The First 60 Minutes: What Small Organizations Need to Say When Something Goes Wrong
Something has gone wrong.
An employee has been injured. A data breach may have exposed customer information. A leader’s conduct is under scrutiny. A product problem is spreading online. A service interruption is affecting the people who depend on you.
The facts are incomplete. The questions are multiplying. Someone has already asked what the organization plans to say.
This is where small organizations are especially vulnerable.
They often have close relationships with employees, customers, donors, volunteers, and community partners. Those relationships are a strength. During a crisis, they also make silence, inconsistency, and speculation feel personal.
The first hour is not the time to solve every dimension of the problem. It is the time to establish control, communicate what is known, and earn enough trust for the next update.
First, decide whether this is a communications crisis
Not every complaint, mistake, or negative post requires a crisis response.
A situation becomes a communications crisis when it creates a meaningful threat to people, operations, trust, reputation, legal obligations, or the organization’s ability to carry out its work.
Warning signs include:
People may be unsafe or materially harmed
Essential services or operations are disrupted
Sensitive information may have been exposed
The issue is attracting sustained public or media attention
Employees, customers, donors, partners, or regulators need immediate information
Misinformation is spreading faster than verified facts
Leadership credibility or organizational integrity is directly at issue
When safety, law enforcement, cybersecurity, legal duties, insurance requirements, or regulatory reporting are involved, communications must support the appropriate specialists. It should not replace them.
The first-hour framework: stabilize, verify, assign, communicate, update
A useful response sequence is simple enough to remember under pressure:
Stabilize
Verify
Assign
Communicate
Update
These actions may overlap. The sequence is not a stopwatch. It is a way to prevent the most common failure: publishing before the organization understands what it knows, who is responsible, or what affected people need.
Minutes 0–10: stabilize the situation
Communication is not the first priority when people are in immediate danger. Protecting them is.
Follow the relevant emergency, safety, operational, legal, or technical procedures. Contact emergency services when appropriate. Stop ongoing harm if the organization can do so safely.
From a communications perspective, the first actions should include:
Alerting the person responsible for leading the response
Opening a single internal channel for verified updates
Preserving relevant records, messages, screenshots, and timelines
Pausing scheduled social posts, emails, and promotional campaigns that could appear careless or contradictory
Recording when the issue was discovered and which actions have been taken
Do not let the team debate public wording while the operational response remains uncoordinated.
Minutes 10–20: verify what is known
During a crisis, information arrives unevenly. Some facts are confirmed. Some are likely. Some are repeated so often that they begin to feel confirmed.
Separate them.
Create a simple working record with four headings:
Category | Question |
|---|---|
Confirmed | What do we know, and how do we know it? |
Unconfirmed | What are we still investigating? |
Actions | What has the organization already done? |
Needs | What do affected people need to know or do now? |
Use timestamps. Identify the source of each important fact. Update the record as the situation changes.
Do not fill gaps with assumptions because the public statement feels incomplete. Uncertainty is uncomfortable, but false certainty is dangerous.
The Centers for Disease Control and Prevention’s crisis-communication guidance emphasizes speed, accuracy, and credibility. Those goals work together when an organization clearly distinguishes what it knows from what it is still investigating.
Minutes 20–30: assign roles and authority
Small teams sometimes assume everyone will naturally coordinate. Under pressure, that assumption produces conflicting messages and delayed decisions.
Assign the roles explicitly.
Incident lead
Owns the overall response, coordinates operational decisions, and resolves competing priorities.
Communications lead
Maintains the verified facts, identifies audiences and channels, drafts messages, and coordinates updates.
Spokesperson
Delivers public or media-facing statements. This may be the incident lead, but it does not have to be.
Approver
Has authority to approve time-sensitive communications. Avoid a long approval chain that makes a prompt response impossible.
Specialist advisers
Depending on the situation, the team may need legal counsel, emergency responders, cybersecurity specialists, insurers, human-resources advisers, regulators, or other subject-matter experts.
One person may hold several roles in a very small organization. The important point is that everyone knows who is doing what.
Also establish one rule: only designated people speak for the organization.
That rule should not prevent employees from reporting facts internally or seeking help. It should prevent uncoordinated public speculation.
Minutes 30–45: identify audiences and draft the first message
The public is not always the first audience.
Ask who is directly affected and who needs information to act. The sequence might include:
People facing an immediate safety or service impact
Employees and frontline representatives
Customers, clients, donors, volunteers, or program participants
Regulators, insurers, partners, vendors, or public authorities
Media and the broader public
Some groups may need different details, but the underlying facts must remain consistent.
Use a holding statement when the full answer is not ready
A holding statement is a short initial message that acknowledges the situation without pretending the investigation is complete.
It should answer five questions:
What happened, at the level currently confirmed?
Who may be affected?
What is the organization doing now?
What should people do, if anything?
When and where will the next update appear?
A practical holding-statement template
We are aware of [confirmed description of the situation] affecting [people, service, or location]. Our immediate priority is [safety, service restoration, information security, or another appropriate priority]. We have [specific actions already taken] and are working with [relevant authorities or specialists, if confirmed] to understand the situation. [Instructions for affected people, if any.] We will provide another update through [channel] by [time or defined milestone].
The template is intentionally plain. During a crisis, clarity is more valuable than brand flourish.
Express concern when people may have been harmed. Do not use empathy as a substitute for facts or action.
Minutes 45–60: communicate and establish the next update
Publish or deliver the message through the channels your affected audiences actually use.
Depending on the situation, that may include:
Direct email or text alerts
Employee messaging channels
A notice on the website
Customer-support scripts
Social media
A recorded phone message
Direct calls to major partners, donors, clients, or community leaders
A media statement
Make sure frontline employees receive the message before or at the same time as the public. They should not learn about the organization’s response from a customer.
Then create a predictable update rhythm.
If you promise another update at 3:00 p.m., provide one at 3:00 p.m. even if the investigation is still underway. “We are continuing to investigate and have no material change to report” is still an update.
Reliability builds credibility when certainty is not yet possible.
What not to say
Pressure encourages language that feels protective but often makes the situation worse.
Avoid these habits.
“No comment”
If you cannot answer a question, explain why and identify what you can say.
“We cannot discuss individual personnel matters, but we can explain the process we are following” is more useful than a refusal with no context.
Speculation presented as reassurance
Do not say there is “no risk” unless qualified experts have established that conclusion. Do not promise that an incident is isolated while the investigation is still open.
Defensive attacks
Blaming the media, a complainant, an employee, or the public rarely restores trust. Correct material inaccuracies with evidence and without unnecessary hostility.
Empty empathy
“We take this very seriously” has little value if it is not followed by concrete action.
Say what the organization has done, what it will do next, and how affected people can get help.
An unreviewed AI-generated response
AI may help organize facts, compare drafts, or identify unanswered questions. It should not independently determine the organization’s position during a high-stakes event.
Sensitive context, legal implications, human consequences, and rapidly changing facts require accountable human review.
Prepare before the clock starts
The best time to make first-hour decisions is before an incident occurs.
Ready.gov advises organizations to develop communications plans in advance because customers, employees, families, authorities, and other stakeholders may all need prompt information during an emergency.
A basic crisis-communications plan should include:
The situations that trigger activation
Current contact information for the response team
Named roles and backups
Approval authority
Contact information for legal, insurance, cybersecurity, emergency, and other advisers
Priority stakeholder lists
Internal and external communication channels
Website and social-account access
Draft holding-statement structures
Procedures for pausing scheduled content
A method for documenting decisions and updates
A schedule for tabletop exercises and plan review
The plan does not need to predict every crisis. It needs to reduce the number of important decisions being made for the first time under pressure.
The first statement does not need to be perfect
It needs to be responsible.
People understand that facts develop. What damages trust is the sense that an organization is absent, careless, evasive, or saying different things to different audiences.
In the first hour, communicate what you know. Be honest about what you do not know. Explain what you are doing. Tell people when they will hear from you again.
Then keep that promise.
The goal is not to win the news cycle or make the problem disappear. It is to help people make informed decisions while the organization responds with discipline.
That is how credibility survives uncertainty.
Would your team know what to say?
NEXILUS helps small businesses and nonprofit organizations prepare practical crisis-communications plans, clarify roles, develop message frameworks, and communicate with confidence when the stakes are high.
