Crisis Management Plans That Work Under Pressure

What a crisis management plan must do

A crisis management plan sets out how an organisation will lead through disruption that exceeds normal operational or incident management arrangements.

The disruption might begin with a cyber incident, serious safety event, supply chain failure, loss of a critical facility, regulatory issue, reputational event or another major operational problem. The initiating event matters, but so do the consequences that develop around it.

Senior leaders may need to make decisions with incomplete information, coordinate several parts of the organisation, communicate with employees and external stakeholders, protect critical operations and set the direction for response and recovery.

A useful plan helps the organisation move quickly from recognising a developing problem to establishing leadership, priorities and control. It should not require executives to design the response process while the event is already unfolding.

The distinction between executive direction and operational control is important. Operational teams manage the incident and technical response. The crisis team sets organisation-wide priorities, resolves competing demands, considers wider consequences and makes decisions that exceed operational authority.

The initiating event matters, but so do the consequences that develop around it.

When an incident requires executive escalation

Not every disruption requires the crisis management team. Many incidents can be managed through normal operational, emergency or technical arrangements. Escalation becomes necessary when the actual or potential consequences begin to exceed those arrangements.

Useful escalation indicators include:

• significant uncertainty about what has happened or what may happen next
• consequences spanning several business areas, locations or response teams
• potential harm to people, critical operations, reputation or stakeholder confidence
• sustained executive or board attention
• significant regulatory, government, customer or media interest
• decisions involving competing organisational priorities, tolerances or resources
• impacts likely to continue beyond the initial incident.

This is why consequence-based escalation thresholds matter. If a plan only says that the crisis team should activate for a major incident, leaders still have to decide what major means while events are moving quickly.

Early escalation does not require an immediate declaration of crisis. It creates the option for leaders to assess the situation, anticipate consequences and mobilise support before the organisation loses time or control.

What the plan should contain

The strongest plans are usually simpler than organisations expect. They establish arrangements that leaders can apply across different types of disruption rather than trying to predict every possible scenario.

1 Escalation and activation

The plan should explain how an emerging issue is identified, assessed and escalated. It should define activation criteria, notification pathways, who can activate the crisis team, how after-hours activation works, and how operational teams connect with executive leadership.

2 Executive roles and decision authority

Participants should understand what they are responsible for and which decisions they can make. This includes the crisis leader, operational leads and functions such as communications, people and culture, legal, risk, technology and business continuity where relevant.

Deputy and alternate arrangements are essential. A plan that depends on one executive being available is vulnerable before the response begins.

3 A common operating picture and rhythm

Once activated, the team needs a disciplined way to establish shared situational awareness and maintain momentum. The plan should provide for an initial briefing, agreed priorities, a structured meeting agenda, regular situation reporting, clear actions and accountabilities, and decision and action logs.

These tools should reduce cognitive load and support decisions. They should not create administration that distracts the team from the problem.

4 Decision support

Crisis decisions are rarely made with complete information. The plan should help leaders define the main problem, distinguish facts from assumptions, identify what remains uncertain and determine which decisions cannot wait.

Decision support should consider likely consequences, stakeholder impacts, critical dependencies, available options, the risk of delay and what information could materially change the decision. The outcome should be recorded with the rationale, owner and review point.

5 Stakeholder and communication arrangements

Communication should support the broader response. The plan should identify priority stakeholders, relationship owners, approval authorities and how internal and external messages will be coordinated as the situation changes.

Employees, customers, regulators, partners, government agencies and media may need different information at different times. Leaders should be able to agree the first message quickly, even when some facts remain uncertain.

6 Integration with emergency response and continuity

Crisis management does not operate in isolation. Emergency teams may be protecting people and controlling the immediate incident while the crisis team manages wider organisational consequences. Business continuity arrangements may be sustaining priority operations or establishing alternative ways of working.

The interfaces between these teams must be clear. Otherwise, several groups can respond to the same disruption using different information, working to competing priorities or assuming another team owns an important decision.

7 Stand down transition and improvement

The end of the immediate crisis is not necessarily the end of the response. The plan should explain who decides to stand down, how unresolved issues transfer into recovery or business-as-usual management, what records must be retained and how lessons will become prioritised improvement actions with owners and timeframes.

A plan that depends on one executive being available is vulnerable before the response begins.

Common weaknesses in crisis plans

A complete-looking document can conceal significant readiness gaps. Common weaknesses include:

• The plan is too long or difficult to navigate under pressure.
• Activation is ambiguous or depends on an undefined major incident.
• Roles and decision authorities exist on paper but have not been tested.
• The plan assumes preferred executives, facilities and systems will be available.
• Executive, operational and continuity arrangements use different priorities or information.
• The plan has not been exercised against realistic constraints.

These weaknesses often remain invisible during document reviews. They become clearer when people have to use the arrangements to interpret information, make decisions and coordinate action.

Plans should be proportionate

Not every organisation needs a large crisis plan. A smaller organisation may require a concise framework, clear escalation arrangements, defined leadership roles and a small set of practical tools. A larger or more complex organisation may need several response levels, business-unit interfaces, detailed stakeholder arrangements and supporting procedures.

The relevant test is not how comprehensive the document appears. It is whether the arrangements give the right people enough structure and authority to act effectively when normal ways of working are no longer sufficient.

How to test whether the plan will work

Use it. A well-designed exercise places the team into a realistic but controlled situation and requires participants to recognise the issue, escalate, establish priorities, make decisions and manage changing consequences.

Within the first 30 minutes, leaders should be able to state:

• the main problem the organisation needs to solve
• the immediate organisational priorities
• the critical operations and stakeholders at risk
• the decisions required now and who has authority to make them
• the first messages and actions
• when the situation will next be reviewed.

Exercises should also test whether the team can activate outside business hours, operate without key people or systems, obtain reliable information, coordinate with operational teams and sustain an effective rhythm as the situation evolves.

The purpose is to identify weaknesses before a real event exposes them and to build evidence that the arrangements are usable.

The plan is only one part of readiness

A crisis management plan matters, but the document is not the capability. Readiness comes from clear governance, practical arrangements, capable people, usable tools, current information and regular testing.

If the organisation already has a crisis plan, the most useful question may not be whether it needs rewriting. It may be whether there is enough evidence and confidence that leaders could use it effectively tomorrow.

ResponseRise works with organisations across New Zealand and Australia to assess, strengthen and test crisis management and business continuity arrangements. Support can begin with a readiness review or progress through capability development, exercises, lessons review and ongoing readiness support.

If you want an independent view of where your organisation is well prepared, where it remains exposed and what should be strengthened first, talk to ResponseRise about a Crisis and Business Continuity Readiness Review.