When a Crisis Hits, Preparation, Not Panic, Protects a Hard-Earned Reputation

The headlines are full of dramatic crises, but often the first signal of a crisis rarely presents that clearly. It might be a forwarded headline between coworkers. A late-night text asking, “Are we aware of this?” A quiet internal message that suddenly accelerates beyond a single group. By the time many organizations recognize they’re in a reputational moment, the outside world has already formed an opinion.

When Silicon Valley Bank began to unravel in March 2023, many peer institutions first realized the severity not through official statements, but investor texts and screenshots circulating on Twitter and Slack. By the time leadership teams convened internally, customers and markets had already reached their own conclusions. The speed of perception and speculation outpaced the formal response.

Reputation can no longer be treated as an abstract concept or a “soft” asset. It influences enterprise value, employee trust, regulatory confidence, and an organization’s margin for error when something goes wrong (think of adding reputation credits to the bank of goodwill with key stakeholders). When reputations falter, it shows up in market volatility, talent retention challenges, customer behavior, and an increased length of recovery from the crisis event.

Most organizations understand their financial and operational risks reasonably well. They plan for them, evaluate them when making key business decisions, and build them into their structure and response systems. Reputational risk, however, is often treated as secondary – an outcome of managing other risks rather than as a distinct discipline requiring its own inputs and planning.

Where Should You Start?

A useful way to think about preparedness is through the lens of likelihood and impact. Leaders naturally focus on scenarios that are both likely and disruptive – they’re predictable and familiar. That can be a dangerous assumption, especially when paired with an ill-prepared organization. Some of the most damaging crises come from events that once seemed improbable – until they weren’t.

Few organizations planned for a world-stopping global pandemic pre-2019, or cascading supply-chain failures, or geopolitical reshuffling at today’s scale, or the speed at which misinformation can now spread and take root. In December 2007, mass shootings were still fairly rare. When our client Von Maur faced one at its Omaha store, the response had to be mobilized without the benefit of a preplanned scenario.

The problem isn’t necessarily failing to predict the crisis. The problem is an organization failing to set up a quick response to unpredictable events. Preparedness isn’t always about predicting the next crisis correctly. It’s about understanding risk (all forms of it) well enough that uncertainty doesn’t lead to paralysis. Building the organizational “muscle memory” is necessary to respond to a crisis effectively regardless of the issue or who receives the first call. Setting up a plan that provides a baseline or a common starting point is an achievable place to start.

To do this, start by answering core questions, such as:

1. Have we identified our most likely and highest-impact crisis scenarios (operational, reputational, regulatory, people, etc.)?
2. How often do we reassess risks based on changes in our business, geography, leadership, or stakeholder expectations?
3. How would we know something is going wrong before it becomes public (where do early warning signs usually appear)? Who’s monitoring for those signals and who’s empowered or trained to escalate it?
4. Do we encourage people to raise concerns, or is there a culture of punishing bearers of bad news?
5. Who has the authority to declare a crisis and make first‑hour decisions? What if senior leaders aren’t available?
6. If a crisis hit tonight, do we know exactly who would be involved? Could a first-day employee be able to follow the plan in a way the organization expects?
7. Who are our most critical stakeholders, and who needs to hear from us first?
8. Have we experienced making decisions with imperfect or incomplete information?
9. Do our internal messages match what external audiences hear?
10. Where have we historically struggled to live up to our commitments?

Having a plan that can address these questions and initial processes to action the answers helps buy time. But too much rigidity can also be its own risk (see the proverbial playbook on a shelf gathering dust). Preparedness is as much about mindset as it about process. For example, prepared organizations understand who needs to be involved, but they’re also prepared to adapt when circumstances change or when the “right” people are unavailable.

Prepared organizations are ready to respond and address questions like these below, quickly and with imperfect or incomplete information available:

1. Is anyone at physical, financial, or emotional risk? If “safety is our top priority,” make sure it truly is.
2. What do we know for certain right now? Early in a crisis, information is at a premium and your task is to balance that with unrealistic expectations for details from your stakeholders.
3. What don’t we know yet? What critical pieces of information are needed, and who can or will be able to get them?
4. Who’s affected, or potentially affected, and what’s the potential impact? Having a clear picture of your stakeholder map can speed this up as can pre-determining the right prioritization, tone, and sequencing of communication (…preparedness).
5. Who needs to hear from us first, and what must they hear? In a crisis, your reputation is shaped by what people hear and who you talk to first. The order says everything about your values.
6. What’s already public, or likely to become public imminently? Assume someone has details, as this will help shape how quickly you need to get ahead of the narrative.
7. What’s our overarching objective in the first hour? Don’t over-plan or overcomplicate the initial response. Take it in bite-sized pieces that can individually build on each other. What’s our initial messaging approach that we can say credibly and confidently right now?
8. What’s the worst-case scenario, and what can we do now to preempt it? It’s never too early to think about what could happen next and ways to take those risks off the table, if possible.

The Biggest Obstacle: Inertia

When nothing’s gone wrong recently, it’s easy to deprioritize planning. Preparedness gets postponed. “We’ll manage the crisis when it happens” is the most dangerous phrase. Preparation compounds. A risk discussion today. A tabletop next quarter. A plan review later in the year. None of these steps need to be perfect to be valuable. Doing something’s always better than waiting.

While actions are what build long-term trust and reputation, words still matter. In many crises, the triggering event causes initial harm, while ineffective communication determines the scale. Conflicting messages, overly specific early statements that require correction, and gaps between internal and external communication erode trust quickly. Once credibility fractures, recovery becomes far more difficult.

In late 2023, Okta – a leading identity and access management provider used by tens of thousands of organizations worldwide – initially reported that a breach affected less than 1% of customers. But a subsequent investigation revealed the attacker had downloaded contact information for nearly all users, expanding the affected scope dramatically. This revision drew public criticism from customers and security experts, who noted earlier estimates understated exposure and slowed the ability of affected organizations to assess and respond. Okta’s shift in messaging underscored how the substance and timing of disclosure, and not just the underlying incident, can shape stakeholder perceptions and affect trust and confidence.

BP and its partners’ continually revised estimates of how many gallons of oil spilled into the Gulf of Mexico during the Deepwater Horizon disaster offer another example of how shifting numbers undermine trust.

There’s always pressure to speak immediately. In the early moments of a crisis, there are two diametrically opposed pressures: speed and accuracy. Speed matters, but not in a vacuum from accuracy. Early communication should do three things:

1. Acknowledge awareness
2. Demonstrate action
3. Commit to updates/next steps

Those communications should resist the urge to offer specificity that cannot yet be verified. Few mistakes damage trust faster than confident statements that must later be walked back or continually amended. Stakeholders watch closely to see whether organizations do what they said they’d do – whether lessons are acknowledged or if change is sustained or temporary. Some of the strongest reputations are built not by avoiding failure, but by responding to it with transparency and follow-through.

One year from now, the question won’t be whether a crisis occurred (one will). It’ll be whether the organization was ready when it did. As Benjamin Franklin said, “By failing to prepare, you are preparing to fail.”

Preparedness isn’t about fear (although a healthy dose of that can be strong motivation!). It’s about stewardship. And it’s one resolution that pays dividends across all aspects of a successful year ahead – financial, operational, and reputational. If you don’t know where or how to get started, get in touch and we can help.