Crisis Communication Plan: A Template for Small and Mid-Size Businesses

A crisis communication plan is a short written document that says who decides, who speaks, what you say first and where you say it when something goes wrong. For a small or mid-size business it should cover your likely risk scenarios, a crisis team with named roles, clear thresholds for escalating, an approval chain that includes legal, current contact lists, pre-approved holding statements, your channels, how you monitor, guidance for employees and an after-action review. Most businesses can fit it on a few pages.

The point isn’t paperwork. It’s that when a video goes viral at 9 p.m. on a Friday, nobody has to work out from scratch who is allowed to post a reply. For how real companies have handled that moment, see our PR crisis examples.

Why smaller businesses need one

Large companies have communications departments. Smaller businesses usually have an owner, a manager and whoever runs the social accounts. In a crisis, that means decisions get made fast by whoever happens to be online, and the first public response is often made up on the spot.

A plan fixes three predictable problems: nobody knows who has authority to speak, the first statement says too much or too little, and different people give different answers. Writing it down in a calm week costs a few hours. Making it up in a bad week can cost far more.

The 10 components of a crisis communication plan

1. Risk scenarios

List the five to ten situations most likely to hit your business. Be specific to your industry. A restaurant might list a food safety complaint, a health inspection result, a viral video from a customer and a staff member’s offensive post. A software company might list an outage, a data breach and a pricing change that angers customers. A consumer brand might add a controversy involving an influencer partner. For each, note who is affected and what the first 24 hours would look like.

2. The crisis team and roles

Name people, not job titles alone, and a backup for each role. In a small business one person may hold two roles.

• Lead: makes final decisions and owns the response.
• Spokesperson: the only person who speaks to media and posts official statements.
• Legal adviser: in-house or outside counsel who reviews statements where there is legal exposure.
• Operations: gathers the facts and fixes the underlying problem.
• Channel owner: manages social accounts, the website and review replies.
• Staff and customer liaison: keeps employees and customer service informed.

3. Decision thresholds

Not every complaint is a crisis. Define in advance what moves an issue from “handle as normal” to “activate the plan.” Useful triggers include: any risk to health or safety, any media inquiry, any legal or regulatory involvement, a post or review being shared well beyond your usual audience, a sudden run of reviews about one issue, or anything involving an employee’s conduct. Use three levels, such as monitor, respond and activate, so the team knows how seriously to treat each one.

4. Approval chain with legal

Write down who must approve a public statement at each level, and how fast. A routine review reply needs no sign-off, as long as it follows your review response policy. A holding statement about a safety issue might need the lead and legal. Agree a target turnaround so approval doesn’t become the bottleneck, and name who can approve if the usual person can’t be reached.

5. Contact lists

Keep one list with mobile numbers and personal emails for the crisis team, outside counsel, insurers, key suppliers, your web host or developer, and anyone who controls account logins. Include platform support routes you might need. Store a copy somewhere you can reach even if company email or systems are down.

6. Pre-approved holding statements

For each risk scenario, draft a short holding statement now and get it approved in advance. When the moment comes, you fill in a few details rather than writing from scratch under pressure. Our guide on how to write a holding statement includes templates you can adapt.

7. Channels

List every place you might need to communicate and who controls it: website, each social account, email list, Google Business Profile, review platforms, customer service scripts, and internal channels for staff. Decide where the main statement will live (usually a page on your own website) so every other channel can link to it.

8. Monitoring

You can’t respond to what you don’t see. Set up alerts for your brand name, key people and products across news, social media and review sites, and decide who checks them and how often. During an active crisis, monitoring moves from daily to near constant. Our brand monitoring service covers this if you would rather not run it yourself.

9. Employee guidance

Tell staff what to do if they are asked about the situation: don’t comment, pass media and legal questions to the spokesperson, and don’t argue online on the company’s behalf. This works best alongside an existing employee social media policy that already explains who can speak for the business.

10. After-action review

Once things settle, meet and write down what happened, what worked, what was slow and what you will change. Update the plan, the contact list and the holding statements. This is how the plan gets better each time it is used.

Crisis communication plan template outline

Use this outline as the skeleton of your document. Fill in each row with your own details.

Section	What to fill in
Purpose and scope	One paragraph on when the plan applies and who it covers.
Crisis team	Names, roles, backups, mobile numbers.
Escalation levels	Your monitor, respond and activate triggers, with examples.
Approval chain	Who approves what at each level, target turnaround, fallback approver.
Risk scenarios	Your top five to ten scenarios, each with first steps and the linked holding statement.
Holding statements	Pre-approved drafts with blanks for date, details and next update.
Channels and access	Every channel, its owner, and where logins are stored securely.
Monitoring	Tools, search terms, who checks and how often at each level.
Employee guidance	What staff should and shouldn’t say, and who to refer questions to.
External contacts	Counsel, insurer, regulators if relevant, key suppliers, platform support.
After-action review	A short template: timeline, what worked, what to change, owner and date.

How to run a tabletop exercise

A plan that has never been tested is a guess. A tabletop exercise is a short meeting where the crisis team talks through a realistic scenario as if it were happening. It takes an hour or two and needs no special tools.

1. Pick one scenario from your list. Choose something plausible, not a disaster movie.
2. Write three or four updates. The first is the trigger. Later updates add complications: a reporter calls, a post is shared widely, a key person is unreachable.
3. Read each update aloud and ask the team what they do. Who decides? What do we say first? Where? Who approves it? How long does it take?
4. Draft the actual holding statement. Time how long approval takes.
5. Write down every gap. Missing logins, unclear roles, statements nobody had approved, contacts that were out of date.
6. Fix the gaps and update the plan. Then schedule the next exercise, typically once or twice a year.

A worked example

This is an illustrative scenario, not a real client. A family-owned home services company with three locations writes its first crisis communication plan.

Its risk list includes a damage claim posted with photos on social media, a technician’s driving caught on video, a data leak from its booking system, and a wave of reviews after a price increase. The owner is the lead, the operations manager is the spokesperson, outside counsel is named for legal review, and the office manager owns the social accounts and review replies.

During a tabletop exercise on the driving video, the team finds two gaps. Only one person has the login for the company’s main social account, and that person is on vacation in the scenario. And no one is sure whether the spokesperson can post without the owner’s approval. They fix both: logins go into a shared password manager, and the approval chain now says the spokesperson can publish a pre-approved holding statement straight away and must get the owner’s sign-off for anything beyond it.

A few months later, a similar video appears. The holding statement goes up within the hour, the team checks the facts, and a fuller update follows the next day. The response isn’t perfect, but it is calm, consistent and fast, which is most of what a plan is for. Our guide on responding to a viral negative post covers what to do in the hours after something like this takes off.

Common mistakes

• Writing the plan and never testing it. Gaps only show up when you rehearse.
• Naming roles but not backups. Crises rarely happen when everyone is available.
• Leaving legal out until the last minute. Where there is legal exposure, bring counsel in early rather than asking them to approve a finished statement in ten minutes.
• Letting the plan go stale. People leave, phone numbers change and accounts get new owners. Review the plan at least once a year.
• Treating it as a PR script only. The plan must also cover fixing the underlying problem. Communication without action rarely holds up.

When to get outside help

Most small businesses can write and test a workable plan themselves. Outside help is worth considering if you operate in a regulated industry, have several locations or brands, have been through a crisis that went badly, or don’t have anyone with the time to maintain monitoring. Our online reputation crisis management service can help build the plan, set up monitoring and support you when an incident happens.

Frequently asked questions

What should a crisis communication plan include?

At minimum: your likely risk scenarios, a crisis team with named roles and backups, thresholds for escalating, an approval chain that includes legal, contact lists, pre-approved holding statements, a list of channels and who controls them, a monitoring setup, guidance for employees and a process for reviewing what happened afterward.

How long should a crisis communication plan be?

For a small or mid-size business, a few pages is usually enough, plus an appendix of holding statements and contacts. The shorter and clearer it is, the more likely people are to use it under pressure.

How often should we update the plan?

Review it at least once a year, after any tabletop exercise, and after every real incident. Update it whenever someone on the crisis team changes roles or leaves.

Who should be the spokesperson in a small business?

Usually the owner or a senior manager who is calm under pressure and knows the facts. The most important thing is that there is one named spokesperson and a backup, so customers and media hear one consistent voice.