Lead Crisis Manager cheat sheet

Crisis definition test: a triggering event plus high uncertainty, threat to core objectives, and compressed decision time - all three must be present; a disruption lacking any one is an incident or a problem, not a crisis.

Incident vs. crisis vs. disaster: an incident is contained by routine response; a crisis threatens the organization's viability or reputation and demands executive authority; a disaster overwhelms local capacity and draws external response.

Crisis lifecycle stages: pre-crisis (signal detection and prevention), acute (damage limitation), chronic (recovery and investigation), and resolution (learning and normalization).

Crisis typology by origin: operational (failure, accident), financial (liquidity, fraud), human (workplace violence, key-person loss), technological/cyber, natural hazard, and reputational/social - each implies a different response tempo.

Vulnerability = exposure × susceptibility − adaptive capacity; risk = likelihood × impact. Crisis management addresses low-likelihood/high-impact events that standard risk registers systematically underweight.

Time-pressure curve: decision quality degrades as information completeness falls and stakes rise; crisis process compensates with pre-delegated authority, decision logs, and structured battle-rhythm cycles.

Normalization of deviance: repeated near-misses without consequence erode safety margins; a crisis program must treat recurring minor deviations as leading indicators, not background noise.

Crisis manager role boundary: the crisis manager owns process, tempo, and integration across functions; subject-matter experts own technical decisions and the accountable executive owns risk acceptance.

Program charter must state scope (event types covered, entities, geographies), authority delegation thresholds, escalation triggers, and the named accountable executive - ambiguity in any of these produces escalation delay in the first hour.

Three-tier governance: strategic (board/executive crisis committee - risk appetite, external posture), tactical (crisis management team - coordination and resource allocation), operational (incident response teams - containment and restoration).

RACI for the crisis management team: crisis lead (accountable), situation unit (information), operations unit (action), planning unit (forward look), logistics unit (resources), liaison (external parties), and scribe (decision log).

Escalation matrix design: define objective triggers (e.g., fatalities, data loss above a threshold, media inquiry, regulatory contact, revenue-impacting outage beyond a set duration) so escalation does not depend on individual judgment under stress.

Policy hierarchy: crisis management policy (board-approved principles) → crisis management plan (framework and roles) → function-specific annexes (cyber, product recall, site evacuation) → playbooks and checklists.

Assurance cycle: annual full exercise, semiannual tabletop, quarterly plan review, and post-incident audit; each produces tracked corrective actions with owners and due dates.

Metrics that indicate program health: exercise corrective-action closure rate, mean time to escalate, mean time to first external statement, plan currency percentage, and percentage of critical suppliers with tested continuity arrangements.

Regulatory and contractual drivers to map explicitly: sector incident-reporting clocks, data protection breach notification timelines, and customer contractual notification windows - the shortest clock sets the response tempo.

Business impact analysis output drives priority: rank processes by maximum tolerable downtime and recovery point objective; recovery sequencing follows the ranking, not seniority of the requesting business unit.

Early warning indicator categories: operational (defect rates, capacity saturation), financial (liquidity ratios, receivables aging), people (attrition spikes, grievance trends), external (supplier distress, regulatory consultations, social sentiment), and geopolitical.

Indicator thresholds need three bands - green/watch/act - with a named owner and a defined action per band; an indicator without an action owner is monitoring theater.

Horizon scanning cadence: daily automated feeds for operational and social signals, weekly analyst review, monthly executive briefing on slow-burn risks; slow-onset crises are missed because review cadence exceeds signal drift.

Exercise design ladder: orientation walkthrough → tabletop → functional drill → full-scale simulation → unannounced no-notice exercise; each level adds realism and cost, so sequence by criticality of the function tested.

Exercise quality criteria: stated objectives, injected events unknown to participants, a trained evaluator per objective, a hot-wash within 24 hours, and a written after-action report within two weeks.

Go-kit contents: contact trees with alternates, authority delegation letters, pre-approved statement templates, site maps and access credentials, cash/credit authority, and offline copies of plans - assume primary systems and networks are unavailable.

Redundancy for the crisis team itself: named alternates two deep for every critical role, a secondary command location, and a communication channel independent of the corporate network.

First-hour sequence: confirm and classify the event, activate the plan and convene the team, establish the decision log, secure life safety and containment, issue an initial holding statement, and set the next battle-rhythm checkpoint.

Battle rhythm: fixed scheduled situation reports (e.g., every 2–4 hours in the acute phase) with a standing agenda - facts known, facts unknown, decisions required, actions and owners, external posture.

Situation report standard: separate verified fact from assessment and from rumor; timestamp every entry; state confidence; never let an unverified item enter an external statement.

Crisis communication principle: be first, be right, be credible - speed establishes voice, accuracy preserves it; acknowledge uncertainty explicitly rather than speculating, and commit to a time of the next update.

Stakeholder sequencing: affected people and their families, employees, regulators and authorities, customers and partners, media and public - sequence by duty of care and legal obligation, not by publicity pressure.

Message architecture: holding statement (acknowledgment and care) → interim updates (verified facts, actions taken, next update time) → resolution statement (root cause summary, remediation commitments, accountability).

Recovery governance: transition from crisis mode to recovery mode is a formal decision with criteria (stabilized situation, response costs contained, investigation scope defined); recovery is run as a program with a single accountable lead.

Post-incident review: blameless fact-finding separate from disciplinary process, root-cause analysis, corrective actions with owners and dates, and a lessons-learned briefing to the executive and board within a defined window.

Crisis definition test: a triggering event plus high uncertainty, threat to core objectives, and compressed decision time - all three must be present; a disruption lacking any one is an incident or a problem, not a crisis.

Incident vs. crisis vs. disaster: an incident is contained by routine response; a crisis threatens the organization's viability or reputation and demands executive authority; a disaster overwhelms local capacity and draws external response.

Crisis lifecycle stages: pre-crisis (signal detection and prevention), acute (damage limitation), chronic (recovery and investigation), and resolution (learning and normalization).

Crisis typology by origin: operational (failure, accident), financial (liquidity, fraud), human (workplace violence, key-person loss), technological/cyber, natural hazard, and reputational/social - each implies a different response tempo.

Vulnerability = exposure × susceptibility − adaptive capacity; risk = likelihood × impact. Crisis management addresses low-likelihood/high-impact events that standard risk registers systematically underweight.

Time-pressure curve: decision quality degrades as information completeness falls and stakes rise; crisis process compensates with pre-delegated authority, decision logs, and structured battle-rhythm cycles.

Normalization of deviance: repeated near-misses without consequence erode safety margins; a crisis program must treat recurring minor deviations as leading indicators, not background noise.

Crisis manager role boundary: the crisis manager owns process, tempo, and integration across functions; subject-matter experts own technical decisions and the accountable executive owns risk acceptance.

Program charter must state scope (event types covered, entities, geographies), authority delegation thresholds, escalation triggers, and the named accountable executive - ambiguity in any of these produces escalation delay in the first hour.

Three-tier governance: strategic (board/executive crisis committee - risk appetite, external posture), tactical (crisis management team - coordination and resource allocation), operational (incident response teams - containment and restoration).

RACI for the crisis management team: crisis lead (accountable), situation unit (information), operations unit (action), planning unit (forward look), logistics unit (resources), liaison (external parties), and scribe (decision log).

Escalation matrix design: define objective triggers (e.g., fatalities, data loss above a threshold, media inquiry, regulatory contact, revenue-impacting outage beyond a set duration) so escalation does not depend on individual judgment under stress.

Policy hierarchy: crisis management policy (board-approved principles) → crisis management plan (framework and roles) → function-specific annexes (cyber, product recall, site evacuation) → playbooks and checklists.

Assurance cycle: annual full exercise, semiannual tabletop, quarterly plan review, and post-incident audit; each produces tracked corrective actions with owners and due dates.

Metrics that indicate program health: exercise corrective-action closure rate, mean time to escalate, mean time to first external statement, plan currency percentage, and percentage of critical suppliers with tested continuity arrangements.

Regulatory and contractual drivers to map explicitly: sector incident-reporting clocks, data protection breach notification timelines, and customer contractual notification windows - the shortest clock sets the response tempo.

Business impact analysis output drives priority: rank processes by maximum tolerable downtime and recovery point objective; recovery sequencing follows the ranking, not seniority of the requesting business unit.

Early warning indicator categories: operational (defect rates, capacity saturation), financial (liquidity ratios, receivables aging), people (attrition spikes, grievance trends), external (supplier distress, regulatory consultations, social sentiment), and geopolitical.

Indicator thresholds need three bands - green/watch/act - with a named owner and a defined action per band; an indicator without an action owner is monitoring theater.

Horizon scanning cadence: daily automated feeds for operational and social signals, weekly analyst review, monthly executive briefing on slow-burn risks; slow-onset crises are missed because review cadence exceeds signal drift.

Exercise design ladder: orientation walkthrough → tabletop → functional drill → full-scale simulation → unannounced no-notice exercise; each level adds realism and cost, so sequence by criticality of the function tested.

Exercise quality criteria: stated objectives, injected events unknown to participants, a trained evaluator per objective, a hot-wash within 24 hours, and a written after-action report within two weeks.

Go-kit contents: contact trees with alternates, authority delegation letters, pre-approved statement templates, site maps and access credentials, cash/credit authority, and offline copies of plans - assume primary systems and networks are unavailable.

Redundancy for the crisis team itself: named alternates two deep for every critical role, a secondary command location, and a communication channel independent of the corporate network.

First-hour sequence: confirm and classify the event, activate the plan and convene the team, establish the decision log, secure life safety and containment, issue an initial holding statement, and set the next battle-rhythm checkpoint.

Battle rhythm: fixed scheduled situation reports (e.g., every 2–4 hours in the acute phase) with a standing agenda - facts known, facts unknown, decisions required, actions and owners, external posture.

Situation report standard: separate verified fact from assessment and from rumor; timestamp every entry; state confidence; never let an unverified item enter an external statement.

Crisis communication principle: be first, be right, be credible - speed establishes voice, accuracy preserves it; acknowledge uncertainty explicitly rather than speculating, and commit to a time of the next update.

Stakeholder sequencing: affected people and their families, employees, regulators and authorities, customers and partners, media and public - sequence by duty of care and legal obligation, not by publicity pressure.

Message architecture: holding statement (acknowledgment and care) → interim updates (verified facts, actions taken, next update time) → resolution statement (root cause summary, remediation commitments, accountability).

Recovery governance: transition from crisis mode to recovery mode is a formal decision with criteria (stabilized situation, response costs contained, investigation scope defined); recovery is run as a program with a single accountable lead.

Post-incident review: blameless fact-finding separate from disciplinary process, root-cause analysis, corrective actions with owners and dates, and a lessons-learned briefing to the executive and board within a defined window.