.png)
.png)
Crisis communications for BCM is the operating process for deciding when a message is needed, who owns and approves it, which internal or external audiences should receive it, and what record the organization keeps afterward.
The plan should do more than list contacts or store prewritten statements. When facts are incomplete and several functions are involved, the team needs a usable path from trigger to approved message to the next update.
In short
A usable crisis communications process should:
- Define message owners, approvers, channel owners, and backups
- Connect observable triggers to specific audiences and actions
- Separate confirmed facts from unknowns and assumptions
- Set a practical approval path
- Record what was sent, corrected, and learned
Define the Roles Behind Each Message
The plan needs to separate responsibilities, even if a small team assigns more than one to the same person.
| Role | What the role owns |
|---|---|
| Crisis lead | Activates the response structure, sets priorities, and resolves escalated decisions |
| Communications lead | Coordinates drafting, review, release, and the communication record |
| Information owner | Verifies facts within operations, IT, security, HR, safety, or another affected function |
| Approver | Reviews the message for the applicable operational, legal, regulatory, or reputational concern |
| Spokesperson or channel owner | Delivers or publishes the approved message |
| Backup | Takes over when the primary owner is unavailable |
Approval should follow the message, not one universal chain. An employee safety instruction may require operations and HR. A regulatory notice may have a prescribed owner, content requirement, and deadline.
The CDC’s Crisis and Emergency Risk Communication guidance recommends selecting and training spokespersons in advance and deciding who reviews information, and in what order, before a crisis. The process must support the quick release of accurate, concise information.
For broader team design and decision rights, see MHA Consulting’s guide to crisis management team roles and responsibilities.
Turn Communication Triggers Into Assigned Actions
A communication trigger is an observable condition that starts a defined task. “Communicate as needed” leaves too much to interpretation.
Triggers will vary by organization, but common categories include:
- A threat to employee or public safety
- A disruption crossing a defined service, duration, or geographic threshold
- Activation or escalation of the crisis management team
- Confirmed customer, patient, member, or partner impact
- A legal, regulatory, contractual, or insurance obligation
- Significant media attention or misinformation
- Recovery progress that changes earlier instructions
Each trigger should point to an audience, owner, approver, timing, primary and backup channels, and next-update rule.
For example, a customer-facing outage may call for an internal update once impact is confirmed. If it passes an agreed threshold, it may also activate a customer holding message. The threshold should reflect the organization’s service commitments, policies, and reporting obligations.
If your team is still deciding what separates a manageable incident from a crisis, review the BCMMetrics guide to incident and crisis escalation.
This is where crisis communications for BCM differs from media advice. The BCM owner is maintaining the conditions, handoffs, dependencies, and plan records that allow the appropriate communications function to act.
Use One Repeatable Message Workflow
The workflow can be simple:
- Confirm the trigger. Record the condition, time, and person who initiated the task.
- Build the fact set. Separate confirmed information, unknowns, and assumptions. Assign each open item.
- Choose the audience and channel. Decide who needs the information, what they need to do, how quickly they need it, and which backup channel is available if normal systems are affected.
- Draft for that audience. State what happened, what it means for the recipient, what the organization is doing, what action the recipient should take, and when another update is expected.
- Review and release. Follow the assigned approval route. Retain the approved version and release time.
- Monitor and update. Track delivery problems, questions, changing facts, misinformation, corrections, and the next promised update.
The NIST Cybersecurity Framework 2.0 supports this logic for cyber incidents. Its Respond function calls for notifying and sharing information with designated internal and external parties. Its Recover function covers communicating recovery progress and using approved methods and messaging for public updates. It is cybersecurity guidance, not a universal BCM communications standard.
The CDC’s Messages and Audiences guidance notes that different groups have different information needs and may require changes in context, delivery, language, and accessibility. One approved fact set can support several audience-specific messages.
Prewritten structures can make drafting easier, but they still require review. BCMMetrics’ crisis communication do’s and don’ts provides additional guidance on message preparation and spokesperson practices.
Keep a Record That Can Be Reviewed
After an exercise or real event, the program owner should be able to reconstruct how communications moved through the response.
As a practical recordkeeping baseline, retain:
- The trigger and activation decision
- The confirmed facts used at the time
- Draft and approved message versions
- Reviewers, approvals, and release times
- Audiences and channels used
- Delivery results, when available
- Questions, corrections, and follow-up messages
- Findings, owners, and target dates for improvement
This is a practitioner baseline, not a universal legal retention rule. Requirements depend on the event, industry, jurisdiction, contracts, and organizational policy.
Warning signs include conflicting versions, missing approval records, outdated contacts, no backup channel, or exercise findings that never reach the plan owner.
Test the workflow with the primary approver unavailable, the normal channel down, and a fact changing after the first message. Check whether the team can correct the update without losing the history.
Maintain the Plan With the Work Around It
BCM Planner lets teams create or upload plan templates, edit and maintain plans in one place, and record exercise results. That makes it a relevant home for the documented communications process and its review cycle.
BCM Planner is not presented as a mass-notification system. Its role here is narrower: helping the team maintain the plan, templates, and exercise record behind communications. Organizations still need suitable delivery channels and the people authorized to use them.
The test is straightforward. Can the team see what triggers a message, who owns each step, what the audience needs, which version was released, and what must change after the event? If not, the communications plan is still a document, not an operating process.
If disconnected documents and unclear versions are making that process difficult to maintain, request a BCMMetrics walkthrough to see how BCM Planner supports plan upkeep.
Frequently Asked Questions
What should a BCM crisis communications plan include?
It should include triggers, audiences, owners and backups, approval routes, primary and backup channels, templates, update expectations, current contacts, and recordkeeping responsibilities.
Who should approve crisis communications?
The approver depends on the message. The plan should map each message type to the relevant operational, communications, legal, HR, security, regulatory, or executive review instead of routing every update through the same group.
When should crisis communications be activated?
They should be activated when a defined condition creates an information or action need for a specific audience. Examples include a safety threat, confirmed customer impact, a prolonged service disruption, crisis-team activation, or a reporting obligation.
How should crisis communications be documented?
Retain enough information to reconstruct the workflow, including the trigger, fact set, drafts, approvals, final message, audience, channel, release time, corrections, follow-up updates, and assigned improvements. Legal or regulatory requirements may call for additional records.
