What Should a Crisis Communications Plan Include?

A crisis communications plan should define how an organisation will verify facts, make decisions, approve messages and communicate with affected stakeholders when normal processes are no longer fast enough. At minimum, it needs activation criteria, named roles, stakeholder priorities, escalation routes, approved channels, holding statements, monitoring procedures and a process for testing and improvement.

A usable crisis communications plan should not attempt to predict every sentence the organisation will need. A real crisis changes quickly, and early information is often incomplete. Its purpose is to give the response team a reliable operating system so it can move quickly without guessing who is responsible or publishing claims that have not been verified.

For Malaysian businesses, the plan should also reflect local media expectations, multilingual audiences, regional or global approval structures, regulatory obligations and the speed at which an issue can move through WhatsApp, social media and news platforms.

TQPR’s crisis communications support in Malaysia helps organisations prepare this structure before pressure rises and coordinate the communications response when an issue becomes active.

Key Takeaways: Crisis Communications Plan

• A crisis communications plan should be operational, not a long policy document that nobody can use under pressure.
• The crisis communications plan must define what activates the response and who has authority to make decisions.
• Roles need named owners, deputies and current contact details.
• Stakeholder communication should be prioritised according to impact, responsibility and urgency.
• Holding statements should confirm what is known, acknowledge concern and explain the next action without speculation.
• Approval routes must be faster than normal business processes.
• Media, social, employee and customer channels need coordinated guidance.
• Monitoring should track facts, stakeholder questions, misinformation and response effectiveness.
• The plan should be tested through simulations and updated after organisational or risk changes.

What Is a Crisis Communications Plan?

A crisis communications plan is the communications component of an organisation’s wider crisis-management and business-continuity arrangements. It sets out how information will move from operational teams to decision-makers and then to employees, customers, media, regulators, partners and other affected groups.

A crisis communications plan should answer practical questions such as:

• What situations trigger the plan?
• Who confirms the facts?
• Who leads the response?
• Who is authorised to speak publicly?
• Which stakeholders must be contacted first?
• What can be said before every detail is known?
• How are messages approved outside normal working hours?
• Which channels will be used?
• How will questions, sentiment and misinformation be monitored?
• Who records decisions and updates the plan afterwards?

The plan is not the same as a business-continuity plan, emergency-response manual or legal protocol. Those documents may cover operational recovery, safety, technology, finance and regulatory decisions. Communications should connect to each of them, but it requires its own roles, workflows, messages and channels.

The U.S. Centers for Disease Control and Prevention describes its Crisis and Emergency Risk Communication Manual as an evidence-based framework for people communicating on behalf of organisations during major emergencies. Its principles reinforce why planning must cover audiences, spokespersons, communication channels and the changing phases of a crisis, not only the initial statement.

It is also not a folder containing old press releases. Templates are useful only when the team knows when to use them, who can approve them and how they should change as verified facts develop.

9 Critical Parts of a Crisis Communications Plan

1. Risk Scenarios and Activation Criteria

The first section should describe the types of events that could create material stakeholder or reputation risk. These might include:

• accidents, injuries or safety incidents;
• product defects, contamination or recalls;
• data breaches or cyberattacks;
• service outages or operational disruption;
• allegations involving leadership or employees;
• regulatory investigations or legal action;
• financial distress or major restructuring;
• misinformation, impersonation or coordinated online attacks;
• supply-chain, partner or influencer controversies; and
• natural disasters or events affecting customers and staff.

The list should be specific enough to guide preparation without pretending every scenario can be predicted.

Activation criteria are equally important. A single complaint may remain a customer-service issue, while the same complaint supported by credible evidence, rapid sharing or journalist interest may require crisis escalation.

A practical crisis communications plan can use response levels:

Level	Typical situation	Communications response
Level 1: Routine issue	Limited impact, low attention and clear resolution owner	Manage through normal customer, operations or communications processes
Level 2: Developing issue	Growing attention, uncertain facts or several affected stakeholders	Alert the response lead, increase monitoring and prepare approved lines
Level 3: Crisis	Serious harm, major disruption, regulatory exposure or sustained public attention	Activate the crisis team, centralise decisions and begin coordinated stakeholder communication

The thresholds should consider more than mention volume. Harm, credibility, stakeholder impact, legal duties, operational disruption and the source of the allegation may matter more than how many people have posted about it.

2. Crisis Team Roles, Authority and Deputies

A contact list is not a crisis team. The plan must state what each person is responsible for and what authority they hold.

Typical roles include:

Role	Core responsibility
Crisis lead	Coordinates the overall response and major decisions
Communications lead	Owns messaging, stakeholder communication and channel coordination
Operational lead	Verifies what happened, what is affected and what is being done
Legal or compliance lead	Advises on legal, regulatory and disclosure requirements
HR or people lead	Coordinates employee and workforce communication
Technology or security lead	Leads technical facts and containment for cyber or system incidents
Customer lead	Tracks customer impact, enquiries and service recovery
Spokesperson	Delivers approved public and media responses
Recorder	Maintains the event timeline, decisions, approvals and published statements

Every critical role needs a deputy. A plan that depends on one managing director, lawyer or communications head becomes fragile if that person is overseas, unreachable or directly involved in the incident.

The crisis communications plan should include work and after-hours contact details, secure backup channels and rules for appointing an alternate leader. Sensitive contact information should be controlled, but the response team must be able to access it when normal systems are unavailable.

3. Fact Verification and a Single Situation Log

Speed matters, but unverified speed creates a second crisis. The plan should define how information is collected, checked and updated.

Every crisis communications plan needs one source of truth containing:

• what happened and when;
• what is confirmed, unconfirmed or disputed;
• who and what may be affected;
• operational actions already taken;
• questions still requiring answers;
• regulatory or contractual deadlines;
• decisions made and by whom;
• approved messages and publication times; and
• the next scheduled update.

Facts should have named owners. Operations may verify service disruption, HR may verify employee information, technology teams may confirm system impact and legal advisers may clarify what can be disclosed.

Early updates should distinguish clearly between facts and assumptions. Silence is not always the safest response, but filling gaps with confidence is worse. A credible statement can acknowledge the situation, explain what is being investigated and commit to another update without claiming more than the organisation knows.

4. Stakeholder Mapping and Communication Priorities

A public statement is only one part of crisis communication. The organisation should identify who is affected, who needs to act and who expects information directly.

Stakeholders may include:

• people who are injured, exposed or directly affected;
• employees and contractors;
• customers or patients;
• regulators and government agencies;
• investors, lenders or insurers;
• business partners, distributors and suppliers;
• landlords, communities or local authorities;
• media and industry bodies;
• regional or global headquarters; and
• the wider public.

The priority should follow impact and responsibility, not visibility alone. Directly affected people may need private communication before the organisation posts publicly. Employees should not learn important operational information from a news alert. Regulators may require formal notification through a specific route rather than a media statement.

The crisis communications plan should record each group’s likely concern, the owner of the relationship, the communication channel and the order of contact. The core facts must remain consistent, but the level of detail and required action may differ. Established corporate communications processes make this coordination easier because the organisation already understands who owns important stakeholder relationships.

5. Decision, Escalation and Approval Routes

Normal approval processes are often too slow for a fast-moving issue. If every update requires several departments, regional headquarters and unavailable senior leaders, the organisation may remain silent while inaccurate versions spread.

The crisis communications plan should define:

• who can activate the response;
• which decisions remain local and which require regional approval;
• who approves operational facts;
• who approves legal or regulatory wording;
• who gives final communications approval;
• what can be released under delegated authority;
• the deadline for each approval stage;
• how disagreements are resolved; and
• what happens when an approver cannot be reached.

A simple approval matrix can separate low-risk factual updates from high-risk statements about liability, safety, financial impact or regulatory findings.

The objective is not to remove necessary review. It is to decide the review path before the organisation is under pressure. The crisis communications plan should allow the team to issue accurate, useful information at the speed expected by stakeholders.

6. Holding Statements, Key Messages and Q&A

A holding statement is a short initial response used while facts are still being confirmed. It should not be an empty phrase such as “We take this matter seriously.”

A useful holding statement normally includes:

1. Acknowledgement of the event or concern.
2. Confirmed facts that are safe to release.
3. The immediate action being taken.
4. Concern for affected people where appropriate.
5. A clear commitment to provide further information.
6. A channel or contact point for relevant questions.

Scenario templates can save time, but they should contain editable fields and approval notes. The team should know which facts must be inserted and which phrases require legal, technical or leadership review.

The crisis communications plan should also connect to an approved message house strategy. The message house establishes the organisation’s broader position and proof points. The crisis Q&A then adapts that foundation to the specific event, stakeholder concerns and verified facts.

Prepare likely difficult questions, not only preferred talking points. The Q&A should cover responsibility, impact, timing, previous incidents, corrective action, compensation where relevant and what remains unknown. It should also identify questions the spokesperson must escalate rather than answer speculatively.

7. Spokespeople, Channels and Response Playbooks

The nominated spokesperson should be chosen for credibility, authority and ability to communicate under pressure. The most senior person is not automatically the best person for every update.

The plan should identify:

• a lead spokesperson and trained alternates;
• subjects each spokesperson can address;
• situations requiring the chief executive or technical expert;
• media-interview and press-briefing procedures;
• social-media publishing permissions;
• employee, customer and partner communication channels; and
• backup channels if websites, email or internal systems are unavailable.

Regular spokesperson media training should test whether leaders can answer direct questions, acknowledge uncertainty and return to verified messages without sounding evasive.

Channel playbooks should reflect how each audience receives information. An employee briefing, customer email, regulatory submission, media statement and social update may share the same core facts, but they do different jobs.

Social media requires especially clear ownership. The social media management team should know who can pause scheduled posts, hide or remove prohibited content, respond to routine questions, preserve evidence and escalate material concerns. Deleting criticism simply because it is uncomfortable can intensify distrust.

8. Monitoring, Misinformation and Response Records

The organisation needs to understand how the situation is changing, not merely how often its name appears.

Monitoring should track:

• confirmed news coverage and journalist enquiries;
• social posts gaining meaningful reach;
• questions from customers, employees and partners;
• claims that are inaccurate, misleading or unverified;
• stakeholder sentiment and recurring concerns;
• impersonation, fake documents or manipulated content;
• whether approved messages are being understood; and
• operational indicators such as support volume, cancellations or service disruption.

Effective media monitoring and reporting combines alerts with human judgement. Not every negative comment needs a public rebuttal. The team should assess the source, evidence, reach, harm and likelihood that silence will allow misinformation to become accepted as fact.

The crisis communications plan should state when to correct publicly, contact a journalist directly, update an FAQ, brief employees or avoid amplifying a low-reach claim.

Keep records of enquiries, responses, published versions, screenshots, approvals and major decisions. This supports consistency during the event and gives legal, operational and communications teams a reliable record afterwards.

9. Simulations, Maintenance and Post-Crisis Review

A plan has not been tested simply because senior management approved the document. A simulation reveals whether contact details work, decision-makers understand their authority and the organisation can verify and approve information quickly.

Useful exercises include:

• a contact-tree test;
• a short tabletop discussion around one scenario;
• a timed holding-statement exercise;
• a mock journalist interview;
• a social-media misinformation inject;
• an after-hours activation test; and
• a full simulation involving operations, leadership, legal and communications.

The exercise should test actions and decisions, not reward participants for guessing a scripted answer.

After a real event or simulation, review what worked, where approvals stalled, which facts were difficult to obtain, what stakeholders asked and whether the channels performed as expected. Assign owners and deadlines to improvements.

The crisis communications plan should also be reviewed when leadership, contact details, operations, technology, regulation, products or risk exposure change. A scheduled review once or twice a year can support this, but event-driven updates are just as important.

What Should Be on the One-Page Activation Sheet?

The full plan may contain scenario guides, templates and detailed contacts. The activation sheet should be much shorter.

Include:

• activation levels and immediate triggers;
• crisis lead, communications lead and deputies;
• emergency contact route;
• first internal meeting or call details;
• fact-verification owners;
• final approval authority;
• nominated spokesperson;
• priority stakeholders;
• approved publishing channels;
• location of templates and contact lists;
• monitoring owner; and
• next-update rule.

This sheet is the front door to the wider plan. It should help the first person alerted take the correct next action without reading a 40-page manual.

A Practical First-Hour Crisis Communications Workflow

The first hour should focus on control, facts and responsibility rather than rushing to publish.

Time	Priority action
First 15 minutes	Record the alert, verify the source, assess immediate harm and notify the response lead
15 to 30 minutes	Activate the appropriate level, assign roles, open the situation log and identify affected stakeholders
30 to 45 minutes	Confirm releasable facts, prepare a holding line and agree the approval route
45 to 60 minutes	Contact priority stakeholders, respond to urgent enquiries and publish only if communication is needed

This is a planning model, not a rule that every organisation must make a public statement within one hour. Some situations require faster safety information. Others need careful verification before public communication. The plan should define the decision criteria rather than impose an artificial deadline.

Malaysia-Specific Crisis Planning Considerations

Multilingual Stakeholders

English may be the working language for headquarters or media materials, while customers, employees or communities may need Bahasa Malaysia, Mandarin, Tamil or other languages. The crisis communications plan should identify who can translate and approve urgent messages without changing their meaning.

Machine translation alone may miss legal, cultural or emotional nuance. High-impact messages should be reviewed by someone who understands both the language and the situation.

Local and Regional Approval

Multinational organisations often need to align with regional or global teams. Define which facts and decisions Malaysia can approve locally, which require escalation and what happens outside the headquarters’ working hours.

One regional statement may also need local adaptation. Malaysian stakeholders may face different operational effects, regulatory expectations or questions from those in other markets.

Regulatory and Disclosure Requirements

Communications cannot be planned separately from legal and regulatory obligations. Listed companies, regulated sectors, employers and organisations handling personal data may have specific notification or disclosure responsibilities.

For example, Malaysia’s Personal Data Protection Commissioner publishes formal data-breach notification guidance. A data incident plan should therefore identify the legal or data-protection owner, assessment process and notification decision path before an incident occurs.

This article is not legal advice. Organisations should obtain advice appropriate to their sector, facts and obligations rather than relying on a general communications template.

Fast-Moving Private and Public Channels

Screenshots, voice notes and partial information can move rapidly through WhatsApp groups before appearing in mainstream news or public social posts. Monitoring only the organisation’s official accounts may provide an incomplete picture.

The response team should create routes for employees, customer teams, partners and local managers to report emerging claims quickly. Internal forwarding should preserve context and evidence instead of turning an unverified message into an accepted fact.

Cultural and Community Context

Language, religious periods, public holidays and community sensitivities can affect how a statement is received. The organisation should not use cultural context as an excuse to avoid accountability, but it should consider timing, spokesperson choice and the needs of affected communities.

Local judgement becomes especially important when a regional template sounds detached from what people in Malaysia are experiencing.

How Does the Plan Connect to Media Relations?

During a crisis, media enquiries should be centralised and recorded. Journalists need a clear contact point, timely confirmation of available facts and realistic expectations for the next update.

The media relations team should coordinate with operations, legal and leadership rather than run a separate version of the response. It may prepare statements, organise briefings, manage interview requests, correct material inaccuracies and track the questions shaping coverage.

Good media handling does not mean trying to suppress every difficult question. It means making accurate information accessible, preparing credible spokespeople and maintaining a professional relationship even when coverage is critical.

When Should an External Crisis Communications Agency Be Involved?

An internal team can manage many issues when roles are clear, facts are accessible and leadership is available. External support becomes more useful when:

• the situation is attracting sustained media or social attention;
• the internal team is directly involved or lacks capacity;
• senior leaders need objective challenge and message discipline;
• several stakeholders, markets or languages must be coordinated;
• spokespersons face difficult interviews or public appearances;
• monitoring and media response need to continue outside normal hours;
• the organisation has no tested plan or usable templates; or
• the issue could materially affect trust, operations or long-term reputation.

The agency should work alongside the organisation’s legal, operational and leadership teams. Communications cannot solve the underlying event, and an external adviser should not invent facts or commitments the business cannot support.

The strongest time to establish the relationship is before a crisis. Preparation allows the adviser to understand the organisation, risks, stakeholders and approval structure before every minute matters.

Common Crisis Communications Plan Mistakes

Avoid these weaknesses:

• treating every negative comment as a crisis;
• failing to define activation thresholds;
• listing names without assigning authority;
• relying on one spokesperson or approver;
• preparing statements without a fact-verification process;
• drafting only public messages while ignoring affected people and employees;
• allowing legal review to become an undefined delay;
• using one message for every stakeholder;
• monitoring volume without assessing credibility or harm;
• forgetting backup communication channels;
• storing the plan where the response team cannot access it; and
• approving the document without testing it.

A polished plan can still fail if the organisation’s culture discourages early escalation. Employees and managers must know that reporting a developing issue is responsible, not disloyal or alarmist.

Frequently Asked Questions About Crisis Communications Plans

Build the Plan Before the Pressure Arrives

A crisis communications plan gives an organisation a disciplined way to move from uncertainty to verified, useful communication. It should clarify decisions, protect affected stakeholders from avoidable confusion and help leadership respond at the speed the situation requires.

The strongest plans are specific enough to guide action but flexible enough to handle events that do not follow the expected script. They connect communications with operations, legal responsibilities and real stakeholder needs.

TQPR supports Malaysian and regional organisations with scenario planning, message development, response structures, spokesperson preparation and live issues management. Contact TQPR to review an existing plan or prepare one before the next high-pressure situation.

---

Sources & Further Reading

• U.S. Centers for Disease Control and Prevention, “Crisis & Emergency Risk Communication (CERC) Manual” (linked above).
• Personal Data Protection Commissioner Malaysia, “Personal Data Protection Guidelines on Data Breach Notification” (linked above)