Every business will experience a crisis they didn't see coming.

Not might. Will.

Lose a key employee with no notice, a major safety incident, a cyberattack, a technology failure, fire, flood, a lawsuit, maybe a financial crisis. It's like the stack of chance cards in the middle of a Monopoly board.

Most businesses know it's a possibility, but finding the time to plan and prevent these things never feels like a priority. That is, until it's too late.

The biggest value of a written incident response plan is that it's created when you have the luxury of time, when you can think through the options and plan out what should happen while you can still think rationally. A written plan gives you a roadmap when you're in the middle of the crisis and rational thought is not in the cards.

This isn't a 30-page disaster recovery plan that gathers dust somewhere. It's a one or two page plan that everyone knows about and can pull up the moment a crisis starts.

How do you start? Sit down with your leadership team and think through the scenarios you could face. What are the functions in your business you can't afford to lose? Pick the top three and create a plan for each. Make sure everyone has a copy.

What goes into an incident response plan?

  1. Who does what? Who talks to clients? Who talks to staff? Who owns the decision-making? Make sure there's contact information for all key people, internal and external. Lawyers, insurance, vendors. No one should have to look up a phone number. Ambiguity under pressure is expensive.
  2. How do you communicate? Clients, staff, vendors, legal, the public, press. What do you say, and when? You want someone dedicated to this so the people handling the crisis can stay focused on it. You can even write scripts or templates in advance. Silence is never the answer.
  3. Know how you recover. What does "normal" look like? What stepping stones start moving you toward it? Prioritize the things that get you functional as quickly as possible.
  4. Timeline. What to do and when. This is your path to recovery. How do you respond, who does what, when do you communicate, when do you escalate, how long do you spend on plan A before falling back to plan B? Contain first, stabilize second, full recovery third.

The businesses that handle crises well aren't the ones with the most resources. They're the ones who thought it through before they had to. A plan can be the difference between one bad day and a bad month, or failing to survive at all.

Now the most important step. Take each incident you've planned for and figure out what you can do in advance to prevent it, or at least soften the blow. Preventing a crisis is far less costly than responding to one.