A crisis communications policy is the short, binding document that tells your people who speaks for the organization, who approves what, and how fast, when something goes wrong. It is not the full plan. The plan holds contacts, templates and checklists. The policy holds the rules that make the plan usable at 2 a.m., when nobody has time to debate authority.
If you lead an organization and you do not have one, this article walks through what belongs in it, how to test it, and where most policies quietly fail.
TL;DR
- A policy sets decision rights: one spokesperson, one approval path, and a named backup for each.
- Tell employees before the public hears it elsewhere. Internal communication comes first.
- Pre-write modular holding statements, not a full script. Facts get filled in only after they are verified.
- Test the policy at least once a year with a tabletop exercise, and revise it afterward.
- Be honest about what you do not yet know. It protects credibility better than false certainty.
Table of Contents
- Policy, plan and playbook: knowing the difference
- Why the policy matters more than the message
- What belongs in the policy
- Honesty about uncertainty
- The first hour
- A quick illustration
- Testing the policy
- Mistakes we see most often
- Our perspective
- Getting help with your policy
- A short checklist to start this week
- FAQ
- Sources
Policy, plan and playbook: knowing the difference
These words get used interchangeably, and that confusion causes real problems. When a board asks for a "crisis policy" and a communications manager delivers a 60-page binder, nobody is satisfied.
Think of it the way a coach thinks about a team. The policy is the rulebook: who is allowed to carry the ball. The plan is the set of plays. The playbook, if you keep one, is the detailed notes on each opponent. You need all three eventually, but the rulebook comes first, because without it the plays collapse into argument.
There is a second distinction worth making. Government guidance, including a CISA handbook for the dams sector, treats crisis communication as an operational management tool used during the active phase of an incident, separate from risk communication, which raises awareness of hazards beforehand. Your policy governs the first. It should say plainly that when a defined trigger is met, communication stops being a marketing function and becomes part of incident command.
Why the policy matters more than the message
Leaders often assume the content of the message determines how the public reacts. In our experience, and in the guidance public agencies publish, the bigger driver is whether the message is consistent. The New Jersey Department of Health's risk communication toolkit for local health agencies frames the goal as a singular, consistent narrative, because confusion among authorities does more damage than hard news does.
A policy is what produces consistency. It does not make you eloquent. It makes sure three executives do not give three different answers to the same reporter.
The same toolkit boils its guidance down to a handful of qualities: be simple, timely, accurate, repeated, credible and consistent. Notice that only one of those is about wording. The rest are about process, and process is exactly what a policy governs.
What belongs in the policy
Here is how we suggest organizing it. Keep each section to a page or less. If a section runs longer, the detail probably belongs in the plan.
Purpose, scope and triggers
Start by defining what counts as a crisis for your organization. A vague definition leads to two failures: leaders who wait too long to activate, and teams that activate for every bad review.
A workable definition names the categories (safety incident, data breach, legal action, executive misconduct, regulatory inquiry, major service failure, public controversy) and a threshold: media inquiry, regulator contact, threat to people, or material effect on operations. Then say who has the authority to declare a crisis. One person, plus a named alternate, is enough.
The spokesperson rule
This is the heart of the document. Federal and municipal guidance alike point to the same practice: designate one primary spokesperson or point of contact, and route all media requests through that role. A CISA post-incident best practices guide describes coordinating public statements with executive leadership, legal counsel and, where relevant, emergency incident commanders.
Your policy should answer four questions in plain language:
- Who is the primary spokesperson, and who is the backup?
- Who else is permitted to speak publicly? (Usually the answer is no one, except by delegation.)
- What should an employee do when a reporter calls? (Take a name and number, say someone will respond, and pass it on.)
- What happens when the right spokesperson is not the CEO? Sometimes a subject expert, a medical director or a safety officer is more credible than the chief executive, and the policy should allow for it.
I would add one more thought. Executives often resist this rule because they believe they are the best voice. Sometimes they are. But a policy is for the day you are not available, or not the right person, and it works only if it applies to everyone.
The approval chain
Every statement needs a path from draft to release. Name the roles, not just the people, since people change jobs. A common structure runs from the communications lead to legal counsel, then to the senior executive, then out. The point is not bureaucracy. It is speed with a safety net.
Set a time standard. If legal review of a holding statement takes a day, you have already lost the first news cycle. Many organizations agree in advance that legal reviews pre-approved holding statements in a short window and that, in genuine emergencies, a defined two-person sign-off is enough.
Internal communication first
This is the clause most often missing. Organizations pour energy into media relations and forget their own employees, who then learn about the event from the news or social media. The CISA guide cited above flags this as a common failure, with real costs to trust and morale at an already volatile moment.
Write it into the policy: employees are informed before, or at least at the same moment as, the public, whenever safety and legal limits allow. Add instructions for what employees should and should not post, and where they can send questions.
Holding statements and templates
You cannot script a crisis you have not seen. What you can do is build modular holding statements: a structure with blanks for who, what, when and where, to be filled only once facts are verified. The CISA dams handbook describes this approach, noting that the early phase of a crisis is marked by confusion, incomplete information and intense media interest.
A good holding statement does three things. It states what is known. It states what is not yet known. And it says when the next update will come. Then it keeps that promise.
Channels and monitoring
List the channels you will use for each audience: email and text for employees, your website and social accounts for the public, direct calls for customers, partners and regulators. State who owns each channel and who can post to it. Include one line on monitoring: who watches news and social media, and how often during an active event.
Documentation and review
Require a log of decisions, statements and times. It protects you legally and teaches you afterward. Then require a post-crisis review within a set number of days.
Honesty about uncertainty
One instruction deserves its own place in your policy, because instinct fights it. When facts are incomplete, say so.
The New Jersey toolkit advises acknowledging uncertainty, avoiding speculation and promising to share more as it becomes available. It also cautions against over-reassuring. Its guidance is that a high initial estimate of harm that is later revised down earns more credibility than a low estimate that has to be raised. In plain terms: if you are tempted to say "there is no risk," you had better be sure.
We see this in practice with leaders who are kind and well-meaning. They want to calm people, so they reassure early. Then the facts change, and the reassurance becomes the story. A policy line such as "We do not state that a situation is resolved or safe until the responsible lead has confirmed it in writing" saves a great deal of pain.
The PRSA also stresses authenticity. Its piece on trust and transparency in times of crisis argues that forthright messages about risks, and about what the organization is doing to reduce them, have lasting positive effects, including when plans are not yet final.
The first hour
A policy should make the first hour boring. That is the highest compliment you can pay it.
The PRSA's guide to navigating the first hour of a crisis begins where we would: ensure safety, and if people are at risk, contact emergency services and the authorities immediately. Communication comes second to protecting people. Your policy should say so in its first paragraph, because it tells everyone, including the lawyers and the marketers, what the organization values when values are tested.
After safety, a sensible sequence looks like this: activate the crisis team, confirm the facts you have, notify employees, release a holding statement if inquiries are coming, and set the time of the next update. None of that requires brilliance. It requires that people already know their role.
A quick illustration
Consider a hypothetical mid-sized healthcare group in Las Vegas. A data-handling error exposes patient information, and a local reporter calls the front desk before leadership even knows the full scope.
Without a policy, the receptionist improvises, a regional manager gives a comment, and the CEO posts something reassuring that evening. By morning, three versions of events exist.
With a policy, the receptionist takes the reporter's details and passes them to the communications lead. The crisis team convenes within the window the policy sets. Employees receive a short note explaining what is known and where to send questions. A holding statement goes out, reviewed by legal under the pre-agreed timeline, naming the next update time. The facts are the same, and the story is entirely different. That illustration is invented to show the mechanism. It is not a client case.
Testing the policy
A policy that has never been tested is a hope. Planning frameworks commonly sort exercises into three kinds: tabletop exercises, which are discussion-based scenarios; functional exercises, which simulate specific response functions; and full-scale exercises, which are comprehensive and can take months to plan. California State University, Fullerton's emergency management program is one public example of an institution that documents a crisis communication plan and a structured exercise program.
For most businesses and nonprofits, a yearly tabletop is the right start. Gather the crisis team for two hours, hand them a realistic scenario, and add complications as you go: a reporter calls, a social post goes viral, the spokesperson is traveling. Then ask where the policy was silent, and fix it.
Two practical tips. Include a person who was not involved in writing the policy, since they will find the gaps you cannot see. And rotate the scenario each year so the team does not rehearse only the crisis they already fear.
Mistakes we see most often
The first is writing for the file rather than for the moment. A 40-page document no one has read will not guide anyone at midnight. Keep the policy short and the plan separate.
The second is naming people instead of roles. Contact details live in an appendix that is checked quarterly. The policy names roles.
The third is forgetting the unglamorous audiences: employees, regulators, customers, board members, insurers, and in some sectors, licensing bodies. A crisis is rarely only a media event.
The fourth is treating the apology as a legal risk only. Counsel matters, and your policy should give legal counsel a firm seat. But PRSA commentary on rebuilding after a crisis stresses humility and the willingness to discuss lessons learned. Leaders who bury the incident tend to rebuild trust more slowly than those who reflect openly.
Our perspective
We have spent more than 30 years helping organizations prepare for and respond to crises, and the pattern is steady. The organizations that come through best did not have the cleverest statements. They had decided, ahead of time, who was in charge of what.
We think of a crisis communications policy as a relay race. Everyone knows a baton exists, but the race is won or lost in the handoffs: from the person who first learns of the problem to the crisis lead, from the lead to counsel, from counsel to the spokesperson. A fast runner who drops the baton loses. A policy is how you practice the handoff when nothing is at stake.
We also believe a policy should lead to action, not only words. Rebuilding trust happens through credible actions that follow the statement: the fix, the changed process, the follow-up. Messaging that outruns what the organization is actually doing will not hold. That is why we pair preparation with real-time response, so that what you say before, during and after a crisis is consistent with what you do.
If you are a leader reading this and thinking your own policy is thin or nonexistent, take heart. You do not need to write the perfect document. You need to write the first honest page, test it, and improve it.
— Mark
Getting help with your policy
If you want an outside view, Mark Brown Strategies works with executives, boards and nonprofits on crisis management and communications, crisis readiness assessments, reputation management and recovery, and litigation support. We serve organizations across California, Nevada, Arizona and Utah, including law firms, casinos, healthcare, technology, education, financial services and real estate. A readiness assessment is a practical place to begin: it shows where your current rules would hold and where they would not.
A short checklist to start this week
You do not need a consultant to begin. In one sitting, you can name your crisis lead and a backup, name your spokesperson and a backup, write down your definition of a crisis, and agree who can approve a statement. Then draft a one-page holding statement template with blanks for who, what, when and where. Put a tabletop exercise on the calendar within the next quarter. Those few steps put you ahead of many organizations.
FAQ
What is the difference between a crisis communications policy and a crisis communications plan?
The policy sets the rules: who declares a crisis, who speaks, who approves, and what principles guide messages. The plan carries the operational detail, such as contact lists, templates, channel instructions and checklists. Keep the policy short enough that people actually remember it.
Who should be the spokesperson?
Name one primary spokesperson and one backup, and route all media requests through them. That is often the CEO or a senior communications leader, but the policy can allow a subject expert when credibility on the topic matters more than rank. Train whoever you choose before you need them.
How often should we review and test the policy?
Test it at least once a year, and review it after any real incident and whenever leadership or structure changes. A tabletop exercise is the simplest format. Update names, roles and contact details more often, ideally quarterly.
What should a holding statement say?
It should say what happened as far as it is verified, what you are doing about it, what you do not yet know, and when you will provide the next update. Do not speculate or declare the situation resolved before it is. Build it as a template with blanks so it can be released quickly once facts are confirmed.
Sources
- Risk Communication Toolkit for Local Health Agencies (New Jersey Department of Health)
- Dams Sector Crisis Management Handbook (CISA)
- Critical Manufacturing Sector Active Assailant Post-Incident Best Practices Guide (CISA)
- Trust and Transparency in Times of Crisis (PRSA)
- 5 Steps for Navigating the First Hour of a Crisis (PRSA)
- CSUF Emergency Management Program