Protect people and contain the event
Owned by: site incident controllers, fire wardens, and IT and security responders.
Time frame: the first minutes and hours.
Output: people safe, the event contained and the facts passed up to the crisis team.
A crisis management plan decides who takes charge when an event threatens your people, your operations or your reputation, and what they do in the first hour. This free crisis management plan checklist is for operations directors, risk and resilience leads, company secretaries and business continuity managers who build the plan or review it each year. One run is one review of the plan, from the executive sponsor and scope to an approved, distributed and tested version. It covers the crisis management team and deputies, decision rights, crisis levels and activation criteria, the scenario list, the first-hour checklist and decision log, the communication plan with holding statements and spokespeople, the contact tree and an out-of-hours call-out test, the links to your continuity and incident plans, executive approval and a tabletop exercise. Regulator notification tasks appear when the organisation has a duty to notify, and remediation tasks appear when the exercise reveals gaps.
Crisis Management Sits Above Emergency Response and Business Continuity
A crisis is not just a big incident. A fire, a cyber attack or a contaminated batch starts as an incident that local teams handle with their own plans. It becomes a crisis when it threatens people, the whole business or its reputation, and needs decisions that nobody on site has the authority to make: whether to recall a product, close a site, pay for outside help or speak to the press. The crisis management plan sets out who makes those decisions, how quickly they meet, what they say and to whom, and how they hand work to the teams below them.
It sits above the response plans, not instead of them. Site emergency plans protect people in the first minutes, incident plans such as the ransomware response playbook deal with one kind of event, and the business continuity plan keeps prioritised activities running. The crisis management team directs all of them, so the plan is only as good as its hand-offs to each one.
Make the decisions nobody else can
Owned by: the crisis management team, led by a senior executive.
Time frame: from activation until the crisis is closed, often several days.
Output: decisions and their reasons in a log, consistent messages to every audience and priorities for the teams below.
Keep prioritised activities running
Owned by: the business continuity manager and heads of department.
Time frame: from the disruption until normal service resumes.
Output: activities recovered in the order and time the business impact analysis sets.
What the Crisis Management Plan Checklist Covers
Eight phases take one plan from sponsor and scope to an approved, distributed and tested version. A review task appears for annual reviews, regulator notification tasks appear for organisations with a duty to notify, and remediation tasks appear when the tabletop exercise reveals gaps.
- Phase 1
Phase 1: Sponsor, Scope & Review Type
5 tasksEvery due date counts from the plan approval date set on task 1. Task 2 appears only for an annual review, and the answer on task 4 decides whether the regulator tasks in Phase 5 appear.
- Confirm the executive sponsor and the plan owner — the sponsor is the executive who approves the plan; the owner runs this review and keeps the plan current between reviews
- Review last year’s plan, activations and open actions — real crises and near misses since the last review, the last exercise report and any action still open
- Write down what counts as a crisis for this organisation — an event that threatens people, operations, finances, reputation or the licence to operate, and needs decisions above normal management
- Set the scope of the plan — the sites, subsidiaries, countries and business units it covers, and what is left to local or departmental plans
- Agree the review timetable with the sponsor — dates for the drafting workshops, the approval meeting and the tabletop exercise, booked in diaries now
- Phase 2
Phase 2: Crisis Management Team & Decision Rights
5 tasks- Name the crisis management team by role — crisis lead, operations, communications, HR, legal, finance, IT and a loggist, each with a named holder
- Name a trained deputy for every role — a role with one holder fails when that person is on leave, unreachable or caught up in the crisis
- Write down the crisis team’s decision rights — what it may decide without the board, such as spending, closing a site, recalling a product or issuing a statement, and what stays with the board
- Agree who can activate the plan — any team member, and the duty manager out of hours; it is better to stand the team down than to call it late
- Set up the crisis room and a virtual fallback — a primary room, a backup away from the main site and a standing conference bridge, in case the site is lost
- Phase 3
Phase 3: Crisis Levels, Activation & Scenarios
6 tasksStart from the example crisis levels below. Written activation criteria mean nobody has to wonder whether an event is serious enough to call the team.
- Define the crisis levels — for example Level 1 incident handled locally, Level 2 serious incident with senior oversight and Level 3 crisis with the crisis team activated
- Set the escalation triggers between levels — named events that move an incident up a level, such as a hospital admission, a media enquiry, a regulator’s call or a site closed for more than a shift
- List the scenarios the plan must cover — cyber attack, product recall, serious injury or death, loss of a site, leadership misconduct, key supplier failure and severe weather, plus any specific to your sector
- Write a one-page card for each scenario — the first signs, the first decisions, who leads, who must hear first and which other plan it calls on
- Check the scenarios against the risk register — every high risk on the register should have a scenario, or a recorded reason why it does not
- List the specialist contacts each scenario needs — insurer and broker, external counsel, forensic or recall partners, a crisis communications adviser and the emergency services liaison
- Phase 4
Phase 4: First-Hour Checklist & Decision Log
5 tasks- Write the first-hour checklist — confirm the facts and that people are safe, call the crisis team, open the log, agree the first holding statement and set the time of the next update
- Set the crisis team’s standing agenda — situation, people, operations, stakeholders and communications, decisions needed, actions and the time of the next meeting
- Set up the decision and action log — time, decision, who made it, the reasons and the information available, plus each action with an owner; name at least two trained loggists
- Prepare the crisis grab pack — the plan, contact lists, log sheets and holding statements, kept printed and offline on phones in case systems are down
- Plan for a crisis that lasts days — shift rotas for the team, handovers between shifts, and rest and welfare for the people on it
- Phase 5
Phase 5: Communication Plan & Holding Statements
8 tasksTasks 7 and 8 appear only when Phase 1 records that the organisation is regulated or could have a duty to notify a regulator.
- List every audience, who owns it and how to reach it — employees and their families, customers, suppliers, regulators, investors and lenders, neighbours, the media and social media
- Draft a holding statement for each scenario — pre-approved wording with blanks to fill in, ready to issue within the first hour while the facts are still emerging
- Agree who signs off statements, in hours and out of hours — one approver and a deputy, with a target time, so a statement is not held up waiting for a signature
- Name and train the spokespeople — a main spokesperson and a deputy, with media training and talking points; everyone else refers enquiries to them
- Plan social media monitoring and response — who watches which channels, when to reply, and how to pause scheduled posts and adverts
- Set up enquiry handling — scripts and a list of frequently asked questions for reception, the switchboard and customer service, so every caller gets the same answer
- Map the regulator notification duty for each scenario — which regulator, what triggers the duty, the deadline and who notifies
- Prepare a notification template for each regulator — the information each regulator asks for, the contact route and an out-of-hours number, ready to complete
- Phase 6
Phase 6: Contact Tree & Call-Out Test
5 tasksRun the call-out test unannounced and outside working hours. A contact list checked by email in office hours has not been tested.
- Build the crisis team contact tree — work and personal mobile numbers for every member and deputy, who calls whom, and a fallback when someone does not answer
- Add the external contacts — insurer, key customers and suppliers, landlord, utilities, regulators and the specialist contacts from Phase 3
- Check the staff alert method — a text alert or mass notification tool with current numbers and message templates loaded, or a phone cascade
- Run an out-of-hours call-out test — unannounced, outside working hours: record who answered, how long each took and who could not be reached
- Fix the gaps the call-out test found — wrong numbers, missing deputies, unanswered phones and steps in the tree that did not work
- Phase 7
Phase 7: Plan Links & Executive Approval
5 tasksThe executive sponsor approves the plan. Nothing in Phase 8 can be completed until they have recorded a decision.
- Check the hand-off to the business continuity plan — the crisis team sets priorities and makes decisions; continuity teams recover activities in the order the business impact analysis sets
- Check the hand-off from IT and cyber incident plans — when an IT or security incident is escalated to the crisis team, and who briefs it
- Check the hand-off from site emergency plans — evacuation, emergency action and fire plans, and the point at which the site incident controller hands over to the crisis team
- Compile the plan and give it a version number — with the change log, the owner, the approval date and the next review date on the front page
- Executive sponsor approves the plan — the decision and any conditions, recorded against the version number
- Phase 8
Phase 8: Distribution, Exercise & Lessons Learned
8 tasksTasks 6 and 7 appear only when the exercise reveals gaps that need changes to the plan.
- Distribute the approved plan — to the crisis team, the deputies and the board, in the grab packs and offline; withdraw old copies
- Brief all staff on their part in a crisis — how they will be told, where to find updates, and to pass media and social media questions to the spokespeople
- Plan the tabletop exercise — a scenario from the list, three to five objectives, a facilitator, observers and timed injects
- Run the tabletop with the crisis team and deputies — test activation, the first hour, the decision log, statement approval and the hand-offs to other plans
- Hold the debrief and write the exercise report — what worked, where the plan was unclear or wrong, and each objective marked met, partly met or not met
- Raise a remediation action for each gap — one owner, one due date and the section of the plan it changes
- Update the plan and have the sponsor approve the changes — a new version number, the change log updated and the new version redistributed
- Set the next review date and the review triggers — the next annual review, and the events that start one early, such as a real activation, a major restructure, a new site or a change of key people
Example Crisis Levels and When to Activate the Team
Activation criteria only work if they are written down before anything happens. The levels below are an example to adapt in Phase 3, not a standard. Replace the examples with events from your own risk register, and agree with the crisis team how quickly it meets at each level.
| Level | What it looks like | Who leads | Crisis team |
|---|---|---|---|
| Level 1: Incident | A problem handled within normal management, such as a minor injury, a short IT outage or a single customer complaint | Site or department manager | Not activated. The crisis lead is told if it could grow |
| Level 2: Serious incident | Wider harm or attention is possible: a hospital admission, a site closed for a shift, a supplier failure that delays orders or a first media enquiry | Senior manager on duty, with the crisis lead on standby | On standby. Members are told and ready to meet |
| Level 3: Crisis | A threat to people, the business or its reputation that needs decisions above normal authority: a death or several injuries, a product recall, a cyber attack that stops operations, the loss of a site or misconduct by a senior leader | Crisis lead | Activated. Meets within the time the plan sets, in person or by phone |
What the communication plan needs. Ready.gov’s guidance on crisis communications plans says contact details for each audience should be compiled in advance, kept up to date and secured; that the spokesperson should be chosen in advance and prepared with talking points; and that messages can be pre-scripted as templates with blanks, approved by the management team and stored where they can be reached remotely. It also suggests giving the staff who answer enquiries scripts and a list of frequently asked questions so they answer consistently. Phase 5 turns each point into a task.
Some scenarios start a legal clock. In Great Britain, the HSE’s RIDDOR guidance says the responsible person must notify the enforcing authority without delay of a death, a specified injury to a worker or a dangerous occurrence, and that the report must be received within 10 days. In the US, 29 CFR 1904.39 requires employers to report a work-related death to OSHA within 8 hours, and an in-patient hospitalisation, amputation or loss of an eye within 24 hours. For food businesses in England, Wales and Northern Ireland, the Food Standards Agency says food you have supplied and believe is harmful should be withdrawn or recalled immediately and your local authority or port health authority told, and the FSA incidents team told if unsafe food has reached consumers. The FSA also publishes an example food incident key decision log. Map the duties that apply to you in Phase 5 and confirm them with your advisers.
Why Run Your Crisis Management Plan in CheckFlow?
The review happens every year, not after the crisis
A yearly recurring schedule starts the review on the same date each year. Due dates count back from the approval date entered on the first task, so the drafting, the call-out test and the approval meeting land in order, and the exercise and next review count on from it.
The sponsor’s approval is a real gate
The executive sponsor chosen on the first task is the only person who can complete the approval step, and nothing in the distribution and exercise phase can be completed until they record a decision. Changes the exercise forces come back to the same person for approval.
Evidence the board and insurers can follow
Call-out test results, the exercise report, the holding statements and each plan version are attached to the tasks that produced them, with names and dates. The Reports Grid lists every past review, so you can show when the plan was last approved and tested.
CheckFlow does not send crisis alerts or replace a mass notification tool. It runs the planning and review around them: who owns each part of the plan, by when, with what evidence, and who approved it. See how a running checklist works.
The crisis plan directs the plans below it. The Business Continuity Plan Testing Checklist exercises the recovery of prioritised activities, and the Incident Response Tabletop Exercise Checklist rehearses a cyber incident in depth. A cyber scenario hands over to the Ransomware Response Checklist and the Data Breach Response Checklist, and the Fire Drill & Evacuation Checklist tests getting people out of the building safely.
Related Operations & Facilities Templates
Information TechnologyLive demo
Business Continuity Plan Testing Checklist
CybersecurityLive demo
Incident Response Tabletop Exercise Checklist
Operations & Facilities ManagementLive demo
Operational Risk Assessment Checklist
Operations & Facilities ManagementLive demo
Emergency Action Plan Checklist
Operations & Facilities ManagementLive demo
Fire Drill & Evacuation Checklist
AI generator
Didn’t find what you need? Describe it.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
Frequently Asked Questions
What is a crisis management plan?
It is the document that says who takes charge when an event threatens the organisation’s people, operations, finances or reputation, and how they work. It names the crisis management team and their deputies, sets out what they may decide, defines when the team is activated, and holds the first-hour checklist, the communication plan, holding statements and the contact tree. It does not replace site emergency plans, incident response plans or the business continuity plan. It directs them, so it also records how each one hands information and decisions to the crisis team.
What should a crisis management plan include?
At minimum: an executive sponsor and owner, the scope, the crisis management team by role with a deputy for each, their decision rights, crisis levels and activation criteria, the scenarios it covers, a first-hour checklist, a decision and action log, and a communication plan with audiences, holding statements, spokespeople and an approval route. Add a tested contact tree, the links to the continuity and incident plans, a version number and a review date, plus regulator notification duties where a scenario carries one. Treat a plan that has never been exercised as a draft.
What is the difference between crisis management and business continuity?
Business continuity keeps the organisation’s prioritised activities running, or recovers them, in the order and time the business impact analysis sets. Crisis management is the senior decision-making layer above it: the crisis team sets priorities, speaks for the organisation and deals with the threat to its reputation and to the people affected. After a site fire, the continuity plan moves production elsewhere while the crisis team decides what to tell customers, staff and the press. The Business Continuity Plan Testing Checklist exercises the continuity side.
Who should be on a crisis management team?
A small group of senior people, named by role rather than by person: a crisis lead with the authority to decide, and leads for operations, communications, HR, legal, finance and IT, plus a loggist who records decisions. Add specialists for a scenario, such as quality and technical leads for a product recall. Give every role a trained deputy, because the main holder may be on leave, unreachable or directly affected. Keep the core team small enough to decide quickly, and call others in as needed.
What is a holding statement in a crisis?
It is a short first statement issued while the facts are still emerging. It confirms in general terms what has happened, says what the organisation is doing, shows concern for anyone affected and says when the next update will come. It avoids speculation and blame. Ready.gov’s crisis communications guidance suggests pre-scripting messages as templates with blanks to fill in, approved by management in advance, so this checklist drafts one for each scenario and agrees who can approve it out of hours.
How often should a crisis management plan be reviewed and tested?
A yearly review is the usual baseline, with another after a real activation, a major restructure, a new site, an acquisition or a change of key people. Test the contact tree with an unannounced out-of-hours call-out, and run an exercise, usually a tabletop in which the crisis team talks through a scenario. Every exercise should end with a report and actions with owners. This template runs the call-out test before the plan is approved and the tabletop after it, so the approved version is the one that gets tested.
What should happen in the first hour of a crisis?
Confirm the facts and that people are safe, then call the crisis team together and open the decision log. Agree the first priorities, issue a holding statement to the audiences who need to hear first, usually staff and anyone directly affected, and check whether a regulator must be told. Set the time of the next meeting and the next update before the team breaks. Writing these steps down as a first-hour checklist means whoever is on duty does the same things in the same order.
Is CheckFlow free for this template?
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
Keep Your Crisis Plan Approved, Tested and Ready to Use
Free trial — no credit card required.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting