Crisis Communications: How to Build a Plan, With Templates and Examples

Crisis communications is the way an organisation shares information with its people and stakeholders when something goes wrong, from a fire or a flood to a cyber attack or a security incident abroad. Done well, it keeps people safe, stops rumours spreading and protects trust. Done badly, it can turn a manageable incident into a much bigger one.

This guide explains what crisis communications covers, how to build a crisis communication plan step by step, who you need to reach and how, and gives you a plan template and message examples you can adapt for your own organisation.

Book a call with our team

What is crisis communications?

Crisis communications is the planned, coordinated flow of information before, during and after a serious incident. It answers four questions for every audience: what has happened, what it means for them, what you are doing about it and what they need to do now.

Most guides treat crisis communications as a public relations task, focused on press statements and social media. That matters, but for most employers the first priority is simpler and more urgent: making sure every employee knows what is happening and confirming that they are safe. Reputation follows from how well you look after your people.

How crisis communications fits into your wider response

Your overall incident response covers the operational decisions: evacuating a site, calling the emergency services, restoring IT, moving work elsewhere. Crisis communications is the part that tells people about those decisions, quickly and consistently. If you are still deciding whether an event counts as a crisis at all, our guide to what a crisis is explains the signs and the different types.

Crisis communications also sits alongside your continuity planning. A business continuity plan keeps critical work running, while your communication plan makes sure people know what to do while that happens.

Why every UK organisation needs a crisis communication plan

When an incident happens, there is no time to work out who should say what, to whom and through which channel. A written plan means those decisions are made in advance, signed off and practised. It helps you:

• Reach people faster: contact lists, channels and approvals are ready, so the first message goes out in minutes rather than hours.

• Keep people safe: staff receive clear instructions, such as evacuate, shelter or stay away, before they hear rumours.

• Speak with one voice: everyone uses the same agreed facts, so customers, journalists and staff do not hear different stories.

• Meet your obligations: employers in the UK have a duty of care to employees under the Health and Safety at Work etc. Act 1974, and timely communication is part of meeting it in an emergency.

• Recover sooner: clear updates reduce confusion, repeat questions and pressure on your response team.

The UK legal and regulatory context

There is no single UK law requiring every business to have a crisis communication plan, but several duties depend on communicating quickly and accurately:

• Civil Contingencies Act 2004: Category 1 responders, such as emergency services, local authorities and NHS bodies, must maintain arrangements to warn, inform and advise the public in an emergency. If you are a public body, your crisis communication plan is part of meeting this duty.

• RIDDOR: certain serious workplace injuries, occupational diseases and dangerous occurrences must be reported to the Health and Safety Executive.

• UK GDPR: if a personal data breach is likely to put people's rights and freedoms at risk, you must report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. In some cases you must also tell the people affected.

• Sector regulators: regulated organisations, for example in financial services, health, energy or education, may have their own notification rules. Note them in your plan so nobody has to look them up mid-incident.

The 5 C's of crisis communication

There are several versions of the 5 C's, but a commonly used set for crisis communication is:

• Concern: show you care about the people affected before you talk about the organisation.

• Clarity: use short, plain sentences. Say what people need to do, not just what has happened.

• Control: take ownership of the situation and the flow of information, so others do not fill the gap with speculation.

• Confidence: communicate calmly and decisively, even when you do not yet have every answer.

• Competence: show that you have a plan and are acting on it, with clear next steps and a time for the next update.

Two further principles appear in almost every good response: consistency across every channel and spokesperson, and honesty about what you do not yet know.

How to build a crisis communication plan, step by step

1. Identify the scenarios you are most likely to face

List the incidents that could realistically affect your people, sites and operations. For most UK organisations that includes fire, flooding and severe weather, power or IT outages, cyber attacks and data breaches, a serious workplace injury, a security threat or violent incident, transport disruption and an incident affecting staff travelling abroad. Prioritise by likelihood and impact.

2. Set up your crisis communications team

Keep it small and cross-functional, and name a deputy for every role:

Role	Responsibilities
Crisis lead	Activates the plan, makes final decisions and signs off messages
Communications lead	Drafts and sends messages to every audience and keeps the log
Spokesperson	Speaks to the media and external stakeholders using agreed lines
HR lead	Handles employee welfare, next of kin and staff questions
Health and safety lead	Advises on safety instructions and regulatory reporting
IT and security lead	Leads on cyber incidents and keeps channels working
Legal adviser	Checks statements and regulatory notifications
Monitoring lead	Watches news, social media and incoming questions for rumours

3. Agree how the plan is activated

Write down who can activate the plan, what triggers it and how the team is called together, including out of hours. Include a fallback if the usual meeting place or phone lines are unavailable.

4. Map your audiences

List everyone you may need to reach and what they need from you. The audience table below gives a starting point.

5. Choose and test your channels

Decide which channels you will use for each audience, and make sure you can still communicate if one of them fails. Contact details must be current, including personal mobiles for out-of-hours alerts, with staff consent.

6. Prepare and pre-approve message templates

Draft templates for your main scenarios and get them signed off by leadership and legal in advance. In a live incident you should only need to fill in the details.

7. Set approval rules

Agree who can approve each type of message. Safety instructions to staff should go out immediately with minimal sign-off; public statements can take a little longer.

8. Train and exercise

Run tabletop exercises and live tests at least once a year, and after any major change. Test that messages actually reach people, including night shifts, remote workers and anyone travelling.

9. Review after every incident and exercise

Hold a debrief, record what worked and what did not, update the plan and assign owners for each fix.

Crisis communication plan template

Use this structure as the basis for your own plan. Keep it short enough to use under pressure, with detail held in appendices.

Section	What to include
Purpose and scope	What the plan covers, which sites and which types of incident
Activation	Triggers, who can activate the plan and how the team is called together
Crisis team	Names, roles, deputies and 24/7 contact details
Scenarios	Your priority incidents with the first actions for each
Audiences	Every stakeholder group, what they need and who owns contact with them
Channels	Primary and backup channels for each audience
Message templates	Pre-approved alerts, updates, holding statements and all-clear messages
Approvals	Who signs off each type of message and the target time to send
Regulatory contacts	HSE, ICO, sector regulators and insurers, with reporting deadlines
Media handling	Spokesperson, holding statement and how to log journalist enquiries
Monitoring	Who watches news, social media and inbound questions
Logging	How decisions, messages and replies are recorded
Review	How often the plan is tested and updated, and who owns it

Who to communicate with: staff, customers, media and regulators

Different audiences need different information, at different times, through different channels.

Audience	What they need	Typical channels	When
Employees	Safety instructions, what to do now, how to confirm they are safe	SMS, voice call, app, email, Microsoft Teams, Slack	First, within minutes
Managers	Briefing, lines to use with their teams, escalation route	Conference call, Teams, email	Straight after staff alert
Customers	Impact on service, what you are doing, when to expect updates	Email, website notice, social media	Once staff are safe and facts are confirmed
Media	Holding statement, named spokesperson, time of next update	Press statement, website	As soon as there is likely to be interest
Regulators	Formal notification within any required deadline	As set by the regulator	In line with legal timescales
Suppliers and partners	Impact on orders, deliveries and contracts	Email, phone	Once the impact is understood
Families and next of kin	Personal, sensitive updates where staff are injured or missing	Phone, handled by HR	As a priority, before any public detail

Employees come first. They are the people most likely to be affected, they are often asked questions by customers and family, and anything they hear from the news before they hear it from you damages trust.

Choosing your crisis communication channels

No single channel reaches everyone. People miss emails when they are away from their desk, phones are on silent in meetings, and some sites have poor signal. A strong plan uses several channels at once:

• SMS: reaches almost every mobile phone and works without data.

• Voice calls: good for urgent instructions and for people who are driving or working with their hands.

• App notifications: fast, and allow staff to reply or share their location.

• Email: useful for detail and follow-up, but too slow on its own for urgent alerts.

• Microsoft Teams and Slack: reach office and hybrid workers where they already are.

• Intranet or website notice: a single source of truth that you can point every audience to.

• Phone tree or hotline: a backup when other channels fail, and a place for staff to call in.

Sending the same alert across all of these at once is exactly what a mass notification system is for. It also lets staff reply, so you can see who has confirmed they are safe and who you still need to reach. Our article on why email alone isn't enough for emergency employee communication explains why a multi-channel approach matters.

The UK Government's Emergency Alerts service can send warnings to mobile phones in an area where there is a danger to life. It is a public warning tool run by government and the emergency services, not something employers can use, so your own plan still needs to reach and account for your people.

Crisis communication examples: message templates for employees

Keep messages short, specific and action-led. Say what has happened, what people must do and when you will update them. Adapt these examples for your own scenarios.

Initial alert

URGENT: [Incident] at [site/location]. Do not travel to [site] today. If you are on site, follow your warden's instructions and go to [assembly point]. Reply SAFE when you are safe. Next update by [time].

Safety check

[Organisation] safety check: there has been [incident] near [location]. Please reply 1 if you are safe or 2 if you need help. If you need urgent help, call 999.

Update

Update [number] on [incident] at [time]: [what has changed]. [What staff should do now]. Please keep checking this channel. Next update by [time].

Remote working or site closure

[Site] will remain closed on [date] because of [reason]. Please work from home if you can. Your manager will contact you about shifts. Do not visit the site until we confirm it is safe.

All clear

All clear: [incident] at [site] is over. [Site] reopens at [time]. Thank you for following instructions. If you have any concerns or need support, contact [HR contact] or [employee assistance programme].

Holding statement for media and customers

We are aware of [incident] at [location] today. Our priority is the safety of our people and everyone affected, and we are working with [emergency services/partners]. We will share more information by [time]. Updates will be posted at [web page].

Your first hour: a crisis communication timeline

Time	Action
0 to 5 minutes	Confirm the basic facts and activate the plan
5 to 15 minutes	Send the first safety alert to affected staff on every channel and ask them to confirm they are safe
15 to 30 minutes	Brief the crisis team and managers, follow up with anyone who has not replied
30 to 45 minutes	Issue a holding statement if media or customers are likely to ask, and post it on your website
45 to 60 minutes	Send the second staff update, check regulatory deadlines and start the incident log
Ongoing	Update at the times you promised, even if there is nothing new to say

These are guide timings. In a fire or security threat, alert staff the moment the threat is known.

Common crisis communication mistakes to avoid

• Waiting for every fact: silence lets rumour take over. Send what you know, say what you do not know yet and give a time for the next update.

• Relying on one channel: an email-only alert will not reach staff on the road, on the shop floor or on leave.

• Forgetting employees: staff who learn about an incident from the news or social media lose trust quickly.

• Mixed messages: different managers giving different instructions creates confusion and risk.

• No way to reply: a one-way broadcast tells you nothing about who is safe and who needs help.

• Out-of-date contact details: a plan is only as good as the numbers and addresses behind it.

• Defensive or corporate tone: lead with concern for people, not with protecting the organisation.

• Over-promising: do not commit to timescales or outcomes you cannot guarantee.

• No record: without a log of what was sent, when and to whom, reviews and regulatory reporting are much harder.

• Never testing the plan: the first time you use it should not be in a real crisis.

How Vismo helps you communicate in a crisis

Vismo brings alerting, location and response together, so you can reach your people quickly and know who is safe.

• Alerts on every channel at once: mass notification sends the same message by SMS, voice call, email, app push, Microsoft Teams and Slack, and staff confirm they are safe with one tap while you see who has not replied.

• Target the people affected: geofencing sends alerts only to people in a defined area, and can flag when people enter or leave a zone.

• Early warning of incidents near your people: threat intelligence flags events close to your staff and sites, so you can warn them sooner.

• Staff who work alone or in the field: lone worker safety gives people SOS alarms and timed check-ins, with escalation when a check-in is missed.

• People travelling abroad: travel security helps you locate and contact travelling staff when an incident happens near them.

• No mobile signal: satellite devices keep remote teams connected where there is no mobile coverage.

• Find out who is affected in seconds: ask in plain language which of your people are close to an incident, or within a set distance of it, and get an answer from your own location data, then message them straight away. This is Vismo AI.

Every alert, reply and action is logged, giving you an audit trail for debriefs and regulatory reporting. To see how communication fits into the rest of your response, read about Vismo's approach to crisis and incident management, or our guide to duty of care for what employers owe their people in an emergency.

Crisis communications FAQ

What should a crisis communication plan include?

A crisis communication plan should include activation triggers, a named crisis team with deputies, priority scenarios, a list of audiences, primary and backup channels, pre-approved message templates, approval rules, regulatory contacts and deadlines, media handling, monitoring, logging and a schedule for testing and review.

What are the 5 C's of crisis communication?

A commonly used version is concern, clarity, control, confidence and competence. Together they describe messages that put people first, are easy to act on, show you are in charge of the situation and give a clear next step.

Who should be on a crisis communications team?

Most teams include a crisis lead, a communications lead, a trained spokesperson, HR, health and safety, IT and security, and legal advice, each with a named deputy. Keep the core team small so decisions can be made quickly.

How quickly should you communicate in a crisis?

Safety instructions to employees should go out as soon as a threat is known, ideally within minutes. A holding statement for media and customers should follow as soon as there is likely to be interest, even if you do not yet have all the facts.

What is a holding statement?

A holding statement is a short, pre-approved message that acknowledges an incident, shows your priority is people's safety, confirms you are responding and says when you will share more. It buys time to gather facts without leaving a silence.

How often should you test a crisis communication plan?

Test it at least once a year and after any significant change, such as a new site, a restructure or a new communication channel. Include a live test that checks messages actually reach staff on every shift and location.

Be ready before the next incident

Good crisis communications is decided before a crisis, not during one. Vismo helps you reach every employee on every channel, see who is safe and keep a record of every step.

Request a product demo