What would your leadership team do if a serious allegation about your business started spreading online before anyone knew whether it was true?
That's where crisis communication and management really matter.
An employee spots the post, screenshots start circulating, and staff begin asking questions.
You need to respond quickly, but rushing out a statement before checking the facts can make things worse. Staying silent for too long can leave employees confused and rumours to fill the gap.
The Reuters Institute’s 2025 Digital News Report found that 58% of respondents across its surveyed markets were concerned about what is real and fake in online news. This reflects wider public concern about online information. It is not a measure of how often businesses experience a crisis.
The concern about what's true online is widespread.
The Reuters Institute's 2025 Digital News Report found that 58% of respondents across its surveyed markets worried about what is real and fake in online news.
That's a measure of public concern—not a count of business crises—but it helps explain why organisations need a calm, prepared response.
In this article, you'll learn how to spot when an online issue needs a coordinated response, decide who should take charge, check what's known, and keep employees and other audiences informed.
You'll also get practical steps for preparing a plan before a crisis hits—and reviewing it afterwards.
When harmful content starts spreading, employees and customers need a reliable source of information. Clear crisis communications help leaders explain what's known, what's still being checked, and what people should do next. Without that guidance, people may turn to screenshots, rumours, or conflicting updates to fill the gap.
A coordinated response also helps the organisation support people directly affected, keep messages consistent, and avoid making claims that may later need correcting. It won't control every post or stop every rumour, but it can give people a clearer way to understand what's happening.
Sometimes leaders are personally named or targeted as part of a crisis. ContentRemoval.com's executive reputation management guide places that work in the context of protecting a leader's online presence.
Crisis communication and management is how an organisation shares accurate, timely information before, during, and after a serious incident.
It also means deciding who needs to act, what people need to know, and how updates will be shared as the situation develops.
A negative comment or complaint doesn't automatically mean you're facing a crisis. It may be something a customer service or HR team can handle through its usual process.
But if a post starts spreading quickly, makes a serious allegation, puts someone's privacy or safety at risk, or disrupts the business, it may need a coordinated response.
The UK Government Communication Service describes a crisis as an event involving threats such as public safety risks, financial loss, or reputational damage.
A social media crisis might begin with a misleading claim, a leaked document, online harassment, or a genuine mistake by the organisation.
The important thing is to check what happened before calling something "false" or "harmful."
That's why a social media crisis management plan should give your team time and space to verify the facts before deciding what to say.
A post doesn't have to stay in one place.
Someone can screenshot it, share it in a group chat, repost it on another platform, or send it to a journalist.
Before your team has checked what happened, employees may be asking managers for answers and customers may be looking for reassurance.
That can affect more than the organisation's reputation.
A post that identifies an employee could put their privacy or safety at risk. Unclear or conflicting updates may damage trust, distract teams from their work, or leave customers unsure whether a service is affected.
It can also be upsetting for the people named or targeted.
Harmful online content might include:
Edited or AI-generated media can make verification harder, but a disputed image or video isn't automatically synthetic. Check the source and context before drawing conclusions.
Online communication can help you share warnings and updates quickly.
But if people pass on unverified claims—or different teams give different answers—the confusion can spread just as fast.
A steadier response has four parts: check what you know, look after anyone affected, agree on one clear update, and keep watching how the situation develops.
That applies to public posts and to the messages your employees are sharing internally. AgilityPortal's guide to internal communications for crisis management explores how organisations can keep staff informed during difficult situations.
A quick but important distinction: acknowledging an incident isn't the same as confirming an allegation. Saying, "We're aware of the post and are checking the facts," tells people you're looking into it. It doesn't say the post is true.
Before you respond, agree who owns the message and what's been confirmed.
Then share an update through a channel employees can find and trust. This is one reason to have a clear internal communications strategy and a reliable place to publish updates, policies, and answers.
The NCSC also advises organisations to communicate clearly and avoid speculation or assurances that later evidence could contradict.
The first hour is about getting control of the response—not having every answer.
Your team needs to work out whether anyone is at risk, what can be confirmed, who is making decisions, and when people will hear from you again.
Use these steps to give the response structure.
Start with the people involved, not the number of likes or shares.
A post can be getting attention without putting anyone in danger, while a single message can contain a serious threat.
Ask someone from HR, security, or operations to make a quick safety check:
If someone may be in immediate danger, follow your organisation's emergency and safeguarding procedures and contact the appropriate emergency services.
Don't wait for the communications team to finish reviewing the post before taking urgent safety steps.
For other cases, ask a named HR, security, or operations lead to contact the affected person privately.
Explain what the organisation knows so far, ask what support they need, and agree how they can report further contact. Keep the conversation confidential and share details only with people who need them to help.
The employee shouldn't have to respond publicly, investigate the post, or manage the organisation's online response themselves.
Before a post is edited, deleted, or shared elsewhere, make a careful record of what your team can see.
This doesn't mean spreading it around internally. It means keeping enough information for the people handling the crisis communication response to understand what happened and when.
Ask one person to record:
Store the material in an access-controlled location and note who can view it.
Avoid sending sensitive screenshots through broad email lists or team chats, especially if they contain someone's personal information. Don't repost the content just to show colleagues what is happening; that can expose more people to it or spread it further.
This record can help your crisis communication team check the facts, track how the situation is developing, and make decisions based on what is actually known.
Follow your organisation's privacy, security, and evidence-handling rules.
If you're unsure what to keep or who should have access, check with your legal or privacy lead before sharing it.
Bring together the people who can check what's happening and make decisions. You don't need a large committee in the first hour; you need the right people, with clear ownership.
In a smaller organisation, one person might cover more than one area, but everyone should know which decisions they're responsible for.
Agree on two things straight away:
Bring in legal, privacy, customer support, or operations if the situation affects their area.
Clear crisis communication team roles and responsibilities help prevent delays and conflicting messages. If you need a starting point for employee updates, see AgilityPortal's guide to internal communications for crisis management.
When a post is spreading, it's easy for people to repeat what they've heard as if it's confirmed.
Slow that down by asking the people closest to the event what happened, then checking any relevant records, messages, or systems. If accounts differ, note the difference and find out what still needs checking.
A simple shared record helps your team stay clear about the facts:
Add who checked each detail and when. If something changes, update the record rather than leaving two versions in circulation.
This gives the communications lead a sound basis for an update and helps the team explain what it knows without filling gaps with guesses.
Be careful with the words you use. Don't call a claim false simply because someone disputes it, and don't repeat it as fact just because it's being shared widely. The National Cyber Security Centre's guidance on communicating during a cyber incident advises organisations to avoid speculation or premature conclusions that may need to be corrected later.
The same discipline is useful in social media crisis management: say what you've confirmed, be open about what you're checking, and explain when people can expect another update.
For a broader look at keeping employees informed, see AgilityPortal's guide to internal communications for crisis management.
Look beyond the number of likes, shares, or comments.
Ask:
A routine complaint can usually stay with the team that normally handles it. Escalate when there may be a safety, privacy, operational, or serious reputational impact. Set a time to reassess severity, because the situation can change.
Take a quick look at what's scheduled to appear on your organisation's social media accounts.
A cheerful promotion, joke, or routine campaign may feel completely wrong beside a serious incident, especially if employees or customers are worried.
If a post could seem insensitive or make it look as though your organisation hasn't noticed what's happening, pause it while the response team reviews the situation.
Check more than the next post in the queue.
Look at scheduled content across your organisation's accounts and any automated posts that might go out without someone reviewing them. Give the person managing each account a clear instruction about what to pause and who can approve posts while the incident is being handled.
That doesn't mean you should stop every message.
Updates that help people stay safe or understand what to do may still need to go out. The decision depends on the incident, the content, and how people affected are likely to read it.
Pausing unsuitable posts is a practical part of social media crisis management. Sprout Social recommends stopping scheduled content when it could appear inappropriate during a crisis. Read its advice on managing a social media crisis response.
The aim is to avoid adding an unnecessary distraction while your team focuses on accurate updates and the people who need support.
Decide who will communicate, which channel they will use, who needs the update, and when it will go out.
If you can't confirm everything yet, say what you are checking and when people can expect to hear from you again. Don't promise a resolution by a time you can't control.
For employees, use a channel they can readily access and give managers the same approved information to share. A clear internal communication strategy can help staff find updates and know where to raise questions.
By the end of the first hour, the team should have a safety check underway, a record of the available evidence, named decision-makers, an initial severity assessment, and a time for the next update.
That gives people a reliable starting point while the facts are still being checked.
A crisis response can slow down when everyone assumes someone else is in charge—or several people send different messages.
Agree on the key roles before an incident happens.
In a smaller organisation, one person may cover more than one role, but each decision still needs a named owner.
| Role | Main responsibility | Why it matters |
| Executive or crisis lead | Activates the response, sets priorities, and resolves decisions between teams | Keeps the response connected to the organisation's overall needs |
| Communications or PR lead | Coordinates messages, monitors public discussion, and prepares spokespeople | Helps prevent conflicting public statements |
| HR or People lead | Supports affected employees, briefs managers, and coordinates staff updates | Protects employee wellbeing and trust |
| IT or security lead | Checks accounts, systems, access, and possible data exposure | Helps establish whether there's a security or privacy issue |
| Legal or privacy lead | Advises on legal concerns, personal information, evidence handling, and wording | Helps the team avoid claims it may later need to correct |
| Operations or customer lead | Assesses service disruption and customer impact | Connects updates with practical steps customers may need |
| Managers | Share approved updates, raise staff concerns, and report new information | Helps reach employees who may not follow public channels |
| Backup approver or spokesperson | Steps in if the usual decision-maker is unavailable | Keeps the response moving |
A useful plan should be easy to find and follow when people are under pressure.
It should answer a few practical questions: When do we act? Who does what? What can we say? How will we keep people informed?
Don't leave those answers until a crisis is already unfolding.
The UK Cyber Security Breaches Survey 2025/2026 found that 25% of businesses had a formal incident response plan. This figure is specifically about cyber security incident response, not crisis communication plans. It offers broader context on how organisations prepare for incidents.
Source: UK Government, Cyber Security Breaches Survey 2025/2026
The UK Government's 2025 public survey found that 84% of respondents thought it was important for the government to share information about its plans for large-scale emergencies.
That finding is about public expectations of government, not company crisis plans. Still, it underlines why people need to know where reliable updates will come from.
Build your plan around these elements:
In September 2024, Tewkesbury Borough Council shut down its IT systems after detecting suspicious activity. The Local Government Association's later case study says the council did not yet have an approved cyber incident playbook.
However, its experience responding to other emergencies helped staff mobilise teams, assign response roles, and communicate with residents and partners. The council used its website and social media for updates, and its regular, transparent communication helped build trust.
The incident also exposed gaps: some contact details and continuity plans were difficult to access once systems were switched off.
The council subsequently developed a cyber incident response plan and improved access to continuity resources.
The lesson is practical: a coordinated response can help people make decisions and keep others informed, but the plan needs to work when everyday systems are unavailable.
AgilityPortal's guide to internal communications for crisis management offers related advice on keeping employees informed. For broader preparation and rehearsal guidance, see the UK Government Communication Service's PRIMER framework.
A crisis communication plan shouldn't sit in a folder that nobody can find.
It should tell your team what to do when harmful online content starts spreading, a serious allegation appears, or employees need clear information quickly.
If you're wondering how to create a crisis communication plan, start with the situations your organisation could realistically face—not a template filled with generic instructions.
Use this checklist to build a practical social media crisis management plan:
The UK Government Communication Service's PRIMER framework can help structure the work: Plan, Rehearse, Implement, Maintain, Evaluate, and Recover. Its guidance stresses keeping the plan current and rehearsing the response, so people know what to do before a crisis begins.
The goal is a plan people can use under pressure: clear enough to guide the first response, flexible enough to fit the facts, and easy to update as the situation changes.
For more on keeping employees informed during an incident, see AgilityPortal's guide to internal communications for crisis management.
Your first message doesn't need to explain everything. Its job is to show people you're aware of the issue, share any immediate action they need to take, and tell them where to look for the next update.
That gives employees, customers, or partners a reliable source of information while your team checks the facts.
A useful holding statement should:
A holding statement lets people know you’re aware of an issue while your team checks the facts. Adapt the wording to the situation and share only information you have confirmed.
We’re aware of [brief description of the issue] and are checking the information. We’re speaking with the people involved and will share another update through [official channel] by [time]. Please send relevant information to [contact or team].
We’re aware that content involving a member of our team is circulating online. We’re contacting the person directly and taking steps to support their wellbeing and privacy. Please don’t share personal information. Employees who need help can contact [HR or support contact].
[Service or operation] is currently affected by [confirmed issue]. We’re working to understand the impact and restore normal service. Please use [alternative process or channel] for now. We’ll post the next update at [time] on [official channel].
We’ve confirmed that [brief, accurate description of what happened]. We’re sorry for the impact this has had on [affected people or group]. We’re taking [specific action] and will provide a further update through [official channel] by [time].
Before using a statement: Replace the bracketed details, check the wording with the appropriate response lead, and set a realistic time for the next update. Don’t promise an outcome or repeat unverified claims.
Adapt the wording to what you actually know.
Don't promise the issue will be resolved by a certain time unless you can control that. If you don't have a confirmed answer yet, say so and explain when people will hear from you again.
The National Cyber Security Centre's guidance on communicating during a cyber incident recommends clear, timely updates and warns against speculation or assurances that later evidence could contradict.
That's a good standard for a crisis communication response: be helpful and direct, while leaving room to update the message as the facts become clearer.
Sprout Social’s 2025 Index found that 73% of social media users expected brands to respond on social within 24 hours. This indicates a consumer response expectation; it is not a universal deadline for every crisis. Organisations should set response targets suited to the incident and the people affected.
Employees shouldn't have to rely on screenshots or rumours to work out what's happening.
Give them a clear update that explains what the organisation knows, what it's still checking, where updates will appear, and when they can expect to hear more.
You may not have every answer yet, but you can still tell people what's being done.
Make sure managers receive the same approved briefing as everyone else, along with a named contact for questions they can't answer.
Ask them to share the update with their teams, pass on concerns, and avoid guessing or giving unofficial explanations. Employees should also know not to repost or debate unverified material on the organisation's behalf.
Think about how all staff will receive the message:
The UK Public Survey of Risk Perception, Resilience and Preparedness 2025 found that 84% of respondents thought it was very or somewhat important for government to share information about plans for large-scale emergencies. This is a public expectation of government communication, not a survey of business crisis plans.
Source: UK Government, Public Survey of Risk Perception, Resilience and Preparedness 2025
Even when people are trying to help, unclear ownership can lead to conflicting statements, gaps in employee support, or messages that need to be corrected later.
Here are a few situations to plan for:
| Workplace situation | Possible risk | Recommended approach |
| A serious claim is circulating but hasn't been verified | A public denial may later prove inaccurate | Acknowledge awareness, check the facts, and give a clear time for the next update |
| An employee is named or targeted online | Their safety, wellbeing, or privacy may be at risk | Contact them privately, assess immediate safety, and offer a confidential support route |
| Several departments publish different explanations | Employees and customers may lose confidence or become confused | Give one communications lead ownership of updates and brief managers using approved guidance |
| Scheduled promotional posts continue during a sensitive incident | The organisation may appear unaware or insensitive | Review queued content and pause posts that could distract from the response |
| Employees ask questions before a public statement is ready | Staff may fill the information gap with rumours | Send a brief internal update explaining what's known, what's being checked, and when staff will hear more |
These scenarios are why a social media crisis management plan needs to cover employee communication as well as public statements.
Your internal crisis communication plan should name the message owner, manager contact, approval route, and backup channel before an incident happens.
A crisis communication response may involve sensitive information about employees, customers, or the organisation.
Share it only with people who need it to investigate or support those affected. Even if a post is already public, repeating someone's private details in a statement can spread them further.
If personal information, threats, or serious allegations are involved, bring in your privacy or legal lead early.
They can help the team assess what information to keep, who should see it, and what the organisation may need to do next. If the incident could involve a personal data breach, the ICO's guidance on assessing data breaches can help organisations consider the risk to people.
The right steps depend on the facts, so don't treat a general article—or a social media crisis management plan—as legal advice.
It's also important to distinguish an employer's crisis response from rules that apply to online services.
Ofcom's crisis response protocol relates to certain service providers in scope of the Online Safety Act and serious public-safety situations involving a significant increase in relevant illegal or harmful content.
A business is not automatically subject to that protocol just because a post about the business or an employee is spreading online.
A busy comment section doesn't automatically mean your crisis communication worked.
Views and shares tell you that people saw a message; they don't tell you whether employees understood it, whether the people affected got help, or whether the organisation followed through.
After an incident, review both the communication and the response process.
You could track:
Use the review to decide what to change, not to blame individuals.
The Government Communication Service's RESIST 3 guidance says evaluation should go beyond simple metrics and consider real-world outcomes and how well the response process worked.
These AgilityPortal guides explore practical ways to coordinate internal crisis communication, keep employees informed, and make important updates easier to find across office, remote, and frontline teams.
Together, these resources offer ideas for planning crisis updates and giving employees a clear, reliable place to find them.
Organisations may need to plan for online content appearing in different formats and moving across platforms.
Edited images, video, and AI-generated content can make verification more complicated, but that doesn't mean every disputed post is synthetic.
The Government Communication Service's RESIST 3 guidance recognises AI-generated content as one possible information threat and discusses monitoring tools that can help teams spot and assess emerging narratives.
There's a useful example in the same guidance: HMRC used an AI-enabled early-warning system to spot a rise in misinformation about tax on second-hand sales.
Its communications team then worked across social media, press, video, and GOV.UK to provide corrections and clear information. HMRC reported that its first response post received more than one million views.
That shows how monitoring can help a team notice and respond to a developing issue; views alone don't prove the misinformation stopped or that every audience understood the correction.
For employers, the practical lesson is to build skills that remain useful whatever tools are available: checking sources, using sound judgement, protecting privacy, writing clearly, and training managers to escalate concerns.
AI may help teams monitor activity or prepare a first draft, but a person should verify the facts, review the wording, and take responsibility before sensitive communication is sent.
The UK Government's AI Playbook covers safe and responsible AI use in government; organisations should also follow their own data and security rules.
During an incident, employees need to know where to find reliable updates.
AgilityPortal gives organisations a central digital workplace for sharing internal communications, policies, documents, and answers.
Teams can use announcements, pages, and other workplace tools to keep information accessible across desktop and mobile.
With AgilityPortal, organisations can:
AgilityPortal can support your internal communication process, but it doesn't replace a crisis communication plan or the people responsible for checking facts and approving messages.
When an online issue is unfolding, employees need to know what’s been confirmed, where to find the latest update and who to contact with questions. AgilityPortal gives your organisation a central digital workplace to share approved messages and useful guidance with your people.
Organisations can't control every post, screenshot, or rumour that appears online.
But they can decide how prepared they are to respond.
A clear crisis communication plan helps people know when to escalate an issue, who makes decisions, and how to share updates while the facts are being checked.
That preparation doesn't guarantee a post will stop spreading.
It does make it easier to respond with care and accuracy: check what's known, support anyone affected, give employees a trusted place to find updates, and follow through on the actions you promise.
Clear roles, an escalation route, and a realistic practice exercise can help your team do that under pressure.
The deeper lesson is that crisis communication and management isn't just about protecting a brand. It's about helping people feel supported and informed when the situation is uncertain.
Employees shouldn't have to piece together what their organisation knows from social media or guess where to ask for help.
A steady, honest update—and a clear next step—can make a difficult moment easier to navigate.
It's how an organisation prepares to communicate before, during, and after a serious incident.
A clear plan helps people know who is responsible, what information has been confirmed, and where affected groups can get updates.
"Crisis comm" is shorthand for crisis communications: the messages and communication process an organisation uses during a serious issue. The aim is to share accurate updates, support affected people, and explain what happens next.
PR crisis management is the public relations work involved in preparing for and responding to an incident that could harm an organisation's reputation.
It includes coordinating statements, answering media questions, and sharing verified information with the public.
Public relations crisis management deals mainly with external audiences, such as customers, partners, and media. Internal communication keeps employees informed.
The messages should be consistent, but staff also need practical information about what the incident means for them and where to raise concerns.
Public relations helps an organisation explain its response to external audiences, while crisis management coordinates the decisions and actions behind that response.
The best approach connects both: clear public messages should reflect what the organisation is actually doing.
The PR lead can coordinate external updates, while the wider crisis team checks facts, supports employees, and decides what action is needed.
Agree on message ownership and approval routes early to avoid conflicting statements.
It's an online issue that could seriously affect people, operations, customer confidence, or the organisation's reputation.
Consider the content's credibility, reach, and potential harm; a negative comment alone doesn't automatically make it a crisis.
Set clear activation and escalation criteria, assign owners and backups, identify audiences and communication channels, prepare adaptable message templates, and practise the plan.
Review it after exercises or real incidents.
Usually a senior decision-maker, communications lead, HR representative, IT or security contact, and legal or privacy adviser.
Add other specialists when the situation calls for them, and name backups for key roles.
Acknowledge the issue, explain what's being checked, give any immediate practical or safety guidance, and say where and when the next update will appear.
Don't present an unverified claim as fact or promise an outcome you can't guarantee.
No. Check the post's credibility, reach, potential harm, and business impact first.
Sometimes it's better to monitor quietly; responding publicly can draw more attention to a minor issue.
Consider contacting crisis PR firms when an incident involves serious public scrutiny, complex media attention, or a response your team lacks the capacity or experience to manage.
Choose support that fits the incident, and keep internal leaders accountable for decisions and facts.
Review it after a real incident or practice exercise, and whenever key contacts, roles, systems, or communication channels change.
Check regularly that the plan and its contact details are still accessible and current.
Use a trusted internal channel, give managers the same approved briefing, and provide updates at predictable times.
Offer a private way for affected employees to ask questions or get support.
They can report content to the platform or manage content on channels they control, but what's possible depends on the content, who owns the channel, and the applicable rules.
Get specialist advice if the content involves threats, personal information, or possible legal issues.
I am a digital nomad, lover of exploring new places and making friends.
I love to travel and I love the internet. I take pictures of my travels and share them on the internet using Instagram.
Traveler, entrepreneur, and community builder. I share my insights on digital marketing and social media while inspiring you to live your fullest life.
One platform to optimize, manage and track all of your teams. Your new digital workplace is a click away. 🚀
Free for 14 days, no credit card required.
