A crisis is not just a bad event; it is a bad event with an audience and a clock. People affected by it form their judgement of you in hours, not weeks, and they judge how you respond at least as harshly as what went wrong. This explainer is about the second part: not how to prevent a crisis, but what to say once one has arrived, and how to say it to people who are frightened, grieving, angry, or about to lose their job.

The quick version

  • In a crisis, speak early even when you don't have all the facts. Your first job is to give people the safety and care information they need now, not to explain or defend yourself.
  • Match your response to how responsible people think you are. The more the fault looks like yours, the more your words have to centre the victims and offer real fixes, denial and spin only work when you genuinely had nothing to do with it.
  • Sensitive news (a death, a layoff, a diagnosis) follows the same rule in miniature: lead with the human, be plain, and don't bury the point inside reassurance.
  • The limit: communication shapes perception, it doesn't substitute for fixing the thing. A flawless statement on top of a real failure buys you days, not trust.

The idea in depth

The most useful academic map of crisis response is W. Timothy Coombs's Situational Crisis Communication Theory (SCCT), set out in "Protecting Organization Reputations During a Crisis" (Corporate Reputation Review, 2007). Its central claim is unfashionably specific: the right thing to say depends on how much responsibility your audience attributes to you. Coombs sorts crises into three clusters, victim (a natural disaster, sabotage, a rumour: you were hit, low responsibility), accidental (a technical fault, an unforeseen failure: medium responsibility), and intentional/preventable (you cut a corner, you knew and didn't act: high responsibility). The greater the attributed responsibility, the more your response must move from defending yourself toward accommodating the people harmed.

SCCT then lines responses up from defensive to accommodative: deny (it isn't us, or there's no crisis), diminish (it's not as bad as it looks, or it wasn't in our control), and rebuild (apologise, compensate, fix). So the move is to diagnose honestly before you draft: if a hacker sabotaged you and customers know it, an over-apology can read as an admission you don't owe; but if you shipped the bug, "we take this seriously" with no ownership reads as evasive, and evasion, in a high-responsibility crisis, is what turns a story into a scandal.

Underneath all three sits a non-negotiable base layer Coombs calls instructing and adjusting information, telling people what to do to stay safe, and acknowledging their distress, which comes before any reputation management. This is the part leaders skip when they let legal write the first draft. So your opening words should address the people affected, not the watching market.

People judge how you respond to a crisis at least as harshly as the crisis itself.

Why speed and honesty beat spin

A second framework, William Benoit's Image Repair Theory (Accounts, Excuses, and Apologies, 1995; summarised in his image restoration work), catalogues the five things any accused party can say: denial, evasion of responsibility, reducing offensiveness (including bolstering your good record), corrective action, and mortification (a genuine apology). Benoit's repeated finding across cases is that the two strategies which actually rebuild trust are the last two, corrective action and mortification, and that they work best together: "here is what we are doing to fix it" carries far more than "we're sorry" alone. So the rule is simple to state and hard to keep: never apologise without a fix, and never announce a fix without acknowledging the harm.

flowchart TD
  A(["Crisis hits"]) --> B{"How responsible
do people think we are?"}
  B -->|"Victim
(hit, sabotaged, rumour)"| C(["Deny / clarify
+ care for those affected"])
  B -->|"Accidental
(technical fault)"| D(["Diminish carefully
+ corrective action"])
  B -->|"Preventable
(we cut a corner)"| E(["Rebuild: own it,
apologise, fix, compensate"])
  C --> F(["Always first:
safety info + acknowledge distress"])
  D --> F
  E --> F
Coombs's SCCT, simplified: match the posture to attributed responsibility, but lead every posture with care and instruction. Leaders Loop

Speed matters because of how attribution forms. In the absence of your account, other people supply one, journalists, employees, customers on social platforms, and first impressions are sticky. This is why crisis playbooks favour a fast holding statement ("here is what we know, here is what we're doing, here is when we'll update you") over a slow, perfect one. The discipline of structured communication earns its keep here: answer first, then support, so a frightened reader gets the point before the caveats.

An honest limitation. SCCT is evidence-based and largely built from controlled experiments measuring reputation, which is a real strength, but lab studies of reputation aren't the same as a live crisis with regulators, lawyers and grieving families in the room. The theory tells you the direction (more responsibility → more accommodation), not the exact wording, and it can't override legal constraints on admitting liability. Treat it as a compass, not a script. And note the harder truth: no framework repairs trust if the underlying failure is real and unfixed. Communication buys time to fix the thing; it is not the fix.

The sensitive-conversation version

Most leaders will never run a corporate crisis, but all of them will one day deliver news that lands like one for the person hearing it: a redundancy, a failed promotion, a bereavement in the team, a serious performance problem. The same logic scales down. Lead with the headline, plainly and early, research and clinical guidance on breaking bad news (the widely taught SPIKES protocol from oncology, Baile et al., The Oncologist, 2000) consistently warns against the long, cushioning preamble that leaves the listener bracing. Acknowledge the emotion before you move to logistics. Don't dilute a clear message with so much reassurance that the person walks out unsure what they were actually told. Decide the one sentence they must leave with, say it in the first minute, then stop talking and let them react.

A worked example

Take a fictional SaaS company, call it Larkfield, that discovers customer email addresses and hashed passwords were exposed in a breach. (Illustrative scenario; not a real incident.) The engineering team wants to wait until the forensic report is complete in ten days. The instinct is understandable and wrong.

Run it through the frameworks. Responsibility cluster: this sits between accidental and preventable, a third party attacked them, but the attack exploited a patch Larkfield had delayed. Attribution will not be generous. So the base layer comes first: within hours, an email tells affected users exactly what to do (reset passwords, watch for phishing) and acknowledges the worry it causes, instructing and adjusting information before anything about Larkfield's reputation. The holding statement says what is known, admits what isn't, and commits to a next update by a named time.

flowchart LR
  A(["Hour 1
Tell users how to stay safe"]) --> B(["Hour 4
Holding statement:
what we know + when we'll update"])
  B --> C(["Day 1–3
Own the delayed patch,
apologise, name the fix"])
  C --> D(["Week 1+
Corrective action shipped,
follow-through reported"])
The order of operations in a breach: care first, candour second, correction third, each on a clock. Leaders Loop

As the picture firms up, Larkfield moves to rebuild: it names the delayed patch rather than hiding behind "a sophisticated attack," apologises specifically, and announces the corrective action, patch shipped, audit commissioned, process changed so it can't recur. Pairing apology with corrective action, as Benoit's work suggests, is what converts an angry customer base into a merely disappointed one. Contrast the alternative: ten days of silence, a leaked version of events, and a statement that opens with how seriously Larkfield takes security, the response that reliably escalates a contained problem into a reputational one.

Frequently asked questions

Should I apologise if our lawyers say it admits liability?

This is a real tension, not a false one, and the answer is jurisdiction-dependent, check with qualified counsel rather than treating any rule of thumb as settled. The practical path most crisis advisers take is to separate empathy from admission: you can acknowledge harm and express genuine regret for what people are going through without conceding legal fault. "We are devastated that this happened and are doing X, Y, Z" is not the same sentence as "we were negligent." Many places also have apology laws that protect expressions of sympathy.

How fast is fast enough?

Fast enough that your account is the first credible one people hear. In practice that means a holding statement within hours, not days, even one that mainly says "we're aware, here's what to do to stay safe, and we'll update you by [time]." Silence is itself a message, and the message it sends is that you're either hiding something or not in control.

Isn't all this just spin with better PR?

It's the opposite, and the distinction is the whole point. Spin tries to make a bad thing look less bad through wording; the frameworks here push you toward owning what's yours and fixing it, because the evidence is that accommodation, not minimisation, is what rebuilds trust when responsibility is real. The 1982 Tylenol recall is the canonical example: Johnson & Johnson pulled 31 million bottles at a cost reported around $100 million despite advice not to, and recovered its market within a year (TIME). That wasn't clever messaging; it was a costly fix that the messaging simply told the truth about.

What if I genuinely don't know what happened yet?

Say exactly that. "Here is what we know, here is what we don't yet know, here is what we're doing to find out, and here is when we'll come back to you" is a complete and trustworthy statement. The mistake is implying certainty you don't have, then having to walk it back, every correction costs more credibility than the honest "we don't know yet" would have.

Does this work for internal crises, like a layoff?

Yes, with the same shape. Tell people the decision plainly and early, acknowledge what it costs them, be specific about support, and don't outsource the message to a vague all-hands euphemism. The failure mode internally is identical to the external one: cushioning and delay that read as evasion and leave people to fill the silence with worse stories than the truth.

Related in the Toolkit

A crisis is where two skills you build in calmer times get tested at once: putting the answer first under pressure (structured communication) and keeping your own composure while you do it (emotional self-regulation).

Where to go next