have been distilled into a practical, easy-to-follow course.
- ICCO PR: Resources, case studies, and ethical guidance on crisis communications.
- Online simulations: Services like Polpeo offer virtual crisis simulations for training PR teams.
Crisis Playbooks in Action: Lessons from Facebook and MH370
By examining two very different crises, we can gain insights into how organizations implement their crisis communication plans and manage public response.
Case Study 1: Facebook and Cambridge Analytica Data Scandal
The Facebook data scandal involved the unauthorized harvesting of millions of users’ personal data by third-party apps, which was later used by Cambridge Analytica to influence political campaigns.
In response, Facebook initially hesitated but eventually issued a public apology, increased transparency, implemented stricter data privacy policies, and revamped its platform controls to prevent future misuse.
Their response included:
- Public Admission and Apology: As media scrutiny intensified, Facebook CEO, Mark Zuckerberg, publicly acknowledged the tech company’s role in how the data was handled, issued an apology, and took responsibility for its role in the debacle.
- Transparency Efforts: Facebook released detailed explanations about how the data was accessed, the scope of the situation, and its implications for users.
- Policy Changes and Platform Updates: The company announced and implemented stricter data privacy policies, tightened third-party app access, and introduced new tools for users to control their data.
- Engagement With Regulators: Facebook cooperated with investigations by government agencies and committed to compliance with emerging data protection regulations.
- Ongoing Communication and Reputation Management: Facebook continued to regularly update users and stakeholders on improvements and better security measures, aiming to rebuild trust over time.
▴ Facebook CEO Mark Zuckerberg testifies before the U.S. Congress in 2018, facing intense scrutiny over the Cambridge Analytica scandal.
Case Study 2: Malaysia Airlines MH370 airplane disappearance
Malaysia Airlines Flight MH370 mysteriously disappeared on March 8, 2014, while en route from Kuala Lumpur to Beijing. This event sparked one of the largest and most complex aviation search efforts in history.
What follows is their crisis communication response:
- Immediate Acknowledgment and Information Release: Malaysia Airlines promptly confirmed the plane was missing and began sharing available information as the situation developed.
- Establishment of a Crisis Center: The airline established a dedicated crisis response center to coordinate communication efforts and manage the flow of information to families, the media, and authorities.
- Regular Updates and Press Conferences: Frequent briefings were held to provide the latest developments. These often involved government and aviation officials alongside the airline’s representatives.
- Support for Families and Victims: Malaysia Airlines prioritized direct communication with passengers’ families, providing support services, counseling, and regular updates.
- Collaboration With International Agencies: The airline worked closely with global aviation authorities, governments, and search teams to share information and coordinate efforts.
▴ Malaysian officials, including then-Prime Minister Najib Razak, address the global media during a tense press conference following the mysterious disappearance of Malaysia Airlines Flight MH370.
Your Newsroom, Your Narrative: Managing Crises with PR.co
A well-structured newsroom is much more than a repository for press releases—it becomes your organization’s command center when a crisis hits.
Your PR.co newsroom can serve as a single source of truth, allowing you to publish real-time updates, address misinformation, and ensure all stakeholders have immediate access to verified information.
PR.co empowers your team to communicate transparently and consistently, no matter how fast the situation is evolving. Not a customer yet? You know where to find us.
▴ Wise uses its digital press hub to organize key company updates, research findings, and public policy positions—making critical information easily accessible to regulators, investors, customers, and employees alike.
Frequently Asked Questions
How should PR teams communicate messages on the various channels?
When things go wrong, owned channels become the fastest and most trustworthy route to reach your audience.
Here’s what to share where:
Corporate Website
The company website can often be the first destination for external stakeholders seeking clarity during a crisis. It could serve as the authoritative source for official updates, press releases, and messages from the CEO. Importantly, it allows you to control the messaging being published.
Creating a dedicated crisis landing page or placing a prominent banner on the homepage helps centralize communication and avoid confusion. This channel also offers the space and flexibility to share detailed information, documents, and multimedia content—all under the brand’s complete control.
Social Media Platforms
Platforms like X (formerly Twitter), LinkedIn, Instagram, and Facebook are critical tools for reaching broad audiences quickly and directly.
However—and it’s a significant point—the immediacy and public nature of these platforms require caution. Every post must be carefully worded, and a dedicated comment moderator should be monitoring the situation.
Social media channels are best used for sharing brief, consistent updates, correcting misinformation, and directing users to more detailed statements on the company website.
Press Briefings and Media Statements
In high-profile cases, the media will inevitably come knocking for answers. The key to controlling the narrative is to engage with them on your own terms.
While this won’t always be fully possible, press briefings offer an opportunity to achieve several critical objectives. They provide a platform to present the facts clearly, communicate the situation with empathy, and reinforce your company’s credibility, especially when led by a well-prepared, media-trained spokesperson.
Media statements will usually accompany a press briefing and a statement on the company’s website.
What is the role of the spokesperson in a crisis?
A company spokesperson is the official voice of the organization, representing the company to the public, media, stakeholders, and sometimes employees. They can directly influence how a crisis is perceived and how successfully it is managed.
Their role is to:
- Deliver Clear, Accurate Information: Provide timely and fact-based updates that reflect the company’s position and actions taken.
- Project Credibility and Confidence: Speak with authority, empathy, and composure to reassure stakeholders and reinforce trust.
- Maintain Message Consistency: Ensure all public statements align with the company’s core messaging and approved crisis communication plan.
- Manage Media Relations: Handle press briefings, interviews, and media inquiries professionally, often under intense pressure and scrutiny.
- Humanize the Brand: Put a human face to the company by communicating with sincerity and empathy, especially when people have been affected.
How should a PR team or spokesperson handle difficult questions during press briefings?
Any PR team or spokesperson will inevitably face tough questions from the media. How they respond can either reinforce credibility or deepen the fallout. Preparation and composure are key.
These five essential tips will help you navigate difficult questions with clarity, control, and confidence.
Bridge Back to Key Messaging- Tip: Acknowledge the question, then smoothly transition (“bridge”) back to the prepared message.
- Example: “That’s an important question, but what we’re focused on right now is ensuring that…”
- Why: It helps steer the conversation and keeps the narrative aligned with the prepared communication strategy.
- Tip: The spokesperson should keep their tone neutral and body language open, even when faced with aggressive questioning.
- Why: Losing composure can undermine credibility and escalate the situation. Calmness projects confidence and control.
- Tip: If the spokesperson doesn’t know the answer, they should say so and commit to finding it. They should avoid speculation at all costs.
- Example: “I don’t have that detail right now, but I’ll follow up as soon as I do.”
- Why: Guessing or misleading erodes trust and can cause long-term reputational damage.
- Tip: The spokesperson should be concise. They should deliver the answer, then pause. No rambling or filling silences.
- Why: Over-explaining opens the door to misinterpretation or unintended disclosures.
- Tip: The person should anticipate difficult or uncomfortable questions and practice answering them during mock interviews or media training.
- Why: Preparedness reduces panic and ensures the individual’s response supports the company’s position.
What Does a Drafted Crisis Communication Template Look Like?
As part of your preparation phase, it’s important to create draft crisis communication templates. These will differ depending on the communication channels.
For example, a typical press release or company website statement usually begins by acknowledging the problem and the concerns of affected parties. Subsequently, it outlines the steps the company is taking to address the situation and support those impacted.
Here’s a good example:
[Company letterhead or logo]
FOR IMMEDIATE RELEASE
[Date]
[Headline: Keep this brief, factual, and calm, e.g., “Company Responds to [Incident]”]
[City, State] — We are aware of the [brief description of the incident, e.g., “data security incident involving a portion of our customer accounts”], that occurred on [date/timeframe], and we understand the concern this may cause.
We want to assure you that our team is taking this matter extremely seriously. As soon as we became aware of the issue, we [action taken, e.g., “took immediate steps to contain the situation, launched a full investigation, and engaged third-party experts to assist”].
At this time, we are [describe the current status and what’s being done, e.g., “working to identify the root cause, assess the impact, and notify any affected individuals”]. Our top priority is maintaining the trust of our stakeholders and ensuring the safety and security of our [customers/data/services/etc.].
We are committed to transparent communication and will continue to provide updates as more information becomes available. Anyone seeking further information or assistance can reach out via [contact method, e.g., press@company.com or a dedicated hotline].
We deeply regret the disruption and concern this incident may have caused, and we are doing everything in our power to address it quickly and responsibly.
Media contact:
[Name]
[Title]
[Email]
[Phone]
[Company website or media page]