8 min read · 1,789 words
A crisis communication plan earns its keep in the first 60 minutes. In that hour you cannot know what actually happened, and waiting until you do is how organisations lose control of the story. The correct first move is to publish an acknowledgment that contains no facts at all.
I learned that the slow way. Years ago I took a call late at night about an incident at a manufacturing site I was responsible for communicating about. Within roughly twenty minutes a photograph was moving through a contractor WhatsApp group with several hundred people in it. We did what the textbooks say and went to establish the facts. Two hours later we had a clean, legally reviewed statement, and two trade publications had already run the story sourced from a driver at the gate.
Our statement read like a rebuttal. The hour was lost because nobody in that room had authority to say anything until the facts were confirmed, and the facts took longer than the internet did.
Why does the first hour decide the outcome?
Because the vacuum gets filled in the first hour, and you do not choose who fills it. The Institute for Public Relations’ review of crisis research treats an initial response inside the first hour after a crisis breaks as the working standard, drawing on Timothy Coombs’ best-practice work, not as an ambitious target.
Being surprised is not the problem. PwC’s Global Crisis Survey of 2,084 senior executives across 43 countries found 69% had lived through a corporate crisis in the previous five years and 95% expected another, yet 29% had nobody dedicated to crisis preparedness. By 2023 PwC found 89% calling resilience a top strategic priority. The intent is there; the wiring is not.
The cost then compounds for years. In Deloitte’s survey of 317 board members, only 30% of companies hit by a reputation crisis had recovered within a year, and 16% were still recovering four or more years later. Weber Shandwick’s study of 2,227 executives across 22 markets attributed 63% of market value to corporate reputation. An hour of silence is not a communications problem. It is a balance-sheet problem.
The 60-Minute Protocol, in five parts
The model is built around time boxes rather than topics, because under pressure people follow a clock, not a document. Each box holds exactly one decision. If you cannot make it inside the window, you escalate rather than deliberate.
| Minutes | The part | The single decision | What breaks without it |
|---|---|---|---|
| 0–10 | The escalation trigger | Is this an incident or a crisis? | Judgement calls made by tired people at midnight |
| 10–20 | The decision right | Who may publish without further approval? | A draft circling three inboxes for two hours |
| 20–30 | The acknowledgment | What can we say that contains no facts? | Silence, which the public reads as concealment |
| 30–45 | Employees first | What do our own people need right now? | Staff learning about their employer from a news alert |
| 45–60 | Channel sequence | Where does it go, and in what order? | Every audience getting the same words at the wrong moment |
Minutes 0 to 20: the trigger and the decision right
An escalation trigger is a written threshold, not an instinct. Mine runs three lines: any event involving injury, any event with a photograph already outside the fence, any event a regulator will hear about. If a line is crossed the protocol starts, and nobody has to be persuaded at one in the morning that this one counts.
The decision right is the part almost everyone skips. One named person and one named alternate hold standing authority to publish the acknowledgment without legal sign-off, CEO sign-off, or a call with the parent company. That authority is granted in writing, in advance. Everything else in the hour is drafting. This is governance.
The gap between having a plan and having a working one is wide. Deloitte’s survey of more than 500 crisis and risk executives found 84% had a crisis management plan while only 17% had tested its assumptions. Just 39% of boards had a plan for a reputation crisis. Documents do not make decisions at midnight.
Should you publish before you have the facts?
Yes, and this is where I part company with most advice given to Indian corporate teams. “Get the facts first” is sound legal counsel and terrible communication counsel, because it treats the first statement as information. The first statement in a crisis is proof that a competent adult is awake and in charge of the situation.
The research has a name. Stealing thunder, studied by Arpan and Pompper and later Claeys and Cauberghe, finds the identical crisis does measurably less reputational damage when the organisation reports it first, and that self-disclosure supplies so much protection the response strategy afterwards matters less.
Air India’s response to the AI171 crash on 12 June 2025 is the clearest recent Indian illustration. The aircraft came down at about 13:39; the first public statement went out at 14:28, inside 50 minutes, containing almost nothing beyond confirmation of the flight, an incident, and a commitment to update. Facts followed at 15:26, 18:11 and 00:41. Whatever else is argued about that response, the first hour was not surrendered.
Here is the template I keep on my phone. It is deliberately factless.
At approximately [time] today there was an incident at our [site or service]. Our first priority is the safety of everyone involved. Emergency services have been informed and we are working with them. We will issue a further update by [a time inside 90 minutes]. For queries: [named person, phone, email].
Why do employees have to hear it first?
Because they are your most credible channel and the only one you own. The 2026 Edelman Trust Barometer, surveying nearly 34,000 people across 28 countries, puts trust in “my employer” at 78%, against 64% for business generally and 53% for government. India ranks third on the trust index at 74. Your own people are believed more than your press release.
Most crisis plans ignore this. Research summarised by the Institute for Public Relations found only 31% of organisations studied had explicit policies for internal crisis communication, against 67% for external. An experimental study of 640 participants found employees with weaker ties to the organisation responded better to direct company disclosure than to hearing it from outside.
In practice that means a plain internal note at minute 30, before the news desks are called. Not the external statement pasted into email. Closer to: this happened, here is what we are doing, here is what to say if asked, here is when you will hear next. The discipline that makes corporate communication work when the news is bad applies with the volume turned up.
Channel sequencing carries more meaning than the wording
Where a statement appears first tells people how seriously you are taking it. Publish on your own newsroom, then employees, then customers and channel partners, then media, then social. Owned first, borrowed second. A statement that exists only as a quote in someone else’s article is one you do not control.
Zomato is the Indian benchmark. When it was breached in May 2017, with 17 million records taken and about 6.6 million hashed passwords exposed, it published the detail on its own blog and kept updating it there. Researchers argued fiercely with the technical choices. Almost nobody argued Zomato had hidden anything, and that distinction is what survives.
What the Indian cases actually show about the first hour
Nestlé India’s Maggi recall is the standing warning. In the quarter to June 2015 it posted a net loss of Rs 64.40 crore with net sales down 20.1%, reversed Rs 288.4 crore of sales on withdrawn stock and took an exceptional charge of Rs 451.66 crore. The early communication was legal and technical while the public conversation was about children and lead, and that gap cost quarters.
Maruti Suzuki’s Manesar shutdown in 2012 is the operational version: the plant closed for over a month, roughly 77,000 units of production lost and quarterly net profit down 5.4% to Rs 227.5 crore. In manufacturing and freight a crisis is rarely only a media event, which is why anyone doing communication work inside a supply chain belongs in the operations review, not waiting for a brief.
What to put in place before your next bad night
None of this needs budget. It needs five decisions taken while nothing is on fire.
- Write the trigger. Three lines, agreed with operations and legal, defining what converts an incident into a crisis.
- Name the two people. One primary, one alternate, with written standing authority to publish. Mobile numbers on the same sheet.
- Pre-approve the factless statement. Have legal clear the template above once, in calm conditions.
- Build the employee route. A distribution list, a WhatsApp broadcast, a plant PA script, tested quarterly. Assume email is slowest.
- Rehearse once a year. Ninety minutes, one scenario, no slides. You are testing the clock and the authority, not the prose.
If you run brand or communication inside an engineering-led business, this is also how the function earns standing internally, the same way marketing earns its seat in a manufacturing company: by being the person who already had the answer at 11pm.
Frequently asked questions
What should a crisis communication plan cover in the first 60 minutes? A written escalation trigger, a named person with standing authority to publish, a pre-approved acknowledgment containing no facts, an internal message to employees before external release, and a fixed channel order beginning with owned media.
Should the first statement include facts? No. Publish acknowledgment, priority and a commitment to update by a stated time. Facts asserted in the first hour are frequently wrong, and correcting your own early claim damages credibility more than a short silence would.
Who should approve a holding statement? One named person with written standing authority from the board or managing director, plus an alternate. Approval chains consume the hour. Legal reviews the template once in advance, not the statement in the moment.
Why tell employees before the media? Employees are your most trusted channel, and staff who learn about their own company from a news alert become the least reliable version of your story. Internal first is the pattern separating recoveries from prolonged damage.
How often should the plan be tested? At least annually, as a live 90-minute exercise with the actual decision-makers. Deloitte found 84% of organisations had a plan and only 17% had tested its assumptions. An untested plan is a document, not a capability.
My view, stated plainly: most Indian corporate crisis plans are written to protect the company from its own lawyers rather than its reputation from the clock. The first hour is not for accuracy. It is for presence, and presence has to be authorised in advance by someone senior enough to sign for it.
If an incident happened at one of your sites tonight, do you know the name of the person who is allowed to publish, and could they do it without asking anyone?
-
Previous Post
When to Rebrand a Company: The Case for Not Doing It