Scroll Top

Crisis Communications: What to Do in the First Hour

Updated September 2026 · Written and maintained by the Progression Agency strategy team

Crisis communications is managing what an organization says, to whom, and in what order when something has gone wrong. Almost all of the work that determines the outcome happens before the incident — during it there is time to execute a plan, not to build one. This covers the first hour, the order stakeholders should hear from you, the mistakes that extend incidents into prolonged crises, and what to prepare while nobody is under pressure.

The short answerIn the first hour, acknowledge without explaining. Confirming that you are aware, that you are establishing the facts, and when you will next update is a complete and defensible position — and the commitment to a next update is what buys the time to be accurate. Explaining before you know is what produces the correction that becomes the story.

Progression Agency is based in New York City and works with clients across the United States. This page is general communications guidance, not legal advice. Many incidents carry specific legal and regulatory notification duties with fixed deadlines — take qualified legal advice on your own situation.

Crisis communications in short
Almost every incident that becomes a prolonged problem follows one shape: an early statement that was too confident, contradicted by later facts.

What is crisis communications?

Managing what an organization says, to whom, and in what order when something has gone wrong — before, during and after the event.

Most of the work that determines the outcome happens before anything goes wrong. During the event there is rarely time to build anything; there is only time to execute what already exists.

The first hour
Step four is the one most often reversed under media pressure, and it is the omission that does the most lasting damage.

What counts as a crisis?

Anything that threatens people’s safety, the organization’s ability to operate, or its standing with the people it depends on.

The useful test is not how bad it looks but whether it affects those three. A story that generates coverage but changes none of them is a problem rather than a crisis, and the response should be proportionate.

Crisis, issue, or noise?
SituationWhat it usually isResponse scale
Injury or safety incidentCrisisFull response, immediately
Data breach affecting customersCrisisFull response, plus legal duties
Service outage affecting customersCrisis or issueDepends on scale and duration
Regulatory actionCrisisFull response, legal-led
Executive misconduct allegationCrisisFull response, governance-led
A critical article, factually accurateIssueConsidered, not urgent
A viral complaint, isolatedIssue or noiseRespond directly to the person
Competitor criticismUsually noiseRarely worth a public response
Sustained pattern of complaintsIssue becoming crisisFix the cause, then communicate

The bottom row is the one organizations misread most often: a pattern of complaints is not a communications problem, and communicating harder about it makes the eventual crisis worse.

What should you do in the first hour?

Establish the facts, convene the people who can decide, acknowledge that you are aware, and stop speculating internally.

The first hour is about accuracy and acknowledgement rather than explanation. Saying you are aware and are establishing the facts is a complete and defensible position.

Establish the facts — First hour. Confirmed versus assumed, in writing..
Convene a small group — First hour. Large groups cannot decide..
Acknowledge, do not explain — First hour. A complete position..
Reach affected people — First hour. Before any public statement..
Brief staff — First hour. Or they become an uncontrolled channel..
One voice only — First hour. Contradictions get screenshotted..

Establish what is actually known

Separate confirmed fact from assumption, and write both down so the distinction survives contact with pressure.

Convene the decision group

A small named group who can decide. A large group cannot decide quickly and leaks.

Acknowledge without explaining

Confirming awareness costs nothing and buys time. Explaining before you know is what creates a second crisis.

Prioritize people affected

Anybody harmed or at risk comes before media, regulators or commentary.

Some incidents carry reporting obligations with fixed deadlines that run from the moment of discovery.

Brief internally, immediately

Staff who learn from the news become an uncontrolled channel.

Stop uncoordinated responses

One voice. Well-meaning individual replies create contradictions that are quoted later.

What should you say first?

That you are aware, that you are establishing the facts, what you are doing now, and when you will next update.

The commitment to a next update is what buys the time to be accurate. Without it, silence reads as evasion and the vacuum gets filled by other people.

What is the biggest mistake organizations make?

Explaining before they know, or minimizing something that later turns out worse than described.

Almost every case that becomes a prolonged reputational problem follows the same shape: an early statement that was too confident, contradicted by later facts.

The mistakes that turn incidents into prolonged crises
MistakeWhy it happensWhat it causes
Explaining before knowingPressure to say somethingA correction that becomes the story
Minimizing the scaleOptimism, or hopeLoss of credibility when it grows
SilenceFear of saying the wrong thingOthers define the narrative
Blaming a third partyInstinct to deflectReads as evasion
Legal language onlyRisk aversionReads as indifference
Ignoring affected peopleFocus on mediaThe most damaging omission
Contradictory internal messagesNo coordinationScreenshots, later
Declaring it over too earlyReliefA second cycle when it is not
Never acknowledging faultLiability fearPrevents the story ending

The last two rows describe how crises extend rather than end. A story with no resolution keeps being available to anybody who wants to revisit it.

By treating them as the same problem rather than competing ones — and by having that conversation before an incident rather than during it.

Legal counsel protects against liability; communications protects against reputational loss. Both are real, and the tension between them is manageable when it is anticipated and destructive when it is discovered at speed.

Get both in the room from the start

Sequential advice produces statements that satisfy one and damage the other.

Distinguish apology from admission

Expressing regret that something happened is not the same as accepting legal liability, and the distinction is well established.

Understand mandatory disclosures

Some incidents require notification within fixed periods, which constrains the communications timeline.

Agree the pre-approved language in advance

Holding statements approved before an incident save hours at the moment they are needed.

Document decisions as you make them

Both for later review and because the record may matter.

Who needs to hear from you, and in what order?

Anybody harmed, then staff, then customers and partners, then regulators where required, then media and the public.

The order matters more than the wording. People who find out about something affecting them from a news report respond very differently from people told directly.

Who hears from you, in what order
People who learn about something affecting them from a news report respond very differently from people told directly.

What is a holding statement and what should it contain?

A short pre-approved statement confirming awareness, expressing appropriate concern, stating what is being done, and promising a further update.

It should be written before it is needed, approved by legal in advance, and adaptable to several scenarios without rewriting from scratch under pressure.

What should you prepare before anything happens?

A named decision group, contact details that work out of hours, holding statements, a list of who must be told, and an agreed spokesperson.

The preparation is unglamorous and it is almost the entire difference between organizations that handle incidents well and those that do not.

What preparation is worth doing
The top-left cluster is the point: most of what helps most costs least, and is skipped because nothing has gone wrong yet.
Named team, with deputies — Prepare. Not dependent on one person..
Out-of-hours contacts, tested — Prepare. Most incidents start at night..
Approved holding statements — Prepare. Written calmly, in advance..
Stakeholder map — Prepare. Who, by whom, in what order..
Trained spokesperson — Prepare. Before, not during..
Run a scenario once a year — Prepare. An unrehearsed plan is a document..

A named crisis team

With deputies. The plan cannot depend on one person being reachable.

Out-of-hours contact details, tested

Most incidents surface outside working hours, and a list nobody has verified is not a list.

Pre-approved holding statements

Covering the scenarios most plausible for your organization.

A stakeholder map

Who must be told, by whom, in what order, through what channel.

An agreed spokesperson, trained

Media training before an incident, not during one.

Access to your own channels

Somebody reachable who can actually publish to the website and social accounts.

A monitoring arrangement

So you learn about it from your own systems rather than from a journalist.

A scenario exercise, run at least annually

The plan that has never been rehearsed is a document rather than a plan.

Should you respond to everything online?

No. Respond to people affected, correct material factual errors, and leave the rest — responding to everything amplifies things that would otherwise pass.

The judgement is about whether a response reaches people who matter or simply extends the life of a story among people who do not.

When is a public apology the right move?

When you are at fault, when people were harmed, and when you can say what you are changing — all three, not one of them.

An apology without a stated change reads as a technique. A statement of change without acknowledgement reads as evasion. Both together are what actually resolves things.

How do you know when it is over?

When the affected people have been dealt with, the cause has been addressed, and you have said what changed — not when coverage stops.

Coverage stopping and the issue being resolved are different events, and treating the first as the second is how organizations get a second cycle.

What should happen afterwards?

A review of what happened, what the response got right and wrong, and what changes in the plan — conducted honestly rather than defensively.

The review is the only part of crisis communications that reduces the cost of the next one, and it is the part most often skipped because everybody is relieved it ended.

What a post-incident review should cover
QuestionWhy it mattersCommon finding
How did we find out?Detection speed sets everything elseLater than we should have
How long to first statement?The vacuum is filled by othersSlower than intended
Were affected people first?The most damaging omissionNot always
Did internal briefing happen early?Staff are a channel either wayUsually late
Was the holding statement usable?Or rewritten under pressureNeeded adapting
Did legal and comms align?Sequential advice causes damageTension surfaced late
Was anything said that we corrected?Corrections become the storySometimes
What caused it, and is it fixed?Communications cannot fix causesThe real work

The final row is the one that determines whether there is a next time. Communications manages an incident; it does not prevent the next one, and treating it as if it does is the most expensive misunderstanding in this field.

How does this differ for a small organization?

The principles are identical and the resources are not — which means the preparation matters more, not less, because there is no capacity to improvise.

A small organization can do the whole of the useful preparation in an afternoon: three names, a tested contact list, two holding statements and an agreed order.

The minimum viable crisis plan for a small organization
ItemWhat it takesWhy it is enough
Three named people, with deputiesAn hourSomebody can always decide
A tested contact listThirty minutesMost incidents start out of hours
Two holding statementsAn hourCovers most plausible scenarios
An agreed stakeholder orderThirty minutesPrevents the worst omission
One agreed spokespersonA decisionPrevents contradictory voices
Website and social access confirmedFifteen minutesYou can publish when needed
A note of legal contact detailsFifteen minutesSome duties have deadlines
A calendar reminder to review annuallyTwo minutesStops it going stale

Nothing in that table requires an agency or a budget. It requires somebody deciding to spend an afternoon on it while nothing is wrong, which is the part that does not happen.

What role does monitoring play?

Finding out early, from your own systems rather than from a journalist — because detection speed determines how much of the response is yours to shape.

Almost every post-incident review finds that the organization learned later than it should have, and the cost of that delay compounds through everything that follows.

Should you ever say ‘no comment’?

Almost never. It is widely read as confirmation, and it forfeits the opportunity to say something true and neutral instead.

Saying what you can say — that you are aware, that you are looking into it, when you will update — is nearly always available even when the substance is not.

Want a crisis plan before you need one?

We work with clients across the United States on communications planning — the unglamorous version: a named team, tested contacts, approved holding statements, and a stakeholder order agreed while nobody is under pressure.

Talk to Progression Agency

Video: communications practice

A general library on marketing and communications practice. The crisis material is written out in full above.

Getting found in search

AI, AEO and what is changing

Paid media and lead generation

Websites and design

Choosing and working with an agency

Social, content and brand

By industry and by situation

Frequently asked questions

What do crisis communication services cover?
Preparation, live response and recovery, in that order of value. Crisis communication services are worth most before anything happens: a holding statement drafted calmly beats one written at midnight. Live response covers spokesperson support, media handling and stakeholder messaging; recovery covers the reputation work afterwards.
When should I retain a crisis communication agency rather than call one?
Before you need one, if the risk is foreseeable. A crisis communication agency on retainer already knows your business, your spokespeople and your regulatory exposure, which removes the first day of briefing from the response. Calling one cold during an incident costs that day at the worst possible moment.
What do crisis communications services actually provide?
Planning before an incident, and capacity during one — a named team, holding statements, spokesperson preparation and out-of-hours availability. Crisis communications services bought during a crisis deliver far less than the same money spent before one.
What is crisis communications?
Managing what an organization says, to whom, and in what order when something has gone wrong — before, during and after the event.
When does most of the work happen?
Before the incident. During one there is time to execute a plan but rarely time to build one.
What counts as a crisis?
Something threatening people’s safety, the organization’s ability to operate, or its standing with the people it depends on. Coverage alone is not the test.
What is the difference between a crisis and an issue?
An issue is serious but does not threaten those three things. Treating an issue as a crisis amplifies it; treating a crisis as an issue loses control of it.
What should we do in the first hour?
Establish the facts, convene a small decision group, check legal duties, reach anybody affected, brief staff, issue a holding statement, and stop uncoordinated responses.
What should the first statement say?
That you are aware, that you are establishing the facts, what you are doing now, and when you will next update.
Why promise a next update?
Because it buys the time to be accurate. Without it, silence reads as evasion and other people fill the vacuum.
Should we explain what happened immediately?
No. Explaining before you know produces the correction that becomes the story, which is the commonest way an incident becomes a prolonged crisis.
Is silence ever the right choice?
Rarely, and not for long. Silence lets others define the narrative, and it is read as evasion regardless of the reason for it.
Who should hear from us first?
Anybody harmed or at risk, then staff, then affected customers and partners, then regulators where required, then media and the public.
Why brief staff so early?
Because staff who learn from the news become an uncontrolled channel, and because they are asked about it by customers, friends and journalists.
What is a holding statement?
A short, pre-approved statement confirming awareness, expressing appropriate concern, stating what is being done, and promising a further update.
When should holding statements be written?
Before they are needed, and approved by legal in advance, so that nothing has to be drafted from scratch under pressure.
How do we balance legal and communications advice?
By having both in the room from the start. Sequential advice produces statements that satisfy one discipline and damage the other.
Is an apology an admission of liability?
Expressing regret that something happened is not the same as accepting legal liability. Take qualified legal advice on the specific wording for your situation.
When is a public apology right?
When you are at fault, when people were harmed, and when you can say what you are changing — all three together, rather than any one of them.
Why does an apology need a stated change?
Because an apology without one reads as a technique, and a change without acknowledgement reads as evasion. Together they are what actually resolves things.
Should we respond to every critical post?
No. Respond to people affected, correct material factual errors, and leave the rest — responding to everything amplifies items that would otherwise pass.
What are the mistakes that extend a crisis?
Explaining before knowing, minimizing the scale, silence, blaming a third party, legal-only language, ignoring affected people, and declaring it over too early.
Why is minimizing so damaging?
Because if the situation turns out worse than described, every subsequent statement is read through that first inaccuracy.
What should we prepare in advance?
A named crisis team with deputies, tested out-of-hours contacts, pre-approved holding statements, a stakeholder map, a trained spokesperson, and access to your own channels.
Why do contacts need testing?
Because most incidents surface outside working hours, and a contact list nobody has verified is not a contact list.
Do we need a trained spokesperson?
Media training is far more useful before an incident than during one, and the difference shows immediately under questioning.
How often should the plan be rehearsed?
At least annually. A plan that has never been rehearsed is a document rather than a plan.
How do we know when it is over?
When affected people have been dealt with, the cause has been addressed, and you have said what changed — not when coverage stops.
What happens if we declare it over too early?
A second cycle, usually worse, because the premature declaration itself becomes part of the story.
What should the post-incident review cover?
How you found out, how long to first statement, whether affected people came first, whether internal briefing was early, whether anything needed correcting, and what caused it.
Can communications prevent the next crisis?
No. It manages an incident; the cause has to be fixed by the organization. Treating communications as prevention is the most expensive misunderstanding in this field.

Sources and further reading

  1. Google Search Essentials — SEO starter guide
  2. Google: creating helpful, reliable, people-first content
  3. Google: intro to structured data
  4. Google: LocalBusiness structured data
  5. Google: FAQPage structured data
  6. Google: Article structured data
  7. Google: Product structured data
  8. Google: title links in search results
  9. Google: control your snippets
  10. Google: robots.txt introduction
  11. Google: sitemaps overview
  12. Google: consolidate duplicate URLs
  13. Google: redirects and Search
  14. Google: JavaScript SEO basics
  15. Google: multi-regional and multilingual sites
  16. Google Search Central Blog
  17. Google: get started with Search Console
  18. Google: how local search results are determined
  19. Google Business Profile: prohibited and restricted content
  20. Google Business Profile: address and service area guidelines
  21. Google Business Profile: review policy
  22. Google Business Profile: add or edit categories
  23. Google Ads: location targeting settings
  24. Google Ads: about negative keywords
  25. Google Ads: about Quality Score
  26. Google Ads: importing offline conversions
  27. Google Ads: about Smart Bidding
  28. Google Ads: about Performance Max
  29. Google Local Services Ads: eligibility and screening
  30. Google Ads: keyword match types
  31. Google Analytics 4: about conversions
  32. Google Analytics 4: attribution models
  33. US Census Bureau QuickFacts: New Jersey
  34. US Census Bureau: American Community Survey
  35. US Census: Statistics of US Businesses
  36. Bureau of Labor Statistics: New Jersey data
  37. BLS: Occupational Employment and Wage Statistics
  38. NJ Department of Labor: labor market information
  39. New Jersey Business Action Center
  40. US Small Business Administration: New Jersey district
  41. USA.gov: business resources
  42. web.dev: Core Web Vitals explained
  43. web.dev: Largest Contentful Paint
  44. web.dev: Cumulative Layout Shift
  45. web.dev: Interaction to Next Paint
  46. Google PageSpeed Insights
  47. Google Rich Results Test
  48. Google Search Console
  49. W3C Markup Validation Service
  50. Schema.org: LocalBusiness type
  51. Schema.org: Service type
  52. Schema.org: FAQPage type
  53. Schema.org: HowTo type
  54. W3C: WCAG 2.2 quick reference
  55. FTC: CAN-SPAM Act compliance guide
  56. FCC: telemarketing and robocall rules (TCPA)
  57. FTC endorsement guides — reviews and testimonials
  58. FTC: rule on consumer reviews and testimonials
  59. HHS: HIPAA guidance on online tracking technologies
  60. New Jersey Courts: attorney advertising guidelines
  61. New Jersey DCA: construction codes and permits
  62. New Jersey Home Improvement Contractor registration
  63. New Jersey Division of Consumer Affairs
  64. TikTok for Business
  65. TikTok Creative Center
  66. TikTok Ads Help Center
  67. TikTok Community Guidelines
  68. TikTok Terms of Service
  69. TikTok Privacy Policy
  70. TikTok Safety Center
  71. TikTok Transparency Center
  72. TikTok Creator Portal
  73. TikTok Newsroom
  74. TikTok for Developers
  75. TikTok advertising solutions
  76. TikTok Creator Marketplace
  77. TikTok Business Center
  78. TikTok for Business blog
  79. TikTok Creative Center: top ads
  80. TikTok Branded Content policy
  81. TikTok Shop for sellers
  82. Instagram for Business
  83. Instagram for Creators
  84. Instagram Help Center
  85. About Instagram
  86. Meta Business Suite
  87. Meta Business Help Center
  88. Meta Transparency Center
  89. About Meta
  90. Meta: Instagram platform docs
  91. YouTube Creators
  92. YouTube Official Blog
  93. YouTube Shorts help
  94. How YouTube Works
  95. YouTube Studio
  96. LinkedIn Marketing Solutions
  97. LinkedIn Help
  98. Pinterest Business
  99. Pinterest Business Help
  100. Snapchat for Business
  101. X for Business
  102. Reddit communities
  103. Reddit for Business Help
  104. ASCAP
  105. BMI
  106. SESAC
  107. Global Music Rights
  108. PRS for Music (UK)
  109. PPL (UK)
  110. SOCAN (Canada)
  111. APRA AMCOS (Australia)
  112. GEMA (Germany)
  113. SACEM (France)
  114. SIAE (Italy)
  115. JASRAC (Japan)
  116. IFPI
  117. RIAA
  118. National Music Publishers Association
  119. Harry Fox Agency
  120. SoundExchange
  121. Music Reports
  122. Epidemic Sound
  123. Artlist
  124. Soundstripe
  125. PremiumBeat
  126. AudioJungle
  127. Free Music Archive
  128. Creative Commons
  129. Incompetech
  130. FTC: advertising and marketing
  131. FTC: disclosures 101
  132. FTC: endorsement guides
  133. FTC: consumer reviews rule
  134. FTC: advertising FAQs
  135. US Copyright Office
  136. US Copyright Office: DMCA
  137. US Copyright Office: music FAQ
  138. US Copyright Office: fair use FAQ
  139. USPTO: trademarks
  140. UK Advertising Standards Authority
  141. ACCC (Australia)
  142. Competition Bureau Canada
  143. GDPR overview
  144. California Consumer Privacy Act
  145. COPPA
  146. FTC: children’s privacy
  147. W3C Web Accessibility Initiative
  148. W3C: WCAG
  149. W3C: captions
  150. W3C: making audio and video accessible
  151. ADA.gov
  152. WebAIM
  153. Epilepsy Foundation
  154. Pew Research: internet and technology
  155. DataReportal
  156. US Census Bureau
  157. US Bureau of Labor Statistics
  158. Interactive Advertising Bureau
  159. Think with Google
  160. Google Trends
  161. Nielsen insights
  162. Schema.org: VideoObject
  163. Schema.org: SocialMediaPosting
  164. Schema.org: MusicRecording
  165. Schema.org: HowTo
  166. Schema.org: FAQPage
  167. Schema.org: Organization
  168. Google: video best practices
  169. Google: video structured data
  170. CapCut
  171. Adobe Premiere Rush
  172. DaVinci Resolve
  173. Canva
  174. Descript
  175. VEED
  176. Kapwing
  177. Otter.ai
  178. Later
  179. Buffer
  180. Hootsuite
  181. Sprout Social
  182. Google Analytics
  183. Google Search Console
  184. Google Analytics developer docs
  185. GA4: events and conversions
  186. Matomo
  187. Plausible Analytics
  188. Similarweb
  189. UK Information Commissioner’s Office
  190. Office of the Privacy Commissioner of Canada
  191. Australian OAIC
  192. European Data Protection Board
  193. EU data protection
  194. EU Digital Services Act
  195. Ofcom
  196. FCC
  197. AIGA
  198. Nielsen Norman Group
  199. Smashing Magazine
  200. web.dev
  201. MDN: web media
  202. MDN: the video element
  203. ISO 21001 (reference)
  204. Buma/Stemra (Netherlands)
  205. STIM (Sweden)
  206. Teosto (Finland)
  207. Koda (Denmark)
  208. TONO (Norway)
  209. IMRO (Ireland)
  210. SGAE (Spain)
  211. ZAiKS (Poland)
  212. KOMCA (South Korea)
  213. MCSC (China)
  214. CISAC
  215. World Intellectual Property Organization
  216. TikTok: creating videos
  217. TikTok: exploring videos
  218. TikTok: privacy settings
  219. TikTok: growing your audience
  220. TikTok Creator Academy
  221. TikTok Effect House
  222. TikTok for small business
  223. Instagram: Reels help
  224. YouTube: Shorts best practice
  225. How YouTube recommends
  226. Pinterest Predicts
  227. Snapchat for Business
  228. Hootsuite blog
  229. Social Media Examiner
  230. Marketing Week
  231. Adweek

Get a free marketing proposal

Tell us what you are trying to grow and we will come back with a plan, not a pitch deck. Same-day reply on weekdays.

Our website uses cookies from third party services to improve your browsing experience. Read more about this and how you can control cookies by clicking "Privacy Preferences".
Privacy Preferences
When you visit our website, it may store information through your browser from specific services, usually in form of cookies. Here you can change your privacy preferences. Please note that blocking some types of cookies may impact your experience on our website and the services we offer.
Privacy Policy
You have read and agreed to our privacy policy
Required