Careers
Part of Crisis communications: what to keep and what to drop
Eight crisis communications practices that hold up under pressure
crisis communications best practices put people first, verify facts, state useful action, acknowledge uncertainty, coordinate updates, listen, correct, and learn.
What to take away
- Make the affected person's decision the center of the message.
- Say what is known, unknown, being done, and expected next.
- Listen and correct throughout the event, not only afterward.
Crisis communications best practices are observable behaviors, not reassuring phrases. Their purpose is to help people make safer, better-informed decisions while the response team acts. Requirements differ by hazard and jurisdiction, so use qualified safety, legal, technical, clinical, or regulatory advice where the event demands it.
Apply eight practices
| Practice | Behavior |
|---|---|
| People first | Lead with safety, assistance, access, and practical impact |
| Verification | Trace every material claim to a current source and owner |
| Action | State who should do what, where, and when |
| Uncertainty | Separate confirmed facts, estimates, reports, and unknowns |
| Coordination | Give every responder one fact brief and update rhythm |
| Accessibility | Use plain language, alternatives, translations, and usable formats |
| Listening | Collect questions, barriers, service needs, and harmful falsehoods |
| Correction | Repair the source record and notify exposed audiences |
The World Health Organization defines risk communication and community engagement around real-time information exchange, informed protective decisions, and communities as partners in emergency solutions. The page addresses public-health emergencies, but its two-way approach cautions businesses against treating affected people as passive message recipients.
Acknowledge emotion without performing it, name the harm or fear that can be supported, explain what the organization is doing, and connect people with real help. Avoid saying safety is the top priority when current operations contradict it.
Evidence of care is a staffed support route, accessible instruction, respectful treatment, and repair. A staffed support route works only if the crisis communications tools behind it hold up: check the vendor status page and confirm call-line staffing before you publish the route.
FEMA training on alert and warning message content lists elements such as the hazard, location, timeframe, official source, expected impact, likelihood, and protective behavior, and stresses clear, accessible, multichannel delivery. These emergency-alert elements should be adapted, not forced into every corporate update.
Use this skeleton for the Action and Uncertainty practices:
- Knownthe confirmed fact, its source, and the time it was verified.
- Unknownwhat is not verified yet, and when an answer is expected.
- Doingwho is acting, where, and the protective step the audience should take now.
- Nextthe next update time, the channel, and where to send questions.
Set a fixed update clock: a typical first statement within 60 minutes of the first verified report, then updates every two hours while the event is active, then daily once it stabilizes. Start with changes since the prior message. Repeat any action still in force, correct errors, and state the next update.
If the investigation remains open, explain what work continues without disclosing facts that could create further harm or violate a duty.
- Use specific dates, times, locations, products, and systems
- Keep one fact log and one controlled source page
- Prepare spokespeople to answer, not recite
- Confirm support capacity before publishing it
- Ask affected groups what is unclear or unusable
- Keep criticism distinct from dangerous misinformation
- Close improvements with a retest
A composite example of the practices applied: a distributor found a mislabeled allergen in one lot. The first statement went out within the hour with the lot code, the affected stores, and the refund route. Updates followed every two hours until the lot was off shelves.
A composite example of the practices failing: a bank with a payment outage said only that engineers were investigating 'a technical issue'. It gave no workaround and no next update time. The same unanswered question filled its support queue.
Assign the practice
The NIST Privacy Framework starting guide outlines a voluntary process for identifying and managing privacy risk. Use it to assign data and response owners for crisis communications best practices; it is not legal clearance.
The CISA business-system logging guidance explains how event records support security review. Preserve appropriate crisis communications best practices access, change, failure, and correction records without claiming that logging validates a metric. A crisis communications checklist turns those records into owners, cadence, and acceptance tests.
Turn each practice into an owner, cadence, input, output, acceptance test, and correction path. Observe the work during a normal reporting cycle and during one controlled failure. Keep the result with the metric definition and decision record. A written policy has little value when access changes, source defects, and disputed conclusions leave no trace that another reviewer can follow.
Common questions
Should a crisis message always express empathy?
It should recognize substantiated human impact in direct language and connect that recognition with responsible action. A stock phrase can sound hollow.
How much detail should be released?
Release enough verified information for affected decisions and applicable duties without exposing private data, creating danger, or compromising a legitimate investigation.
What makes a spokesperson credible?
Relevant authority, command of verified facts, honest limits, direct answers, calm delivery, and reliable follow-up matter more than title alone.
