.png)
Crisis Management and Response: From Preparedness to Organisational Resilience
Updated: Oct 28
A crisis can expose weaknesses that remain largely invisible during normal operations. Established governance arrangements, experienced leadership teams and well-rehearsed procedures may all appear effective until an unexpected disruption challenges the assumptions on which they depend.
The difficulty is that organisations rarely have the luxury of understanding a crisis fully before responding. Early decisions can shape the options available later, while seemingly reasonable actions may introduce consequences that only become apparent as the situation develops.
This raises an important question for Boards and executive leaders: how confident can an organisation be in its crisis management capabilities before those capabilities are tested by a real event?
This article examines crisis management and response through the lens of organisational effectiveness, drawing on practical examples and governance considerations to explore what distinguishes documented preparedness from genuine crisis readiness.
Executive Takeaways
For senior executives and Board directors, five insights capture the practical implications of effective crisis management and response for organisational resilience.
An operational incident becomes a crisis when its consequences exceed existing response capabilities.
Crisis escalation should consider cascading impacts, critical dependencies, competing priorities and wider organisational consequences. Incident severity alone may not adequately reflect the need for executive intervention.
Effective crisis governance depends on clear decision authority and coordinated leadership.
Operational teams need sufficient authority to act promptly, while executive crisis management must resolve competing priorities and maintain enterprise-wide coordination. Board oversight should focus on material strategic consequences and management's ability to sustain an effective response.
Stakeholder confidence depends on how organisations communicate and manage uncertainty.
Timely communication is essential, but credibility also requires accurate information, consistent messaging and transparency about what remains unknown. Communication arrangements must evolve alongside the operational response and reflect the needs of affected stakeholders.
Crisis management, business continuity and recovery must operate as connected capabilities.
Functional response arrangements may be individually effective yet fail to address shared dependencies or conflicting recovery priorities. Integrated coordination enables organisations to protect essential services, manage the wider consequences of disruption and restore sustainable operations.
Crisis readiness must be demonstrated through decision-making effectiveness, not documented preparedness alone.
Plans and procedures establish important foundations, but realistic exercises provide stronger evidence of organisational capability. Boards should expect testing that challenges leadership behaviour, escalation speed, incomplete information and cross-functional coordination, with findings translated into measurable improvements.
Why Crisis Management Remains a Leadership Challenge
The COVID-19 pandemic exposed a fundamental weakness in organisational crisis preparedness. Many organisations had business continuity plans, established governance structures and documented emergency procedures. Yet the scale, duration and interconnected nature of the disruption challenged assumptions about how those arrangements would operate in practice.
Traditional continuity planning often considered disruption to specific locations, systems, suppliers or business activities. The pandemic created a different challenge. Organisations faced simultaneous pressures on workforce availability, supply chains, customer services and operational capacity, while navigating changing government restrictions and significant uncertainty about the duration of the crisis.
The challenge extended beyond maintaining essential operations. Leadership teams had to make decisions about employee safety, service prioritisation, financial sustainability and stakeholder expectations, often with incomplete information and limited visibility over how conditions would evolve.
This exposed an important distinction between having crisis management arrangements and possessing the organisational capability to execute them effectively.
Crisis management depends on the ability to establish priorities, coordinate decisions across functions, delegate authority and adapt as circumstances change. A documented plan provides structure, but its effectiveness ultimately depends on leadership judgement, organisational behaviour and the quality of information available to decision-makers. In complex crisis situations, established governance arrangements may come under pressure as leaders confront incomplete information, competing priorities and rapidly changing operational conditions.
The UK COVID-19 Inquiry's July 2024 report identified inadequate leadership, coordination and oversight, insufficient learning from previous exercises, and planning arrangements that lacked the flexibility required for a different type of pandemic. Its findings illustrate how extensive preparation can coexist with significant weaknesses in the ability to respond to a developing crisis.
The challenge remains relevant beyond the pandemic. The Business Continuity Institute's Crisis Management Report 2024 found that only 22.4% of surveyed respondents rated their organisations' crisis management capabilities as excellent. Meanwhile, 17.3% reported more than five crisis team activations during the year. These findings suggest that crisis management is an active operational requirement, while confidence in organisational capability remains limited.
For Boards and executive teams, the implication is clear. Crisis preparedness needs to be assessed through the organisation's capacity to recognise deteriorating conditions, establish decision-making authority, coordinate its response and adjust priorities as new information becomes available.
The effectiveness of crisis management is ultimately demonstrated through the quality and execution of decisions made under pressure.
Strengthen Your Operational Resilience Capability
Explore how Aevitium's Operational Resilience Pathway™ helps organisations assess operational resilience maturity, strengthen incident management and response capabilities, and improve their ability to withstand, respond to and recover from disruption.
What Makes a Crisis Different from an Operational Incident?
An operational incident and a crisis can originate from the same event, but they place different demands on an organisation's governance, leadership and decision-making capabilities.
An operational incident typically involves a disruption, failure or unexpected event that can be assessed and managed through established procedures, functional responsibilities and escalation arrangements. These may include technology outages, cybersecurity incidents, supplier failures or interruptions to critical business processes.
A crisis emerges when the nature, scale or potential consequences of an event require a broader organisational response. The situation may exceed established response capabilities, involve competing strategic priorities or demand decisions that cannot be resolved within existing functional authority.
The distinction is not determined by the severity of the initial incident alone, but by the organisation's capacity to manage its consequences through normal governance and operational arrangements.
A technology outage, for example, may initially be addressed by an IT incident response team. However, if the disruption affects multiple critical services, creates regulatory reporting obligations, threatens customer confidence or requires decisions about which services to restore first, the organisation may need to activate its crisis management arrangements.
This transition becomes particularly important when incidents are interconnected. A third-party technology failure may affect payment processing, customer communications and regulatory obligations simultaneously. Each function may have established response procedures, yet the combined consequences require coordinated decisions about resource allocation, service prioritisation and stakeholder communication.
The organisation must assess both the immediate incident and its wider consequences, including how those consequences may evolve over time.
Recognising When Crisis Management Is Required
Effective escalation arrangements should consider several dimensions:
Operational impact: The extent to which critical services, people, infrastructure or essential business activities are affected.
Interdependencies: Whether the incident creates cascading consequences across functions, suppliers, customers or business services.
Decision-making authority: Whether the response requires decisions beyond the mandate of individual operational teams.
Strategic and stakeholder consequences: Whether the situation creates material financial, regulatory, reputational or wider organisational exposure.
Response capacity and uncertainty: Whether existing resources, procedures and information remain sufficient to manage the developing situation.
These dimensions help organisations determine when additional coordination, executive authority or formal crisis management activation becomes necessary.
Importantly, crisis management activation should not depend exclusively on confirmed losses or predefined impact thresholds. Early indicators of escalating disruption, emerging dependencies or deteriorating response capacity may justify executive involvement before the full consequences are understood.
For Boards and senior executives, the priority is to establish clear activation criteria, delegated authority and escalation arrangements that enable the organisation to respond proportionately as circumstances evolve.
An effective crisis management framework allows operational teams to manage incidents within their authority while ensuring that enterprise-level decisions are recognised, escalated and coordinated at the appropriate time.
From Operational Incident to Enterprise Crisis: Understanding Cascading Consequences
A crisis rarely develops in isolation. An initial operational incident can create interconnected consequences across business services, third parties, regulatory obligations and stakeholder relationships. As these impacts accumulate, existing response arrangements may become insufficient, requiring broader coordination and executive decision-making.
The following illustration shows how different crisis triggers can generate cascading consequences, and where the transition from operational incident response to enterprise-level crisis management becomes necessary.
Crisis Management Governance and Decision Authority
Effective crisis management depends on clearly established governance arrangements that enable timely, coordinated and accountable decision-making. During a crisis, the organisation must respond to rapidly changing circumstances, often with incomplete information, competing priorities and significant consequences for customers, employees and other stakeholders.
Clearly defined roles and responsibilities are also essential to effective crisis governance, particularly when operational teams, executive leadership and the Board must coordinate decisions across different levels of authority.
These conditions place considerable demands on existing governance structures. Decisions that would ordinarily follow established approval processes may need to be taken within minutes or hours. Multiple functions may require the same resources, while actions taken to protect one business service can create additional pressures elsewhere.
The effectiveness of crisis governance depends on the organisation's ability to establish who has authority, how decisions are coordinated and when matters require escalation.
Establishing Clear Decision-Making Authority
A well-designed crisis management framework should distinguish between operational responsibilities, executive crisis leadership and Board oversight.
Operational response teams retain responsibility for managing incidents within their areas of expertise. They assess the situation, implement containment measures and coordinate technical or functional recovery activities.
The executive crisis management team provides enterprise-wide coordination when the consequences extend beyond individual functions. Its responsibilities typically include establishing organisational priorities, resolving competing demands, allocating critical resources and overseeing stakeholder communication.
The Board retains its governance and oversight responsibilities, particularly where the crisis creates material implications for organisational strategy, financial sustainability, regulatory obligations or stakeholder confidence.
The objective is to ensure that decisions are made at the appropriate level of authority, with sufficient information and accountability, while maintaining the speed required by the circumstances.
Balancing Centralised Oversight and Local Decision-Making
One of the most challenging aspects of crisis governance is determining which decisions should remain within local management authority and which require central coordination.
An excessively centralised response can create bottlenecks, particularly when operational teams need to act quickly to contain disruption. Conversely, fragmented decision-making can result in inconsistent priorities, competing actions and limited visibility of the organisation's overall exposure.
This challenge becomes more pronounced in organisations operating across multiple jurisdictions, business units or regulated entities.
For example, a multinational organisation experiencing a significant technology disruption may require local management teams to address immediate customer and regulatory obligations while the group crisis management team coordinates recovery priorities and shared technology resources.
Effective arrangements should establish clear decision rights, delegated authorities and escalation expectations before a crisis occurs. They should also provide sufficient flexibility to adapt those arrangements as the situation develops.
Maintaining Decision Quality Under Pressure
Decision-making during a crisis requires organisations to balance speed, uncertainty and the potential consequences of different courses of action.
Leadership teams may face incomplete or conflicting information, evolving assessments of impact and significant pressure to demonstrate that the situation is under control. These conditions can encourage premature conclusions, excessive escalation or delays while additional certainty is sought.
A structured decision-making process helps maintain discipline without introducing unnecessary bureaucracy. This includes establishing a common understanding of the situation, identifying the decisions required, evaluating material consequences and recording the rationale for significant actions.
Particular attention should be given to the assumptions supporting decisions. As circumstances change, those assumptions may become less reliable, requiring leaders to reassess priorities and adapt their response.
Crisis governance should also provide opportunities for constructive challenge. Operational specialists, risk professionals and other relevant stakeholders must be able to communicate emerging concerns, challenge assumptions and escalate deteriorating conditions without unnecessary barriers.
Ensuring Accountability and Continuity of Leadership
Crises can extend over several days, weeks or longer, creating additional challenges for leadership continuity and organisational coordination.
Effective governance arrangements should establish clear ownership of decisions, appropriate delegation and reliable handover processes. They should also ensure that the crisis management team maintains an accurate record of significant decisions, outstanding actions, emerging risks and changes in the organisation's circumstances.
These arrangements support accountability during the response and provide an evidence base for subsequent reviews, regulatory engagement and organisational learning.
Ultimately, crisis management governance should enable the organisation to act decisively while maintaining control over the wider consequences of its decisions.
The strength of crisis leadership lies in the ability to combine delegated authority, enterprise-wide coordination and informed judgement as circumstances evolve.
Crisis Communication and Stakeholder Confidence
Communication plays a central role in crisis management, influencing how employees, customers, regulators and other stakeholders understand the situation and respond to the organisation's actions.
During a crisis, information is often incomplete, circumstances change rapidly and different stakeholders require different levels of detail. The organisation must balance the need to communicate promptly with the responsibility to provide accurate, consistent and meaningful information.
Delays can create uncertainty and undermine confidence, while premature or inconsistent statements may introduce additional reputational, operational and regulatory consequences.
Effective crisis communication depends on clear accountability, reliable information flows and close coordination between operational response teams, executive leadership and those responsible for stakeholder engagement. At a time of crisis, stakeholder confidence depends not only on the speed of communication but also on the organisation's ability to distinguish confirmed information from emerging assessments and uncertainty.
Learning from the TSB Banking Disruption
The 2018 TSB banking disruption illustrates how operational failures and crisis communication can become closely interconnected.
Following a major IT migration, customers experienced significant difficulties accessing accounts and banking services. The disruption extended over several weeks, generating substantial customer dissatisfaction, regulatory scrutiny and reputational consequences.
The subsequent regulatory investigation identified serious weaknesses in the planning, management and oversight of the migration, including the management of operational risks and third-party arrangements.
The case illustrates the importance of ensuring that communications remain aligned with the actual operational position. During prolonged disruption, customer confidence depends on the organisation's ability to explain what is happening, acknowledge uncertainty, provide practical guidance and maintain reliable updates as recovery progresses.
The broader lesson extends beyond technology failures. Communication becomes part of the organisation's response capability, helping stakeholders understand the consequences of the disruption and the actions being taken to manage them.
Balancing Speed, Accuracy and Uncertainty
One of the most difficult communication decisions during a crisis concerns the timing of the first statement.
Waiting for complete information may delay important guidance to customers, employees or other affected parties. However, communicating before the organisation has established a sufficiently reliable understanding of the situation can create confusion and undermine subsequent updates.
A disciplined approach distinguishes between confirmed facts, emerging assessments and information that remains uncertain.
Initial communications should explain what is known, acknowledge material uncertainties, identify immediate actions where appropriate and establish when further information can be expected.
As the crisis develops, communication must evolve alongside the operational response. Updates should reflect changes in impact, recovery expectations and the decisions taken to protect affected stakeholders.
Credibility is strengthened when organisations communicate consistently, acknowledge uncertainty and demonstrate that their actions remain aligned with the information they provide.
Coordinating Internal and External Communication
Crisis communication also requires coordination across functions and jurisdictions.
Operational teams may hold the most accurate information about technical failures and recovery progress. Customer-facing teams understand the immediate consequences for affected users. Legal, compliance and regulatory affairs functions assess disclosure obligations, while executive leadership determines the organisation's overall communication priorities.
Without effective coordination, these different perspectives can produce conflicting messages or delays in communicating material developments.
The crisis management framework should establish clear ownership of communications, defined approval authorities and reliable mechanisms for sharing information between response teams.
Particular attention is required where the organisation depends on third-party providers. Information may need to be obtained from suppliers before the organisation can explain the cause, impact or expected duration of a disruption.
Communication arrangements should also anticipate the possibility that normal channels become unavailable during the crisis itself.
Ultimately, effective crisis communication is a leadership responsibility. It supports informed stakeholder decisions, reinforces accountability and helps maintain confidence while the organisation works to restore stability.
Coordinating Crisis Response, Business Continuity and Recovery
An effective crisis response requires several organisational capabilities to operate together. Incident management, business continuity, crisis management and disaster recovery each serve distinct purposes, but their effectiveness depends on how well they are coordinated.
Incident management focuses on identifying, assessing, containing and resolving disruptive events. Business continuity arrangements support the delivery of essential activities when normal operating conditions are disrupted. Disaster recovery provides the technical and operational capabilities required to restore affected infrastructure, systems and supporting resources.
Crisis management provides the leadership and coordination necessary when the consequences of disruption require enterprise-wide decisions, competing priorities must be resolved or the organisation faces material strategic and stakeholder implications.
These capabilities should operate as an integrated response, with clear responsibilities, information flows and decision-making authority.
Connecting Response Capabilities Across the Organisation
During a significant disruption, different teams may be working towards related but potentially competing objectives.
Technology teams may prioritise restoring infrastructure, business continuity teams may activate alternative operating arrangements, and customer-facing functions may focus on maintaining essential services. Meanwhile, legal, compliance and communications teams assess reporting obligations and stakeholder expectations.
Each activity contributes to the response, but decisions made within one function can affect the options available to others.
For example, restoring a technology platform may require a temporary suspension of certain services, while activating alternative processes could introduce additional operational capacity constraints or control vulnerabilities.
The crisis management team must maintain visibility of these interdependencies, establish common priorities and ensure that decisions reflect the organisation's overall objectives.
This requires a shared understanding of the disruption, including affected services, available resources, recovery dependencies and the consequences of different response options.
Managing the Transition from Response to Recovery
Recovery is rarely a single event. Organisations may restore critical services progressively, operate temporary arrangements for extended periods or encounter additional disruption as systems and processes return to normal.
The transition from immediate crisis response to recovery requires careful coordination.
Leadership teams should establish the conditions under which services can be restored, temporary controls can be withdrawn and responsibility can return to normal operational governance.
These decisions should consider service stability, residual vulnerabilities, outstanding customer impacts and the organisation's capacity to sustain normal operations.
A service may be technically restored while customer backlogs, reconciliation activities, regulatory obligations or supplier dependencies remain unresolved.
Recovery should be assessed through the restoration of sustainable operational capability, rather than the technical resolution of the initial incident alone.
Strengthening Organisational Resilience Through Learning
The conclusion of a crisis provides an opportunity to evaluate the effectiveness of the organisation's response arrangements.
Post-crisis reviews should examine how the situation was identified and escalated, whether decision-making authority was sufficiently clear, how effectively teams coordinated their activities and whether recovery priorities reflected the organisation's strategic and operational objectives.
Particular attention should be given to dependencies, assumptions and vulnerabilities that became apparent during the disruption.
The findings should inform improvements to crisis management arrangements, business continuity plans, recovery capabilities and the wider operational resilience framework.
For Boards and executive teams, the objective is to establish whether the organisation can continue delivering its most important services through disruption, coordinate its response effectively and restore sustainable operations within acceptable parameters.
Organisational resilience is strengthened when crisis management, business continuity and recovery operate as connected capabilities, supported by clear leadership, shared priorities and continuous learning.
Testing Crisis Management Under Realistic Conditions
Crisis management plans provide an essential foundation for organisational preparedness, but their effectiveness can only be established through realistic testing.
Many organisations conduct crisis exercises to validate procedures, confirm responsibilities and assess whether response teams understand their obligations. While these activities provide value, they may offer limited insight into how the organisation will perform when information is incomplete, decisions are contested and multiple business priorities compete for attention.
A successful exercise should assess more than whether participants followed the prescribed process. It should examine the quality of leadership, the effectiveness of coordination and the organisation's ability to adapt as circumstances evolve.
Testing Decision-Making Under Pressure
Real crises rarely unfold according to a predetermined sequence. Early information may be contradictory, the full extent of the disruption may remain unclear and decisions may need to be taken before their consequences can be reliably assessed.
Scenario-based exercises should reproduce these conditions by introducing uncertainty, changing circumstances and time-sensitive decisions.
For example, a simulated technology disruption could initially appear to affect a single business service before revealing dependencies involving external providers, customer communications and regulatory obligations.
Participants should be required to determine when the incident warrants escalation, which services take priority and what actions are justified given the information available.
The exercise should assess whether decisions are made at the appropriate level, whether material assumptions are challenged and whether emerging information leads to timely reassessment.
The objective is to understand how effectively the organisation makes and adapts decisions when certainty is unavailable.
Exposing Cross-Functional Dependencies and Competing Priorities
Crisis exercises are particularly valuable when they expose the consequences of decisions made across organisational boundaries.
A technology team may recommend suspending a system to prevent further damage, while business leadership seeks to maintain customer services. Compliance teams may require additional information to assess regulatory reporting obligations, while communications teams face pressure to provide immediate reassurance.
Each perspective may be reasonable within its own functional context. The challenge is determining how these competing considerations should be reconciled in the interests of the organisation as a whole.
Realistic exercises should involve relevant business functions, executive decision-makers and, where appropriate, critical third-party providers.
Scenarios can introduce resource shortages, conflicting recovery priorities, supplier delays or the simultaneous disruption of multiple services.
These conditions help reveal whether existing governance arrangements support enterprise-wide coordination or whether organisational silos continue to shape the response.
Evaluating Leadership Behaviour and Organisational Learning
The behaviour of leaders during an exercise can be as important as the technical outcome.
Observers should consider how participants respond to challenge, communicate uncertainty, delegate authority and encourage the escalation of emerging concerns.
Particular attention should be given to situations where information challenges an earlier decision or where individuals hesitate to raise concerns because of hierarchy, perceived expectations or pressure to demonstrate progress.
Testing should also examine whether crisis teams maintain a shared understanding of the situation and whether leadership transitions, decision records and stakeholder communications remain effective as the exercise develops.
Post-exercise reviews should identify weaknesses in decision-making, governance and coordination, alongside procedural or technical gaps. Findings should be translated into clear improvement actions, with accountable owners and subsequent validation of their effectiveness.
For Boards and executive teams, the value of crisis testing lies in the confidence it provides about the organisation's actual response capability.
A completed exercise demonstrates that a scenario has been rehearsed. A well-designed exercise provides evidence of how the organisation is likely to behave when its assumptions, leadership and operational arrangements are challenged.
Discover how organisations can strengthen critical service delivery, manage interconnected vulnerabilities and demonstrate their ability to withstand, recover from and adapt to disruption.
What Effective Crisis Readiness Looks Like
Effective crisis readiness reflects an organisation's ability to recognise escalating disruption, mobilise appropriate leadership and coordinate a response that protects its most important services and stakeholder interests.
It requires more than maintaining current plans or conducting periodic exercises. Readiness depends on whether governance arrangements, operational capabilities and leadership behaviours can function together when normal decision-making conditions no longer apply.
Several characteristics distinguish organisations with more mature crisis management capabilities:
Clear activation and escalation arrangements: Emerging incidents are assessed against their wider consequences, with defined criteria for activating executive crisis management.
Established decision authority: Operational teams, executive leadership and the Board understand their respective responsibilities, including how authority is delegated and material decisions are escalated.
Reliable situational awareness: Leaders receive timely, relevant information that distinguishes confirmed facts from assumptions and emerging uncertainties.
Integrated response capabilities: Incident management, business continuity, crisis management and recovery activities operate with shared priorities and visibility of critical dependencies.
Coordinated stakeholder communication: Internal and external communications remain consistent with the evolving operational position, regulatory obligations and stakeholder needs.
Demonstrated effectiveness: Realistic exercises and post-incident reviews provide evidence of response capability, supported by measurable improvements.
These characteristics should be evaluated in the context of the organisation's operating model, strategic objectives, critical services and exposure to disruption.
For Boards, an important question is whether the organisation has sufficient evidence that its crisis management arrangements will remain effective when multiple assumptions fail simultaneously.
For executive leaders, the challenge is to ensure that response capabilities remain practical, adaptable and sufficiently integrated to support decisions under pressure.
For risk and resilience professionals, the priority is to move beyond assessing the existence of plans and procedures towards evaluating how effectively the organisation identifies, escalates, manages and learns from disruptive events.
From Crisis Preparedness to Organisational Resilience
Crisis management and response should ultimately be understood as an integral component of organisational resilience.
A well-prepared organisation may still experience significant disruption. Its resilience is demonstrated through the ability to recognise the implications of that disruption, make informed decisions, protect essential activities and restore sustainable operations.
This requires continued investment in leadership capability, effective governance, operational coordination and organisational learning.
The ultimate measure of crisis readiness is not whether an organisation has prepared for every possible scenario, but whether it can make sound decisions, coordinate its response and adapt effectively when circumstances depart from its expectations.
Five Questions Board Directors Should Ask
Effective Board oversight of crisis management and response requires confidence that the organisation can recognise escalating disruption, mobilise appropriate leadership and coordinate decisions under pressure. Five questions can help directors assess whether crisis readiness extends beyond documented plans to demonstrated organisational capability.
1. Do we know when an operational incident should escalate into an enterprise crisis?
Tests whether crisis activation criteria consider cascading consequences, cross-functional dependencies, stakeholder impacts and strategic implications, rather than relying solely on predefined incident severity classifications.
2. Are decision-making responsibilities clear when multiple functions face competing priorities?
Examines whether operational teams, executive crisis leadership and the Board understand their respective authorities, and whether governance arrangements enable timely decisions without creating unnecessary bottlenecks.
3. Can we maintain reliable situational awareness and stakeholder confidence when information is incomplete?
Assesses whether leadership receives timely, accurate and appropriately challenged information, and whether internal and external communications remain coordinated as circumstances and recovery expectations evolve.
4. Can our crisis management, business continuity and recovery capabilities operate effectively together?
Establishes whether response teams share priorities, understand critical interdependencies and coordinate decisions across business functions, jurisdictions and third-party providers, including during the transition to sustainable recovery.
5. What evidence demonstrates that our crisis management arrangements will work under realistic conditions?
Challenges management to demonstrate effectiveness through exercises that test decision delays, incomplete information, competing priorities, leadership behaviour and cross-functional dependencies, supported by documented lessons and measurable improvements.
Conclusion: Crisis Management as a Test of Organisational Resilience
Effective crisis management and response depend on an organisation's ability to make informed decisions, coordinate competing priorities and maintain stakeholder confidence when normal operating conditions are disrupted.
Plans, procedures and response structures provide an essential foundation. Their value, however, depends on how effectively they support leadership judgement, timely escalation and coordinated action when circumstances become uncertain.
For Boards and executive teams, crisis readiness should be assessed through demonstrated capability. This includes the ability to recognise cascading consequences, establish clear decision authority, maintain reliable communication and coordinate the transition from immediate response to sustainable recovery.
Realistic testing and organisational learning are central to maintaining that capability as business models, operational dependencies and external risks evolve.
Ultimately, crisis management is a test of organisational resilience in practice. The organisations best prepared for disruption are those that can translate governance, leadership and operational capabilities into effective decisions when they matter most.
About the Author: Julien Haye
Julien Haye is Managing Director of Aevitium LTD and a former Chief Risk Officer with over 26 years of experience across global financial services and non-profit organisations. Known for his pragmatic, people-first approach, he helps organisations strengthen risk management, governance and resilience to support better strategic decisions.
He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and Resilient Risk Management (Kogan Page, 2026). He also hosts the RiskMasters podcast, where he explores risk, leadership and organisational resilience with industry leaders and change makers.
Frequently Asked Questions About Crisis Management and Response
1. Who should own the crisis management framework within an organisation?
Executive management should assign clear accountability for maintaining the crisis management framework, with responsibility for its development and coordination typically allocated to a designated resilience, risk or business continuity function. Ownership of the framework should be distinguished from authority to direct an actual crisis. The latter should rest with an appropriately empowered executive crisis leader or management team, supported by defined escalation and delegation arrangements.
2. How often should an organisation review its crisis management plan?
Crisis management plans should be reviewed at least annually as a practical baseline, with additional reviews following material organisational changes, significant incidents, exercises or changes to critical dependencies. Review frequency should reflect the organisation's complexity and risk exposure. Reviews should assess whether decision authorities, contact arrangements, escalation thresholds and response capabilities remain appropriate, rather than focusing solely on document updates.
3. What should trigger a review of crisis management arrangements outside the normal review cycle?
Material changes to the operating model, critical technology platforms, outsourcing arrangements, organisational structure or senior leadership may warrant an immediate review. Significant incidents, emerging threats and exercises that reveal coordination weaknesses should also trigger reassessment. Particular attention should be given to changes that affect existing assumptions about response capacity, decision authority or the availability of critical resources.
4. How should organisations manage a crisis involving a critical third-party provider?
Organisations should establish contractual and operational arrangements that support timely incident notification, information sharing, coordinated recovery and escalation. Crisis plans should identify critical supplier dependencies, alternative arrangements and internal decision-makers responsible for managing the relationship. Where a provider supports several important services, the organisation should assess the cumulative consequences of disruption rather than treating each affected service independently. Accountability for the organisation's response remains with its own management.
5. What crisis management information should be reported to the Board?
Board reporting should provide a clear assessment of crisis readiness, material vulnerabilities and management's ability to respond effectively. Relevant information may include exercise findings, unresolved remediation actions, significant dependency exposures, escalation performance and evidence of recovery capability. Reporting should distinguish between the completion of preparedness activities and demonstrated effectiveness, allowing directors to challenge whether management's confidence is supported by credible evidence.
6. How can smaller organisations establish effective crisis management without a dedicated crisis team?
Smaller organisations can establish proportionate crisis management arrangements by identifying a small group of decision-makers, assigning deputies, defining escalation criteria and documenting essential response procedures. The priority should be maintaining clear authority, reliable communication and access to critical resources. Practical scenario exercises can help identify dependencies on individual employees, technology providers or external advisers that might otherwise remain overlooked.