Crisis Management

Crisis management is a fascinating challenge for directors and one of the most important skills to bring to the board table.

The event I attended on this very topic last week was fantastic!

When asked the question, “How would you define Crisis Management?” General consensus was that it very much depends on the type of board you sit on. However, the common theme was that it was a business-stopping event, something that requires an institutional response because it threatens human health, reputation, strategic enablement, and/or financial security.

Mindset and approach:

• Be a duck, not a chicken - stay poised, focused, and purposeful, even amid turbulence

• Be revealing rather than concealing. Communication plans are critically important. Internally as well as externally.

• Don’t waste a crisis! Every crisis is an opportunity to reframe what you’re doing for the future of the business and a burning platform for change

• Follow your instincts and don’t be stuck in paralysis; sometimes, you just have to act.

• Ensure your response to any crisis is based on values

• Stay in your lane.

• And don’t forget, this too shall pass!

Prevention

• Effective crisis management begins long before a crisis emerges.

• Conduct regular and robust risk assessments to anticipate what could go wrong, including likely scenarios and improbable, high-impact ones.

• Ensure that risks are critically evaluated, particularly through the Audit and Risk Committee lens, with a focus on strategic, reputational, and operational threats.

• Embed a culture where issues can be raised early. Whistleblowing channels, site visits, and informal “boots-on-the-ground” insights provide invaluable early warnings.

• Ensure your risk management policies are not only in place but understood and lived across all levels of the organisation.

• Prioritise a strong, trusting relationship between the Board and CEO — one that allows for honest dialogue and shared accountability when the pressure is on.

Preparation

• Preparation is your best insurance policy. In today’s environment, adequate isn’t enough — crisis readiness must be exceptional.

• Build and maintain clear, tested frameworks for risk escalation, decision-making, and crisis response (including a decision matrix and up-to-date risk register).

• Ensure that the right people are in the right roles and that they are well-prepared to lead under pressure.

• Develop and rehearse incident response and business continuity plans. Conduct regular desktop exercises and simulations to stress-test both systems and people.

• Ensure communication protocols - both internal and external - are clear, practised, and aligned with organisational values.

• Establish relationships with external advisors ahead of time (e.g., PR firms, media monitoring providers).

• Store critical plans and materials in formats accessible without power or connectivity. A small detail can make or break a response.

In the thick of it

• When the pressure hits, leadership is tested. The ability to respond with clarity, care and cohesion is what defines success.

• Execute the communications plan — with empathy, urgency and accuracy. Prioritise those most affected (employees and customers) before the media cycle.

• Designate clear spokespeople and avoid duplication or confusion. Determine whether the CEO or Chair will lead public communications and ensure scripts are approved accordingly.

• Centralise questions to the CEO through a nominated leader (often the Chair or Subcommittee Chair) to protect operational bandwidth.

• Remove unnecessary voices from the response table - ensure only those with direct responsibility and expertise are present.

• Enable real-time collaboration between the CEO and Chair — this relationship becomes the lynchpin of effective board governance during a crisis.

• Maintain detailed documentation of key decisions, timelines, and communications. This supports both transparency and future evaluation.

• Most importantly, lead with values. Apologise when needed. Communicate with care. And don’t forget to look after yourself and your people.

Post-Crisis

• The value of a crisis is only realised when lessons are learned, shared, and acted upon.

• Conduct a thorough post-event review involving key stakeholders.

• Commission independent analysis where necessary — particularly in the case of cyber events, data breaches or complex incidents.

• Translate insights into action. Track outcomes in the enterprise risk register and governance frameworks, not in a forgotten post-mortem document.

• Acknowledge the human impact. Crises create invisible trauma for employees, from counsellor fatigue to burnout in technical teams. Ongoing care is part of the responsibility.

• Use the moment to evolve — whether that’s your operating rhythm, your board agenda, or your organisational culture. Don’t waste the crisis!

Thank you to all who shared as part of the event, especially the exceptionally talented panel!