Why Your Crisis Communication Plan Probably Will Not Work When You Need It Most

Every organisation of any size will tell you they have a crisis communication plan. It is usually a document created several years ago, reviewed once or twice, and stored in a shared drive that half the team cannot find under pressure. The uncomfortable truth is that most crisis communication plans fail not because they are poorly written, but because they have never been tested in conditions that resemble a real crisis.

The Gap Between Planning and Performance

There is a significant difference between having a plan and being able to execute it. Crisis communications demand speed, clarity, and coordination across multiple teams and stakeholders, often simultaneously. When organisations run tabletop exercises or live simulations, the cracks appear quickly. Designated spokespeople freeze. Approval chains create bottleneck delays. Pre-drafted holding statements turn out to be too generic to be useful.

The FCA and PRA operational resilience framework, which reached its compliance deadline in March 2025, highlighted this gap for many financial services firms. Organisations that had invested in documentation but not in rehearsal found themselves scrambling to demonstrate genuine capability rather than paper compliance.

Common Failures in Crisis Communications

Unclear escalation triggers. Many plans describe what to do once a crisis has been declared, but fail to define the specific conditions under which a situation becomes a crisis. This ambiguity causes delays as people wait for someone else to make the call.

Over-reliance on a single spokesperson. If your plan names one individual as the primary media contact, what happens when that person is unavailable, on leave, or part of the problem? Resilient plans build depth, not dependency.

Neglecting internal communications. Organisations often focus entirely on external messaging, forgetting that employees, contractors, and partners need timely, accurate information too. Internal confusion amplifies external reputational damage.

Static contact lists. Crisis contact lists go stale faster than most teams realise. People change roles, phone numbers update, and new stakeholders join the organisation. If you have not validated your contact list in the past three months, assume it contains errors.

No social media protocol. Social media moves faster than any approval chain. Organisations without a clear protocol for monitoring, responding to, and escalating social media activity during a crisis will find themselves reacting rather than leading the narrative.

What Good Looks Like

Effective crisis communication is built on three foundations. First, it requires regular exercising. Not annual reviews, but quarterly practice sessions that put real people under realistic pressure. Second, it demands pre-authorised decision-making frameworks that allow designated individuals to act without waiting for committee approval. Third, it needs integration with broader operational resilience and business continuity arrangements.

Organisations that performed well during the 2025 compliance period were those that had already embedded crisis communications into their wider resilience testing programme. They did not treat communications as a separate workstream but as an integral part of incident response.

Practical Steps You Can Take Now

• Run a short-notice tabletop exercise focused specifically on communications, not operational response
• Validate your crisis contact list and test it with a no-notice call-out
• Review your holding statements and update them to reflect current risks and organisational context
• Identify and train at least three potential spokespeople, not just one
• Establish a clear social media monitoring and response protocol with pre-agreed escalation triggers
• Brief your senior leadership team on their specific roles during a communications crisis

Moving Beyond Compliance

The regulatory landscape in 2026 continues to demand demonstrable resilience capability. With DORA now in its second year of application across the financial sector and the Terrorism Protection of Premises Act 2025 driving new security obligations for venue and event operators, the ability to communicate effectively during a crisis is no longer optional. It is a regulatory expectation and a business necessity.

Organisations that invest in building genuine crisis communication capability, rather than simply maintaining a document, will find themselves better positioned to protect their reputation, maintain stakeholder confidence, and recover more quickly when things go wrong.

If you would like to discuss how Oakwood can help your organisation build and test effective crisis communication arrangements, please get in touch through our contact page or explore our range of training courses at Oakwood Risk Training.