Framework library · Operations and resilience
Crisis management framework
A crisis threatens people, customers, finances or reputation faster than normal management can respond. The framework divides the work into stages from preparation to learning, so that most of the decisions (who leads, who speaks, what triggers escalation) are made in calm conditions rather than in the first hour.
Use it when
- An event could harm customers, staff or the public within hours, such as a network outage that stops emergency calls, a data breach or a fire at a site.
- You have continuity plans for systems but no agreed way to lead, decide and speak when several things fail at once.
- A recent incident was handled late or inconsistently, and you want to know which stage failed.
- A regulator, a licence condition or a major customer requires a tested crisis capability.
Avoid it when
- The disruption is routine and covered by operating procedures. Treat it as an incident. Calling everything a crisis wears out the response.
- You need recovery times for each activity. That is business continuity planning; the crisis plan decides when to invoke it.
- You want to reduce the chance of the crisis happening. Work on causes and controls with a risk register or a bow tie analysis.
How to run it
Prepare before anything happens
Name the crisis team and deputies, where and how it meets, its decision rights and its first statements. Then exercise them.
Agree what triggers escalation
Write thresholds anyone on shift can apply: customers affected, emergency calls failing, data exposed, media enquiries. Make it safe to escalate early.
Stabilise in the first hours
Protect people first, then contain the damage. The leader sets priorities and a rhythm of updates; the specialists fix the fault.
Communicate early, often and in order
Staff, emergency services, regulators, customers and the public, with facts as they are known and the time of the next update. Coombs's research suggests the response should match how much responsibility the public will attribute to you.
Recover and stand down deliberately
Hand the remaining work back to normal management under the continuity plans, and say publicly when service is restored.
Learn and change something
Hold a review within weeks, without blame, that produces dated actions with owners, and check they were done.
Work through it
Answer the questions below, or load the worked example to see a finished one. The drawing updates as you type. Export the result as a PowerPoint deck, a Word document, an Excel workbook, a PDF or plain text.
What you type stays in this browser, so you can close the page and come back to it. It is not sent to Blue Prysm or anyone else, and the exports are made here, on your device. Privacy policy.
Mistakes to avoid
- Waiting for certainty before escalating. The cost of a false alarm is small next to an hour lost at the start.
- Letting the engineers who are fixing the fault also run the crisis. Separate leading and communicating from repairing.
- Saying nothing until the cause is known. Silence is filled by others. Say what you know and when you will say more.
- Writing a lessons report that changes nothing. Track every action to closure.
Where it comes from
No single originator. The staged approach follows Christine M. Pearson and Ian I. Mitroff, "From crisis prone to crisis prepared: a framework for crisis management", Academy of Management Executive 7(1), 1993. The communication stage draws on W. Timothy Coombs's situational crisis communication theory, set out in Corporate Reputation Review 10(3), 2007. ISO 22361:2022, Security and resilience: Crisis management: Guidelines, is the current international guidance. Source.
Use it with
Further reading
Work through it with us
The frameworks here are free to use as they stand. If you would rather work through the question behind this one with us, these are the ways an engagement starts.