PR Tips · July 23, 2026
Crisis Communication: A PR Playbook and When to Hire a Crisis PR Agency
By Kyle Porter, Executive Vice President & Managing Director.
Updated October 22, 2026
Virgo PR is a crisis communications agency that helps companies build a response plan before an incident and manage the first public statement, spokesperson, and follow-up messaging when a data breach, product failure, scandal, lawsuit, or public controversy threatens their reputation.
Most companies write their crisis communication plan during the crisis. That is the single most common mistake in this discipline, and it explains why so many public responses read as improvised, because they are. A plan built in the first hour after a story breaks competes with legal review, executive panic, and a reporter's deadline, all at once. A plan built months earlier just needs to be executed.
Crisis communication is the practice of managing what an organization says and does during an event that threatens its reputation, operations, or stakeholder trust: a data breach, a product failure, an executive scandal, a lawsuit, or a public controversy. It covers the pre-built response plan, the first public statement, spokesperson management, and the ongoing messaging that follows until the situation stabilizes. Done well, it protects trust with customers, employees, investors, and the media during the moments when that trust is most exposed.
Build the Plan Before You Need It
1. Identify your realistic crisis scenarios in advance
Every industry has a predictable set of risks: a security company should plan for a breach, a consumer brand should plan for a product recall, a public company should plan for a leadership departure or a restatement. Sit down with legal, operations, and communications leadership and list the five or six scenarios most likely to affect your organization specifically, not a generic list pulled from a template. The plan gets used only if it matches the risks that are actually plausible.
2. Pre-draft holding statements for your top scenarios
A holding statement is the first public acknowledgment of an incident: it buys time to gather facts while confirming the organization is aware and responding. Drafting the skeleton language in advance, with blanks for the specific details, cuts the time between an incident breaking and a public response from hours to minutes.
3. Define the internal decision chain before a crisis, not during one
Someone needs the authority to approve a public statement quickly. If that approval has to route through five people who have never discussed the process, the company loses the first hours of the story to internal logistics instead of external response. Name the approvers, the backups if a primary approver is unavailable, and the maximum acceptable delay for sign-off.
4. Choose and train spokespeople before the pressure is on
A crisis is the wrong time to discover that your designated spokesperson freezes in front of a camera or cannot resist speculating beyond confirmed facts. Identify who speaks for the company in different scenarios, a CEO for major reputational events, a technical leader for a product or security incident, and put them through media training well before they need it.
5. Map your stakeholders and their information needs
Customers, employees, investors, regulators, and media all need to hear from the company, though not necessarily the same message through the same channel at the same time. Employees often deserve to hear difficult news internally before it goes public. Build that sequencing into the plan rather than figuring it out in real time.
The First 24 Hours: A Response Framework
6. Confirm the facts before you say anything publicly
The instinct to respond immediately is strong, but a fast, wrong statement does more damage than a slightly slower, accurate one. Get a clear internal picture of what happened, what is still unknown, and what can be confirmed before any external language goes out.
7. Acknowledge the situation even if you cannot yet resolve it
Silence in the first few hours reads as evasion, even when the company is simply still investigating. A short holding statement acknowledging awareness and commitment to sharing more information as it becomes available keeps the company in the conversation instead of ceding it to speculation.
8. Centralize all public communication through one source
During a fast-moving story, mixed messages from different executives create more damage than the original incident. Route every external statement, to press, customers, or social media, through the same approved language and the same small group of people.
9. Monitor coverage and sentiment continuously, not once a day
The first 24 hours is when a story's framing gets set. Track what reporters, forums, and social platforms are saying in near-real time so the company can correct factual errors quickly and see whether the story is spreading, stabilizing, or fading.
10. Update stakeholders on a defined cadence, even with "no new update"
A promised follow-up that never arrives erodes trust faster than bad news delivered on schedule. If the plan calls for an update every four or six hours, keep to it, even if the update is simply that the investigation is ongoing.
Spokesperson and Messaging Discipline
11. Say what you know, what you don't, and what you're doing about it
This three-part structure covers nearly every crisis statement: the confirmed facts, an honest acknowledgment of what remains unconfirmed, and the concrete steps being taken. It resists the temptation to over-promise or speculate, both of which come back to hurt credibility later.
12. Avoid legal hedging that reads as evasive
Legal review is necessary, but statements scrubbed into pure passive-voice non-commitment ("mistakes may have been made") read as dodging responsibility, and audiences notice. Aim for language that is accurate and legally sound without sounding like it was written to avoid meaning anything.
13. Keep every spokesperson on the same script
One executive going off-message, even with good intentions, can undo careful planning. This is part of why a defined approach to corporate communications matters well beyond the crisis itself: consistency has to be a habit, not a one-time instruction.
14. Correct the record when coverage gets facts wrong, but pick the battles that matter
Not every inaccurate comment online deserves a public correction. Reserve direct pushback for factual errors that materially affect the story or that are spreading through credible channels, and let smaller inaccuracies go rather than amplifying them.
When to Bring In an Outside Crisis PR Agency vs. Handle It Internally
Some incidents are manageable with an internal team: a minor service outage, a limited customer complaint that surfaces publicly, or a small factual error in coverage that a quick correction resolves. If the situation is contained, the internal team has bandwidth, and the reputational stakes are modest, handling it in-house is often the right call, particularly if the company already has a tested plan and trained spokespeople in place.
The calculus changes once a few conditions show up: the story is gaining national or industry-wide media attention faster than an internal team can track; legal exposure is significant enough that every public word needs coordination between communications and counsel; the internal team lacks direct relationships with the reporters actively covering the story; or the company's own leadership is too close to the situation to communicate about it with the necessary distance and discipline. Any of these is a reason to bring in a crisis management agency.
An outside crisis PR agency brings three things an internal team often lacks in the moment: experience running the first-72-hours playbook across many prior incidents, existing relationships with the reporters covering the story right now, and the outside distance to push back on a defensive instinct that makes a bad situation worse.
The decision does not have to be all-or-nothing. Many companies keep crisis planning and spokesperson training in-house year-round, then bring in outside support specifically for the acute response window when a real incident hits and speed matters most.
Where Crisis Communication Stalls
Waiting for complete information before saying anything. Perfect information rarely arrives on a useful timeline. Acknowledge and commit to updates rather than going silent while the full picture comes together.
Letting legal review turn every statement into jargon. A statement that is technically accurate but unreadable does not build trust. Push for plain, direct language that still clears legal review.
Treating the crisis plan as a document instead of a rehearsed process. A plan that sits in a shared drive and has never been run through a tabletop exercise will not perform well under real pressure.
Reacting only to the initial event and missing the follow-up cycle. The first statement is rarely the end of the story. Ongoing coverage and stakeholder updates often matter more to the long-term outcome than the initial response.
What is crisis communication?
Crisis communication is the practice of managing what an organization says and does during an event that threatens its reputation, operations, or stakeholder trust. It covers the pre-built response plan, the first public statement, spokesperson management, and the ongoing messaging that follows until the situation stabilizes.
What should a crisis communication plan include?
A crisis communication plan should include the five or six realistic crisis scenarios for the organization, pre-drafted holding statements for the top scenarios, a named internal decision chain with backup approvers, trained spokespeople, and a stakeholder map showing who needs to hear what and in what order.
What should a company do in the first 24 hours of a crisis?
In the first 24 hours of a crisis, a company should confirm the facts, acknowledge the situation with a short holding statement, route all public communication through one source, monitor coverage and sentiment continuously, and update stakeholders on a defined cadence. The first 24 hours is when a story's framing gets set.
When should a company hire a crisis PR agency?
A company should hire a crisis PR agency when the story is gaining national or industry-wide attention faster than the internal team can track, when legal exposure means every public word needs coordination with counsel, when the team lacks relationships with the reporters covering it, or when leadership is too close to the situation. Many companies keep planning in-house and bring in outside support only for the acute response window.
How does Virgo PR handle crisis communications?
Virgo PR handles crisis communications by building the response plan before an incident, including a designated spokesperson and pre-approved holding statements, and by supporting clients through the acute response when an incident hits. The same approach runs across the sectors below.
How we work with crisis clients
Food and beverage brands: Virgo PR builds a pre-built response plan for recalls and food safety issues, with a designated spokesperson and pre-approved holding statements. See our food and beverage PR guide.
Healthcare organizations: Virgo PR plans crisis and incident response for providers, with HIPAA-aware messaging and translation of what legal, compliance, and regulatory affairs have already approved. See our healthcare PR agency page.
Crypto and Web3 companies: Virgo PR handles SEC filings, enforcement responses, exploit and hack response, and community incident management. See our crypto and Web3 PR agency page.
FAQ
How quickly should a company respond to a crisis?
A company should acknowledge the situation within the first few hours with a short holding statement, because silence reads as evasion, but only after confirming the facts it can state publicly.
What is a holding statement?
A holding statement is the first public acknowledgment of an incident. It buys time to gather facts while confirming the organization is aware and responding.
Can a company handle a crisis in-house?
A company can handle a crisis in-house when the situation is contained, the internal team has bandwidth, the reputational stakes are modest, and the company already has a tested plan and trained spokespeople.
Who should speak for a company during a crisis?
The company should designate spokespeople in advance: a CEO for major reputational events and a technical leader for a product or security incident, each trained through media training well before they need it.
Does Virgo PR offer crisis communications?
Yes. Virgo PR builds crisis response plans, designates spokespeople, prepares holding statements, and supports clients through the acute response window.
Related reading
Follow us
Topics
- Media Relations
- Crisis Communications
- Consumer PR
