What makes a good communication plan?

Two Ernst & Young graduate employees were sacked after allegedly accessing Prime Minister Anthony Albanese’s personal banking details while on secondment at Commonwealth Bank. Paul Issa and Phillip Issa were later charged with unauthorised access to restricted data, and Paul Issa also faced an additional charge related to distributing personal data in a threatening or harassing way. EY declined to comment.

That silence is now part of the story. A firm that advises other organisations on governance and risk could not, or would not, explain its own. When a genuine crisis lands on your desk, the plan you needed was the one written before the phone rang, not the one improvised while a journalist waits on hold.

Many organisations confuse a communication plan with a folder of pre-approved lines. That is not a plan. It is a prop.

A real communication plan is a decision-making tool. It sets out who is authorised to speak, what they can confirm before legal has finished reviewing everything, and how quickly a response needs to move once the first question lands. Speed matters because silence reads as concealment, whether or not that is fair.

Good plans also assume the worst version of the story will travel first. Had EY assumed a privacy breach involving the Prime Minister’s banking details would become a national story within hours, a holding statement would have existed before the Australian Federal Police confirmed the charges. Instead, the vacuum was filled by everyone except the organisation that owed an explanation.

Before drafting a single line, define what the plan is meant to protect. Is it a share price, a regulatory relationship, a workforce’s trust, or an individual’s reputation? Each purpose changes who should speak and what they should say.

This is where a disciplined framework earns its keep. Every message should be clear, concise, and consistent across every channel it travels through. A plan that lets legal, HR, and the executive office issue three different versions of events multiplies the damage rather than containing it. Consistency is not a style preference, it is the difference between a story that closes in a day and one that runs for a fortnight.

A plan built around what an organisation wants to say, rather than what each audience needs to know, tends to fail on contact with reality. Employees want to know whether their own data is safe. Customers want to know what changes for them. Regulators want a timeline. Journalists want a story they can verify before deadline.

A useful discipline here is the three-message framework: an incident message covering facts and timeline, a company message setting out values and commitment, and a personal message from the leader carrying their own accountability. Skipping the personal message, as EY appears to have done, leaves the most human part of the story untold. Someone else will tell it instead, and they will not tell it kindly.

The best communication plans exist long before the headline does. That means naming spokespeople in advance, agreeing escalation triggers with the board, and rehearsing the plan against a scenario that resembles what genuinely goes wrong in your sector, not a generic template borrowed from a training course.

This is the thinking behind Wilkinson Group’s retained advisory service, Wilkinson Confidante, built around exactly this kind of preparedness: intelligence already live, protocols already tested, and senior counsel already briefed on the business before an incident occurs. It is also why issues management deserves attention as its own discipline. Most crises, this one included, were visible as risk well before they became a headline. A staffing arrangement that gave a graduate employee access to a sitting Prime Minister’s financial records was a governance question well before it was a media one.

A good communication plan is judged the way a veteran newsroom editor judges a source, by whether it holds up under pressure and survives a follow-up question. EY’s response to its own staff allegedly accessing a sitting Prime Minister’s bank account did not need to be flawless. It needed to exist.

Peter Wilkinson has spent 24 years advising boards through exactly this kind of exposure, drawing on three decades as a journalist before that. Organisations that treat a communication plan as a living document, tested and updated as the business changes, rarely find themselves explaining silence after the fact.

The plan is not there to manage a story once it breaks. It is there so the story never gets to write itself.

If in doubt about whether to say something, say it. Silence has never once protected a reputation it was meant to save.