5.7 Crisis management and contingency planning

Crisis management responds to an event that threatens people, operations, finances or reputation; contingency planning prepares actions and resources before disruption occurs.

Planning identifies critical activities, dependencies, triggers, owners and communication routes. A crisis plan must be usable under pressure, not a long document nobody rehearses.

Identify the threat, the critical function and the first decision; then connect the contingency action to recovery.

A cloud outage plan names a backup system, decision owner and customer message, then tests whether data can be restored.

A contingency plan reduces impact but cannot predict every event; it needs review and exercises.

Effective crisis management depends on speed, clear authority, accurate information, stakeholder communication, ethical judgement and learning after the event.

Conflicting messages and unclear ownership increase harm; transparent updates preserve trust even when the solution is incomplete. Decisions should protect safety first and document trade-offs.

Check who decides, what evidence is reliable, how stakeholders are informed and how the response adapts.

During a product recall, one incident lead coordinates technical evidence while customer support gives a consistent safety message and records affected batches.

A confident public statement without verified information can deepen the crisis.

Contingency planning can shorten downtime, protect people and reputation, and clarify priorities, but it also consumes time and resources and may create false confidence.

Plans expose dependencies and improve resilience when rehearsed; unused plans still need updating as suppliers, systems and regulations change.

Weigh preparation cost against likelihood and impact, then test the plan’s recovery time and single points of failure.

A retailer pays for a second payment provider; the cost is justified if a failed provider would stop all sales during peak season.

A plan stored in a folder is not resilience; capability must be available and tested.