Crisis Management Plan: Template, Example + Checklist
A crisis management plan you can adapt: risk table, team roles, crisis levels, a phase-by-phase checklist, decision log, search and AI annex, drills and a one-page checklist.
Written & reviewed byAnthony Will, Founder & CEOReputation Resolutions · 13+ year industry veteranUpdated November 2026 · 11 min readKey takeaways
- A crisis management plan is a short working document: risks, a named team with backups, severity levels, steps by phase, a decision log and a maintenance schedule.
- Rate each risk on likelihood and impact and give it an owner. Every example here is hypothetical, so replace it with your own facts.
- Define levels by triggers anyone can recognize, and add an annex for search results, reviews and AI answers. Have counsel review anything with legal exposure.
- Test the plan with drills. Ready.gov and the SBA both stress testing and practice.
Want help building and running the plan?
We can help you build a plan and run it, and we work on the content itself: removal where it qualifies, suppression and AI answer correction. Start with a free, confidential assessment. We are not a law firm, and outcomes are never guaranteed.
In this guide
A crisis management plan is a written document that says who decides, who does what, and in what order when something threatens your organization's operations or reputation. A usable one covers six things: the risks you face, a named team, severity levels, steps for each phase, a decision log and a maintenance schedule. This page gives templates for each.
This page is the plan itself. Our guide on what crisis management is explains the concepts and phases. Here you get the working documents, plus an annex most templates leave out: what to do about search results and AI answers. Some organizations build the plan with a crisis management firm. Others write it in-house. Either way, it only works if the people named in it have read it and practiced it.
Every table below is a template and every example is hypothetical, so replace each with your own facts. We are not a law firm and this is not legal advice. Where a step carries legal exposure, we mark it have counsel review. If anyone is in danger, call your local emergency number first. In the US, you can also call or text 988.
What the plan is built from
Ready.gov's business continuity steps run: prepare, define objectives, identify and rank risks and impacts, develop strategies, assign teams and tasks, and test. The SBA says to start by assessing risk and to practice the plan with staff. Those pages cover disasters and business interruption. The reputation parts below are our own working method, not drawn from them.
Step 1: Risk and vulnerability assessment
List what could realistically hurt you, rate each item on likelihood and impact, and give each an owner. The SBA advises focusing on risks that are realistic for your business, and Ready.gov's steps include ranking risks by priority. These rows are hypothetical. Delete what does not apply and add your own.
Negative news article about the company or an executive
- Likelihood
- Medium
- Impact
- High
- Owner
- Head of communications
Coordinated fake or hostile reviews
- Likelihood
- Medium
- Impact
- Medium
- Owner
- Customer experience lead
Viral social post about a customer incident
- Likelihood
- Medium
- Impact
- High
- Owner
- Social media lead
Data incident or leaked customer information
- Likelihood
- Low
- Impact
- High
- Owner
- IT lead, with counsel
Employee allegation that becomes public
- Likelihood
- Low
- Impact
- High
- Owner
- HR lead, with counsel
Wrong answer about the company in an AI assistant
- Likelihood
- Medium
- Impact
- Medium
- Owner
- Marketing lead
Likelihood and impact are your judgment, not measurements.
Step 2: The crisis team and roles
Name a person and a backup for each role. Ready.gov says to organize a team and define its tasks. In a small organization one person may hold several roles, but if you can, keep final sign-off separate from drafting.
Crisis lead
- Responsibility
- Sets the level, makes final calls, owns the decision log
- Primary
- [name]
- Backup
- [name]
Communications lead
- Responsibility
- Drafts statements, keeps stakeholder lists, manages channels
- Primary
- [name]
- Backup
- [name]
Legal counsel
- Responsibility
- Reviews statements and records (an outside role, not ours)
- Primary
- [name]
- Backup
- [name]
Operations lead
- Responsibility
- Supplies the facts and fixes the underlying problem
- Primary
- [name]
- Backup
- [name]
HR lead
- Responsibility
- Employee messages and workplace matters
- Primary
- [name]
- Backup
- [name]
Spokesperson
- Responsibility
- Speaks on the record, briefed and practiced
- Primary
- [name]
- Backup
- [name]
Monitoring owner
- Responsibility
- Runs the search, review, social and AI checks
- Primary
- [name]
- Backup
- [name]
Add a contact sheet with mobile numbers and an out-of-hours route, stored where you can reach it if email is down. Have counsel review who may speak for the organization and what they may say.
Step 3: Crisis levels and escalation triggers
Levels stop every problem being treated as a catastrophe, and a real one as routine. Define each by a trigger anyone can recognize, then say who is told and who decides. These triggers are hypothetical.
Level 1: Watch
- Trigger (hypothetical)
- A few negative mentions or reviews, no media interest
- Who is told
- Communications lead
- Who decides
- Communications lead
Level 2: Elevated
- Trigger (hypothetical)
- A reporter asks for comment, or a negative post spreads beyond your usual audience
- Who is told
- Crisis lead, spokesperson, counsel
- Who decides
- Crisis lead
Level 3: Crisis
- Trigger (hypothetical)
- A credible allegation of serious wrongdoing, a safety issue, a data incident, regulator contact or sustained national coverage
- Who is told
- Full team and executives, plus the board if your governance requires it
- Who decides
- Crisis lead with the CEO and counsel
Let anyone raise a situation one level, and have counsel review the Level 3 triggers, especially anything involving regulators, safety or disclosure duties.
Step 4: Response procedures by phase
Five phases, each with a checklist. Tick what applies and cross out what does not.
| Phase | Steps |
|---|---|
| Assess | Confirm the facts and list the unknowns; save dated screenshots and URLs; set the level; open the decision log; decide who is told |
| Contain | Stop the cause if it is ongoing; pause scheduled posts and automated messages; preserve records and ask counsel what must be kept |
| Communicate | Tell employees and affected people before the public where you can; publish one approved statement on your own site; use the same facts in every channel; do not speculate; counsel reviews admissions, apologies and anything about individuals |
| Recover | Fix or explain the root cause; update your own pages and profiles; request removal of content that breaks a platform's rules; monitor search, reviews and AI answers |
| Review | Hold a debrief; compare the decision log with the plan; update the plan, contacts and templates; give every fix an owner and a date |
Hypothetical example. A 40-person home-services company sees a customer's video accusing a technician of misconduct start to spread. The communications lead logs it and sets Level 2 because local media have asked for comment. Counsel reviews a short statement saying the company is looking into it, the operations lead pulls the job records, and the monitoring owner checks search, reviews and social daily while the matter is open. The company is invented. The sequence is the point.
Decision log template
A decision log records what was decided, by whom, on what facts, and what happened next. It stops the team re-arguing choices under pressure and feeds the review. Keep entries brief and factual. Have counsel review how the log is kept, because records made during an incident may be requested in a later legal dispute.
Day 1, 9:40 am (hypothetical)
- Decision
- Set Level 2
- Made by
- Crisis lead
- Facts it was based on
- A reporter asked for comment; the video is spreading
- Next step and owner
- Counsel reviews draft statement; communications lead
(your entry)
- Decision
- Made by
- Facts it was based on
- Next step and owner
Communications annex
Keep messages in their own annex so the plan stays short. List every audience: employees, customers, partners, regulators, the media, and the publishers and platforms where content appears. Write the approval chain as draft, fact-check, counsel, then crisis lead. For fill-in messages and stakeholder grids, use our crisis communication plan page, and see holding statement examples for first statements. The CDC's CERC manual also has chapters on communication plans, spokespeople and working with the media, written for emergency response.
Reputation and search annex
Most templates stop at the press statement. Yet people search your name, read reviews and ask AI assistants before they read anything you publish. Add an annex that says what to watch, who watches, and what you do when something turns up.
What to monitor: search results for your organization and leaders' names, with and without words like complaint, scam or lawsuit; news mentions; review sites and your Google Business Profile; social posts; and what major AI assistants say when asked the same fixed questions about you. Save dated screenshots to compare. Reputation monitoring is the ongoing version. Set a baseline cadence in the plan and a tighter one while an incident is open.
What to do when you find something: choose the route by what the content is, not by how it feels.
Content breaks a platform's rules or the law, such as a fake review, doxxing or an unlawful false statement
- Usual route
- Removal request to the publisher or platform, or a legal route with your counsel
- What to know
- The publisher decides, and no outcome is guaranteed. Have counsel review anything that rests on a legal claim.
Accurate, legitimate coverage that stays online
- Usual route
- Suppression: publish and strengthen accurate pages so other results sit beside it
- What to know
- Slow, with no ranking guaranteed. It is not a way to hide real news.
Wrong facts in an AI answer or search summary
- Usual route
- Correction: fix the source pages, publish accurate ones, recheck on a schedule
- What to know
- Answers change from one run to the next, so log what you saw and when.
Fair criticism, or a dispute you can settle
- Usual route
- Respond, fix the problem, and ask real customers for their experience
- What to know
- Do not try to remove honest reviews.
Our pages on negative article removal and suppressing negative search results explain the first two routes, and reputation crisis management covers the online side of an active incident.
Testing and drills
A plan nobody has tried is a guess. Ready.gov says training, testing and exercises are essential components of preparedness, and the SBA says to practice the plan with your staff. Three drills cover most of it:
- Tabletop. Walk the team through a hypothetical scenario from your risk table and note where the plan was silent or unclear.
- Contact test. Check that every number works and backups can be reached outside office hours.
- Approval drill. Draft a statement for a made-up event and run it through your real approval chain to see where it stalls.
Write down what each drill showed and fix it before the next one. Ready.gov's business continuity page also links a test exercise planner you can adapt.
Plan maintenance schedule
These cadences are our suggested starting points, not a standard from any source below. Put each on a calendar with an owner, or the plan quietly expires.
| Task | Suggested cadence | Owner |
|---|---|---|
| Check contacts and backups | Quarterly | Crisis lead |
| Review the risk table and run a drill | Twice a year | Crisis lead |
| Update templates and approved wording | Yearly | Communications lead, with counsel |
| Confirm roles after a hire or departure | When it happens | Crisis lead |
| Full review after any Level 2 or 3 event | After the event | Crisis lead |
Put a version number and last-reviewed date on the first page.
One-page crisis checklist
Print this block or paste it into your own plan. It is a template.
- Level set and logged
- Facts confirmed, unknowns listed
- Dated screenshots and URLs saved
- Cause contained, scheduled posts paused
- Counsel reached on anything with legal exposure
- Employees and affected people told
- One approved statement published, same facts everywhere
- Monitoring owner checking search, reviews, social and AI answers
- Debrief held, plan updated, owners assigned
When to bring in outside help
Some teams run the plan alone. Others add help for what needs a specialist: messaging and media, legal advice, or the content itself. We are not a law firm, so counsel should lead on legal exposure. Most crisis PR firms focus on messaging and media. We also work on the content itself, through removal, suppression and AI answer correction where each fits, and none of it is guaranteed. See corporate crisis management, PR crisis management, or how to recover from a PR crisis once the incident is over.
Reputation Resolutions has worked on online reputation since 2013, is A+ BBB accredited, is a Google Partner and has clients in 40+ countries.
Frequently asked questions
What is a crisis management plan?+
A written document that sets out who decides, who does what, and in what order when an event threatens your operations or reputation. It names the team, defines severity levels and lists steps by phase.
What should a crisis management plan include?+
Risks with owners, a team with backups, severity levels, steps for each phase, a decision log, a communications annex, a reputation and search annex, drills and a maintenance schedule. The sections above give a template for each.
How do I write a crisis management plan?+
Assess your realistic risks, name a team and backups, define levels, write the phase checklist, add the log and annexes, then test it and fix what breaks. Ready.gov's steps follow a similar order: rank risks, assign teams and tasks, then test.
What is the difference between a crisis management plan and a crisis communication plan?+
This plan covers the whole organization: risks, roles, levels and every phase. A communications plan covers the messages, audiences, channels and approvals inside it. Our crisis communication plan page has message templates.
What is a crisis response plan?+
Usually another name for the same document, or for the part covering what you do once an incident is under way: assess, contain, communicate, recover and review.
Is there a crisis management checklist or playbook?+
Yes. The one-page checklist above is a template. A crisis playbook is a shorter version, often one page per scenario, listing the level, the people to call and the first steps.
How often should a crisis management plan be updated?+
We suggest a quarterly contact check, a risk review and drill twice a year, and a review after any serious event. That cadence is our suggestion, not a standard from Ready.gov, the SBA or the CDC.
Can a crisis plan keep negative content out of search results?+
No plan can promise that. It can say what you monitor and which route you take: removal where content breaks a platform's rules or the law, suppression for accurate coverage that stays up, and correction for wrong facts in AI answers. Outcomes are never guaranteed.
Do I need a lawyer to review my crisis management plan?+
For anything with legal exposure, yes, including admissions, employee matters, regulators, privacy and how records are kept. We are not a law firm and this page is not legal advice.
Sources & references
Prefer we handle it?
Want help building and running the plan?
We can help you build a plan and run it, and we work on the content itself: removal where it qualifies, suppression and AI answer correction. Start with a free, confidential assessment. We are not a law firm, and outcomes are never guaranteed.
Get a free confidential assessmentKeep reading
Ready to See What AI Finds About Your Reputation?
Schedule your free, confidential consultation and we'll show you exactly where you stand across search engines, review sites, and AI platforms.