What Is a Crisis Communication Protocol and How Do You Set One Up?

A crisis communication protocol is a pre-drafted document that establishes who within an organization holds which communication responsibilities during a crisis, how decisions are made, which stakeholders are informed, and through which channels. It forms the operational backbone of crisis preparedness. Without such a protocol, an organization loses valuable time in the first critical hours to internal alignment rather than effective communication. This article addresses the most frequently asked questions about drafting, testing, and applying a crisis communication protocol.

What components must a crisis communication protocol include?

A crisis communication protocol must include at minimum a crisis team structure with roles and responsibilities, an escalation process, a crisis classification system, contact lists, guidelines for internal and external communication, and pre-approved messages for the most likely scenarios. Together, these elements form a workable framework that remains usable even under pressure.

In practice, organizations that are well prepared for crisis communication include the following components in their protocol:

Crisis team composition: who is part of the crisis team, who has decision-making authority, who is the ultimate spokesperson?
Escalation process: how is an incident escalated from the operational level to management or the board?
Crisis classification: a system to quickly determine the severity and type of a crisis (see also the section below).
Contact list: internal key persons as well as external contacts such as legal advisors, communications agency, regulators, and emergency services.
Communication channels per stakeholder group: who informs employees, who contacts the media, who addresses customers or shareholders?
Holding statements and Q&A’s: pre-approved messages that can be deployed immediately while the facts are still being gathered.
Decision tree for media contact: when does the organization respond actively, when does it opt for a minimal statement, when does it remain temporarily silent?
Log and documentation procedure: how are decisions, actions, and communications recorded for later evaluation?

A protocol does not need to be an exhaustive manual. It must be quickly consultable, even by people working under stress. Conciseness and clarity are at least as important as completeness.

Who should be involved in drafting a crisis protocol?

Drafting a crisis protocol is not a task for communications alone. Management, Legal, HR, Risk, Operations, and where relevant IT or the CISO must be involved from the very beginning. Each of these functions contributes specific insights into risks, decision-making authority, and operational constraints that directly influence the communication strategy.

In the Belgian business context, social dialogue also plays a role. In crises that affect employees, such as restructurings or operational incidents, trade unions and the works council are relevant stakeholders whose position must be taken into account in the protocol in advance.

A practical approach is to develop the protocol through a working group with representatives from the relevant functions, led by communications or corporate affairs as the coordinating discipline. This working group maps out the most likely crisis scenarios, determines who must be involved in each scenario, and establishes the decision-making lines. External expertise can help identify blind spots and test the protocol against sector- and organization-specific risks.

Board level is also relevant. In larger organizations and multinationals, the protocol also determines when and how the executive board or board of directors is informed, and which decisions can only be made at that level.

How do you develop a crisis classification system for your organization?

A crisis classification categorizes possible incidents based on severity, urgency, and potential impact on the organization. Typically, three levels are used: an operational incident that can be managed internally, a crisis that requires management attention and affects external stakeholders, and a major crisis with broad societal, media, or reputational impact.

The classification is not merely theoretical. It determines which procedures are activated, who takes the lead, and which communication actions are initiated immediately. A misjudgment in the initial phase — where a serious situation is underestimated — is one of the most common causes of communication errors.

When developing a classification system, the following questions are guiding:

What is the potential impact on people? Are there injured persons, casualties, or health risks?
What is the operational impact? Is business continuity disrupted?
What is the reputational and media sensitivity? Is this a subject that can quickly attract public or political attention?
Are there legal or regulatory implications? Are there reporting obligations or supervisory authorities that must be notified?
Which stakeholders are affected? Does it involve internal employees, customers, local residents, shareholders, or broader public groups?

Based on the answers to these questions, an organization can determine per scenario which crisis level applies and which protocol steps are activated. The classification system must be periodically updated when the organization’s activities, risk profiles, or stakeholder environment change.

What is the difference between a crisis communication protocol and a crisis plan?

A crisis communication protocol is an operational document that establishes how communication takes place during a crisis: roles, escalation procedures, channels, and messages. A crisis plan is broader and also encompasses operational, legal, safety, and business continuity measures. The protocol is, in other words, a component of the broader crisis plan.

In practice, the terms are often used interchangeably, but the distinction is relevant for who bears responsibility for which document. The crisis plan is typically owned by Risk, Operations, or management. The crisis communication protocol falls under the responsibility of communications or corporate affairs, in coordination with the other involved functions.

A good crisis communication protocol is aligned with the broader crisis plan and references the relevant operational procedures without duplicating them. Conversely, the crisis plan must not treat communication as an afterthought that is only activated at a later stage. Communication is not the final piece of crisis management, but a discipline that must be actively involved from the very first moment.

How do you test and update a crisis communication protocol?

A crisis communication protocol that has never been tested offers only limited assurance in a real crisis. Testing takes place through tabletop exercises, targeted training sessions, and full crisis simulations in which scenarios are simulated. Updates are necessary after every significant change in the organization, after an exercise, or after a real crisis.

Tabletop exercises are accessible and cost-efficient: a crisis team works through a fictional scenario together, discusses decisions, and identifies gaps in the protocol without operational disruption. Full simulations go further and also test cooperation with external parties, media communication, and internal information flows under realistic time pressure.

After each test or exercise, a structured evaluation is essential. Which decisions went smoothly? Where did delays or ambiguities arise? Which messages proved insufficiently prepared? The findings are incorporated into an updated version of the protocol.

In addition to periodic exercises, the protocol must also be proactively updated when:

the organizational structure or management changes;
new risks or activities are introduced;
the media or stakeholder environment changes significantly;
legislation or regulation imposes new communication obligations;
a real crisis has occurred and the evaluation produces recommendations.

A protocol that is more than two years old without revision is, in most organizations, due for replacement.

When is a crisis communication protocol not sufficient?

A crisis communication protocol is a necessary but not always sufficient form of preparation. In complex, rapidly escalating, or sensitive crises, a protocol falls short if it is not accompanied by trained people, strong situational awareness, and the ability to make quick strategic decisions based on incomplete information.

A protocol establishes procedures, but procedures are not a strategy. In an acute crisis, managers and communication officers must be able to read the specific context, weigh the interests of different stakeholders, and formulate messages that are credible, consistent, and sustainable. That requires judgment, experience, and preparation that goes beyond a document.

Situations in which a protocol alone is insufficient include:

crises in which multiple disciplines must collaborate simultaneously, such as legal, operational, and communications experts;
situations with significant media or political pressure where strategic decisions must be made quickly;
complex stakeholder dynamics, such as during restructurings, mergers, or incidents with societal sensitivity;
crises in which the facts are initially unclear yet communication is immediately expected.

A protocol is the foundation. But crisis preparedness is a broader investment: in training, in simulations, in building relationships with key stakeholders before a crisis occurs, and in the ability to communicate credibly even in uncertain circumstances.

How Whyte helps with drafting a crisis communication protocol

Whyte Corporate Affairs guides larger organizations and multinationals through complete crisis preparation, from risk analysis and stakeholder mapping to drafting a workable crisis communication protocol and conducting crisis exercises. This guidance starts from an integrated approach: communications, Legal, HR, Risk, and Operations are not treated as separate silos, but as part of one coherent crisis preparation process.

Concretely, Whyte provides support with:

mapping organization-specific crisis scenarios and vulnerabilities;
drafting or revising a crisis communication protocol, including crisis team structure, escalation processes, and crisis classification;
developing holding statements, Q&A’s, and communication guidelines per scenario;
facilitating tabletop exercises and full crisis simulations with management, communications teams, and other involved functions;
media training and spokesperson training for executives and spokespersons;
acute crisis support when an incident actually occurs.

Whyte combines senior strategic advice with hands-on execution and has extensive knowledge of the Belgian institutional, media, and societal context. Would you like to know what a crisis communication protocol could concretely look like for your organization? Get in touch for an exploratory conversation.

Frequently Asked Questions

How long does it take to draft a crisis communication protocol?

The lead time varies depending on the complexity of the organization, but on average allow four to eight weeks for a fully developed protocol. This period includes the risk analysis, the working group sessions with the relevant functions, writing and reviewing the document, and internal validation. Organizations that want to accelerate this process are well advised to bring in external expertise to structure and oversee it.

What is a holding statement and when do you use it?

A holding statement is a short, pre-approved statement that you deploy in the first hours of a crisis, when the facts are not yet fully known. It confirms that the organization is aware of the situation, that action is being taken, and that more information will follow as soon as it is available. Using a holding statement prevents communication vacuums that create space for speculation or misinformation, while simultaneously showing that the organization is in control.

Does every office or department need its own crisis communication protocol?

Not necessarily, but larger organizations with multiple locations, countries, or autonomous divisions are well advised to provide location- or division-specific supplements alongside an overarching protocol. These supplements establish local contact lists, escalation lines, and any language requirements, without duplicating the central protocol. It is crucial that the local protocols are fully aligned with the central framework and that everyone knows when action can be taken locally and when the central crisis team must be activated.

How do you handle social media during a crisis if the protocol was drafted before the rise of certain platforms?

An outdated protocol that contains no specific guidelines for social media poses a real risk: social media is often the first channel on which a crisis becomes visible and on which the public expects a response. At the next revision, add a separate section on social media, with guidelines on monitoring responsibilities, response times per platform, tone of voice, and the decision-making procedure for publishing or removing posts. Also determine who is authorized to post on behalf of the organization during a crisis.

What do you do if a key person from the crisis team is unreachable during a real crisis?

A good protocol provides a clear substitute for every key role, including contact details. Ensure that the substitutes are not only listed on paper, but are also effectively trained and briefed on their role. In addition, it is advisable to define a 24/7 reachable crisis coordinator or an on-call arrangement, so that there is always a first point of contact who can activate the protocol, regardless of the time or availability of the primary responsible persons.

How do you communicate internally during a crisis without information leaking prematurely?

Internal communication must proceed quickly, clearly, and in a controlled manner, but must also be structured so that confidential information does not seep out through informal channels. Use secure communication channels for the crisis team itself, and ensure a clear internal communication line whereby employees are informed in a timely manner through official channels, so they do not seek information from external sources. Explicitly instruct those involved about what may and may not be shared, and with whom.

How do you know whether your crisis communication protocol was effective after a real crisis?

Conduct a structured evaluation after every crisis, preferably within one to two weeks after the acute phase has ended. Analyze the timeline of decisions and communication actions, question the team members involved about bottlenecks, and determine which parts of the protocol worked well and which fell short under pressure. Concrete indicators include the response time to the first media report, the consistency of messages across channels, and the satisfaction of internal stakeholders with the information provided. The findings form the basis for the next version of the protocol.

This content was generated with the help of AI and it may contain mistakes