How to Build a Crisis Management Team: Roles, Structure and Rhythm

A crisis team is the small group of people who take charge when something threatens your organization’s safety, operations or reputation. It usually has a leader who makes the final call, a communications lead, legal counsel, an operations lead who fixes the actual problem, and someone responsible for employees, with each role backed up by a named deputy. The team works best when it is small, has clear decision rights, and meets on a fixed rhythm until the issue is under control.

This guide focuses on the people: who to choose, what each role does, how the team is activated and how it runs. For the wider document that surrounds the team, including risk scenarios and holding statements, see our guide to building a crisis communication plan.

Why a named team matters

When nothing is written down, a crisis is handled by whoever happens to be online. That usually produces three problems at once: several people speak publicly and say different things, nobody is sure who has authority to approve a statement, and the work of actually fixing the problem gets lost in the noise.

A named team solves this by answering in advance the two questions that waste the most time in the first hour: who decides, and who does what. It also protects everyone else in the organization. Staff who aren’t on the team know exactly where to send questions and that they don’t need to improvise.

Core roles on a crisis team

Every organization’s team looks slightly different, but these roles appear in almost every effective one. In a small business one person often holds two of them.

Role	Owns	Typical person
Team leader	Final decisions, priorities, escalation to the board or owners	CEO, owner or a senior executive with authority to commit resources
Communications lead	All external and internal messaging, media contact, consistency across channels	Head of communications or marketing, or an outside adviser
Legal counsel	Legal exposure, regulatory obligations, review of statements	General counsel or outside counsel
Operations lead	Establishing facts and fixing the underlying problem	Head of the affected function: operations, IT, product, facilities
People lead	Employee safety, staff communication, HR matters	HR lead or office manager
Coordinator	Meeting schedule, decision log, contact lists, action tracking	An organized person with time to give, often an executive assistant or project manager

The coordinator is the role most teams forget and most regret forgetting. Someone has to keep the log of what was decided, when and by whom, chase actions and make sure the next meeting happens. It is not a junior task.

The spokesperson is a separate decision

The person who speaks publicly is often the team leader, but it doesn’t have to be. Choose based on the issue, credibility and ability to stay calm on camera. Our guide on how to choose a spokesperson covers the trade-offs, and media training is worth doing before you ever need it.

The extended team: who you call in

Beyond the core, a crisis team pulls in specialists depending on the situation. List them in advance with contact details, so nobody is searching for a phone number at midnight.

• IT and security, for outages, hacked accounts and data incidents.
• Customer service, who will take the first wave of calls and messages and need a script.
• Finance, for refunds, insurance claims and anything affecting investors or lenders.
• Your insurer, especially a cyber or liability insurer that may have notification requirements and approved vendors.
• Outside specialists, such as forensic investigators, a crisis communications adviser or a reputation firm.
• Site managers, franchisees or regional leads if the issue is local to one location.
• HR and employment counsel, when the issue involves a staff member and may need an internal workplace investigation.

Keep the core small. A team of five who can decide in ten minutes beats a team of fifteen who need an hour to agree on a sentence. Extended members join the meetings where they are needed and leave when they’re not.

Decision rights: who can approve what

The most useful single page a crisis team can have is a short list of decisions and who can make them. For example:

• Publishing a pre-approved holding statement: the communications lead, without waiting.
• Any new public statement: the communications lead drafts, legal reviews where there is exposure, the team leader approves.
• Pausing a product, service or location: the team leader, on the operations lead’s advice.
• Talking to regulators or law enforcement: legal counsel, or someone counsel designates.
• Offering refunds or compensation beyond normal policy: the team leader with finance.

Write down a deputy for every approver. The approver will be on a plane, asleep or unreachable at the worst moment.

How the team is activated

Most issues never need the full team. Agree thresholds that move an issue from normal handling to activation. Common triggers include any risk to people’s health or safety, a media inquiry about something negative, involvement of police or a regulator, a data or security incident, a post or review spreading well beyond your usual audience, or anything involving a senior leader’s conduct.

1. Anyone can raise the alarm. Staff should know exactly who to tell, by phone and message, including out of hours.
2. The team leader or a deputy decides whether to activate. When in doubt, activate. Standing a team down is cheap; activating late is not.
3. The coordinator calls the first meeting within an agreed time, usually within the hour for serious issues, by phone or video if people are spread out.
4. The first meeting sets three things: what we know, what we don’t know yet, and what happens in the next few hours, including whether a holding statement goes out now. Our guide to writing a holding statement covers the wording.

How the team runs in the first 48 hours

A crisis team needs a rhythm. Without one, meetings drift into all-day calls where nobody has time to act.

• Short, scheduled meetings. For example, every two to four hours on day one, then twice a day. Each meeting starts with new facts, then open decisions, then assigned actions with owners and deadlines.
• Actions between meetings. People leave the call to do the work. The coordinator tracks progress.
• One channel for the team. A dedicated group chat or call bridge, separate from normal company channels, so updates don’t get lost. Assume anything written could become public, and ask counsel how to handle sensitive discussions.
• Shifts for long incidents. If the issue runs past a day, name deputies to take over overnight. Exhausted people make poor decisions.
• A clear stand-down. The team leader formally closes the activation, and the team moves to monitoring and follow-up.

A crisis team for a small business

If you have ten staff, you don’t need six people and a war room. You need the same functions covered by two or three people, plus outside help you can call.

• The owner leads and usually speaks.
• A manager handles operations, staff and customer communication.
• Whoever runs your social accounts and reviews monitors and posts approved wording only.
• Outside counsel and your insurer are on the contact list with a note of when to call them.

The principles don’t change: one decision-maker, one voice, a written log and backups for everyone. The small business reputation page covers the everyday side of this.

A worked example

This is an illustrative scenario, not a real client. A software company with about eighty staff has a crisis team on paper: the COO leads, the head of marketing handles communications, outside counsel is on call, the VP of engineering owns operations and the HR director covers people. An executive assistant is the coordinator.

On a Saturday, customers report that their accounts show other users’ data. The on-call engineer takes the service offline and calls the VP of engineering, who calls the COO. The COO activates the team within thirty minutes. The first call confirms what is known (a deployment on Friday caused a display error), what isn’t known (whether any data was downloaded) and the immediate actions. The communications lead posts a short, pre-approved holding statement on the status page. Counsel is brought in to assess whether notification obligations apply.

The team meets every three hours through the weekend, with the head of marketing’s deputy taking the overnight shift. By Monday the fix is live, a fuller statement is published and customers get a direct email. The after-action review finds one gap: support staff learned about the incident from customers. The plan now includes a message to all customer-facing staff in the first hour.

Common mistakes

• Too many people. Every extra person slows decisions. Keep extended members out until needed.
• No backups. A team of named individuals with no deputies fails the first time someone is on vacation.
• Legal brought in last. Asking counsel to approve a finished statement in five minutes produces either delay or risk.
• Nobody fixing the problem. Communication can’t carry a crisis if the underlying issue isn’t being solved.
• Never rehearsing. A tabletop exercise once or twice a year exposes missing logins, unclear authority and out-of-date contacts before they matter.
• No after-action review. Every activation should end with a short review of what worked and what to change.

When outside help makes sense

Many organizations run their crisis team entirely in-house. Outside support is worth considering if nobody on the team has handled a public crisis before, if the issue is attracting national media, or if it is already shaping your search results and reviews. Our guide on choosing a crisis PR firm covers what to look for, and our crisis management service can sit alongside your team on the online side: monitoring, statements, review responses and search results.

Frequently asked questions

Who should lead a crisis team?

Someone with the authority to make decisions and commit resources without waiting for permission, usually the CEO, owner or a senior executive. The leader doesn’t have to be the public spokesperson, and should have a named deputy who can step in.

How big should a crisis team be?

Small. A core of four to six people is typical for a mid-size organization, and two or three for a small business. Specialists join for specific issues rather than sitting on every call.

Is a crisis team the same as an incident response team?

Not quite. An incident response team, often in IT or security, focuses on technical containment and recovery. A crisis team makes the organization-wide decisions, including communication, legal and people issues. In a cyber incident the two work together, with the technical lead sitting on the crisis team.

How often should a crisis team train?

At least once a year, and ideally twice, with a tabletop exercise based on a realistic scenario. Update contact lists and roles whenever someone joins, leaves or changes jobs.