Crisis Communication During Business Disruptions
Learn about crisis communication planning, stakeholder management, and communication strategies during business disruptions.
Understanding Crisis Communication
Crisis communication is the process of managing information flow during a business disruption to ensure that stakeholders receive timely, accurate, and consistent messages. Effective crisis communication protects an organization's reputation, maintains stakeholder confidence, and supports the recovery effort. For IS auditors, crisis communication is an integral component of business continuity planning that should be assessed for adequacy and preparedness.
Crisis Communication Plan Components
A well-developed crisis communication plan should include:
- Spokesperson Designation: Identifying who is authorized to communicate on behalf of the organization during a crisis. Spokespeople should be trained in media relations and crisis messaging.
- Stakeholder Identification: Listing all groups that need to be informed during a crisis, including employees, customers, regulators, shareholders, media, suppliers, and the general public.
- Communication Channels: Defining the methods and tools for reaching each stakeholder group. Channels may include email, phone trees, text messaging, social media, website updates, and press releases. Redundant channels should be available in case primary channels are affected by the disruption.
- Message Templates: Pre-drafted message templates for common scenarios that can be quickly customized during an actual crisis. Templates ensure consistent messaging and reduce response time.
- Escalation Procedures: Defining when and how to escalate communications based on the severity and scope of the disruption.
Communication Principles During a Crisis
Effective crisis communication follows several guiding principles:
- Timeliness: Communicate early and often. Delayed communication allows rumors and misinformation to fill the void.
- Accuracy: Only share confirmed information. Speculation and unverified details can undermine credibility and create confusion.
- Consistency: All communications should convey a unified message. Conflicting statements from different sources within the organization erode trust.
- Empathy: Acknowledge the impact on affected parties and demonstrate concern for their well-being.
- Transparency: Share what is known, what is being done to address the situation, and when the next update will be provided.
Regulatory and Legal Considerations
Organizations may have legal obligations to notify regulators, customers, or other parties within specified timeframes, particularly in the case of data breaches or disruptions to regulated services. The crisis communication plan should account for these requirements and include legal counsel in the communication review process.
Audit Considerations
IS auditors should verify that a crisis communication plan exists, that it is integrated with the broader BCP, and that communication procedures have been tested. Auditors should assess whether stakeholder lists and contact information are current, whether communication channels are redundant, and whether spokespeople have received appropriate training.
CISA Exam Tips
For the CISA exam, understand that crisis communication is a component of BCP, not a standalone activity. Know that designated spokespeople should be the only ones communicating externally during a crisis. Questions may focus on the importance of pre-drafted templates, redundant communication channels, and the principle of providing timely, accurate, and consistent information to stakeholders.