Crisis plan versus continuity plan
| Crisis management plan | Business continuity plan | |
|---|---|---|
| Question | What do we decide and say? | How do we keep delivering? |
| Owner | CEO and crisis team | Activity owners |
| Trigger | Threat to people, licence, reputation, or disruption beyond tolerance | Disruption of a prioritised activity |
| Content | Team, authority, meeting rhythm, decision log, communication | Workarounds, recovery steps, resources |
| Judged by | Board, regulator, media, staff | Customers, auditors |
Organisations that merge the two get a plan nobody can use at 2 a.m.: the duty manager needs the continuity checklist, the CEO needs the decision structure. Keep them separate and cross-referenced.
Seven sections of the plan
- Activation. Who may activate (leader or deputy), on which criteria, and how the time is logged. The criteria are written as facts, not judgements: "a critical service beyond tolerance", "an event requiring regulator notification".
- Crisis management team. Eight roles with primary and deputy: leader, coordinator, operations, communications, legal and compliance, people, IT and security, finance. Authority written down: who may stop operations, spend, and speak.
- Meeting rhythm and situation report. First meeting within 30 minutes, then every two hours on day one. Same agenda every time; situation report as the only shared picture.
- Decision log. Time, decision, options considered, who decided, rationale, review point. This is what protects the team afterwards.
- Communication matrix. Six audiences, each with an owner, channel, timing and template: staff, customers, regulators, media, board, insurers.
- Stand-down and review. Who declares the end, on what criteria, and the post-incident review within ten working days.
- Exercising. Tabletop at least annually, call-tree quarterly, review after every activation.
Download the template
Download the template. Seven sections with the team table, communication matrix, decision log and a situation report form in Appendix A. Docx, five pages.
Download docx (crisis-management-plan-template.docx)
Regulator notification timelines in the communication matrix must be replaced with the ones that apply to you: NCEMA, CBUAE, DFSA, ADGM or sector rules. No registration, no forms. Need it adapted to your organisation or a full programme: see how we work.
The communication matrix, where plans usually fail
Six audiences, and most plans cover two. Staff need to hear from the organisation before they hear from the press; customers need a holding statement within two hours, not a perfect statement tomorrow; regulators have prescribed timelines that start at detection, not at the first meeting. The matrix in the template assigns each audience an owner and a pre-approved template, so that in the first hour nobody drafts from a blank page. The pre-approved holding statements are the part legal should sign before the crisis, not during it.
Frequently asked questions
What is a crisis management plan?
A document that defines how an organisation makes decisions and communicates during an event that threatens people, operations, reputation or licence: activation criteria, the crisis team and its authority, meeting rhythm, decision log and communication with all audiences. It governs the response; continuity plans recover the activities.
Who is on a crisis management team?
A leader with a deputy, a coordinator, and leads for operations, communications, legal and compliance, people, IT and security, and finance. Every role has a named deputy; a team that depends on one person is a single point of failure.
How often should the crisis team meet during an incident?
Within 30 minutes of activation, then every two hours on the first day and twice daily afterwards, always with the same agenda and a written situation report.
How is the crisis plan tested?
Tabletop exercises at least annually using realistic injects, call-tree tests quarterly, and a review after every real activation. The tabletop pack on this site provides a ready scenario.