Most crisis planning produces a document describing responses to anticipated events, and the crisis that arrives is not on the list.
This is not a failure of imagination that better planning would fix. The space of possible situations is genuinely larger than any list, and effort spent extending the list produces diminishing returns while consuming the effort that should have gone elsewhere.
The common structure
What makes preparation possible is that crises differ enormously in content and hardly at all in structure.
In every one, somebody must decide with incomplete information. Somebody must be the single source of what is known. Somebody must speak externally, and everybody else must not. People must be told things in a particular order. And a record must exist afterward of what was known when.
Those five requirements are identical whether the situation is a fire, an allegation, a funding collapse, or a data breach. They are also, reliably, what fails first, and they fail because they were never assigned.
What to prepare
Roles by name, with alternates. Who decides, who speaks, who keeps the log, who handles the people affected. Named individuals rather than positions, because positions are vacant at inconvenient moments, and alternates because the crisis will happen while somebody is in Boise.
Decision rights during a crisis. What the person on scene may commit without asking. A supervisor who may authorise five hundred dollars ordinarily should know whether that limit applies at two in the morning with a flooded building, and the answer should not have to be worked out then.
The notification order. Who is told, in what sequence, and by whom. This is where organizations do the most avoidable damage: a family learning from social media, a board learning from a reporter, a regulator learning after the deadline. The order is knowable in advance and takes twenty minutes to write down.
Contact information that is current. Unglamorous and the most common point of failure. A list that has not been checked in two years contains a supplier who no longer holds the contract, an attorney who has retired, and a mobile number that has changed.
The first hour. Not what to do about the situation, which is unknowable, but the procedural sequence: convene these people, start the log, hold external communication, establish what is actually known.
What cannot be prepared
Being honest about this is what keeps the preparation from becoming theatre.
The substantive decision cannot be prewritten, because it depends on facts you do not have. Any plan specifying what to decide in a situation is either describing an emergency rather than a crisis, or it is fiction.
Judgment under pressure cannot be installed by a document. Nor can the standing that allows a leader to say something difficult and be believed, which is built over years and either exists when needed or does not.
And the specific event cannot be anticipated. Planning that assumes otherwise produces a binder consulted once, found not to cover the situation, and abandoned in the first twenty minutes.
The two-page version
A forty-page plan will not be read during a crisis. Nobody has ever read one during a crisis.
What gets used is short enough to take in at a glance: names and numbers, decision rights, notification order, first-hour sequence. Two pages, printed, held by everybody named on it, because the digital version is inaccessible in precisely the operational failures where it matters.
The longer document may still be worth producing, for insurers or regulators or because writing it forces thought. It should not be confused with the thing that will actually be used.
Small organizations
A district office of nine people or a firm of thirty frequently concludes that this is corporate machinery that does not apply to them.
The opposite is closer to true. A large organization has redundancy and specialists. A small one has one person who knows the payroll system, one who holds the funder relationships, and one who understands the building. The absence of any of them for two weeks is itself a crisis, and it is entirely foreseeable.
For an organization of that size the whole exercise is perhaps ninety minutes: name the alternates, write down what only one person knows, make sure two people can access what matters, and confirm the contact list. That is not a crisis plan in any formal sense and it addresses the most likely failure directly.
The entries that follow deal with the pieces in turn: assigning roles and decision rights, continuity for organizations without dedicated capacity, and running an exercise that produces information rather than reassurance.
Edited by Patrick J. Wolf, PhD