What are the 5 steps of crisis management?

Crisis management runs in a fixed order: detection, assessment, response, communication, recovery. Get the order right and the individual steps mostly take care of themselves.

Most guides treat it as a checklist, something to run once a story breaks. That’s backwards. By the time a story is public, the organisation has usually known for weeks, sometimes years.

The correct starting point is detection, not response. Response feels urgent because it’s visible. Detection isn’t, which is exactly why it gets skipped.

I’ve sat across the table from boards mid-crisis for over two decades. The break is always the same one: someone reaches for the statement before doing the quiet work of detection and assessment first.

KPMG Australia is this year’s case study. A whistleblower’s formal internal disclosure landed in May 2024. Senator Deborah O’Neill made the allegations public under parliamentary privilege in March 2026, two years later.

Within weeks, chief executive Andrew Yates and national audit head Julian McPherson had resigned. Chairman Martin Sheppard and two senior partners followed by June.

The resignations came fast. The two-year gap before anyone outside the firm knew, didn’t.

That gap is what the five steps exist to close.

Detection means continuous monitoring across regulatory signals, internal reporting, media coverage and stakeholder sentiment, run as a standing function rather than a reaction to one tip.

Every crisis communications consultant in Australia will tell you the same thing: by the time a story breaks, the organisation has usually known for weeks, sometimes months.

KPMG’s whistleblower tried to escalate directly to the board in late 2024. Then-chair Martin Sheppard redirected those communications to general counsel instead. That’s not detection. That’s a warning system routed away from the people who could act on it.

This is the discipline behind issues management, and it separates an organisation that sees a problem coming from one that reads about it in the paper.

Assessment means weighing legal exposure, regulatory posture and public narrative together, fast, under senior judgment rather than committee consensus.

Once an issue surfaces, the instinct in most large organisations is to convene a committee instead. Legal, communications, HR and external advisers all weigh in before a decision gets made. That suits consensus, not speed, and a crisis punishes slowness. It’s one of the most common committee-run crisis response failures, and it’s entirely avoidable.

Sheppard and two senior partners eventually stepped down, in June. The assessment that mattered happened months too late, only after parliament forced the issue.

Senior judgment matters more than headcount. A single adviser who has sat through cyber breaches, judicial inquiries and executive misconduct cases before can size up severity in an afternoon. A committee often can’t do it in a week. Peter Wilkinson built Wilkinson Group’s model around exactly this principle: no account managers, no junior escalation chain, just the person who takes the call.

Response means executing a tested protocol within hours, not news cycles, built before the event rather than improvised during it.

Silence in the first hours doesn’t buy thinking time. It creates a second story, the one about why leadership went quiet, and that story is often more damaging than the original issue.

Finance officials told parliament they’d had to chase KPMG for information the firm should have volunteered. A technical scandal became a story about evasiveness, and evasiveness is far harder to recover from. A crisis communications consultant in Sydney working this file would have pushed for an honest position long before Finance had to confront KPMG’s leadership directly.

A protocol isn’t a statement drafted in a hurry. It’s rehearsed in advance, so the first public words come from control, not catch-up. This is the entire logic behind a retained model such as Wilkinson Confidante, where the response framework already exists before the phone rings.

If a spokesperson still has to fumble over the right words under questioning, that readiness gap shows on camera. It’s also why interview preparation and media training sit alongside the protocol itself, not after it.

Communication means delivering three distinct messages together, never one statement: the incident message, the company message and the personal message.

Optus’s 2022 data breach shows what happens when the three don’t line up. CEO Kelly Bayer Rosmarin fronted the media within days, apologetic and visibly rattled. But her incident message, calling the attack sophisticated, was contradicted by the federal government within 24 hours. Home Affairs Minister Clare O’Neil called it “anything but sophisticated.” A mismatch like that undoes the personal message instantly, however genuine the apology sounded.

The incident message states the facts and the timeline plainly, without spin. The company message sets out values and the commitment to fix what went wrong. The personal message, delivered by the leader directly, carries the human acknowledgment that facts and policy statements can’t substitute for.

Directors and executives often skip the personal step because it feels exposing. It’s also the step audiences remember.

Consistency across all three matters as much as the content of each. A reputation management consultant in Australia worth retaining will insist all three are aligned before anything goes out. A mismatch between the corporate statement and the leader’s own tone erodes whatever credibility remains.

Recovery means verified, traceable change sustained well past the point the media moves on, not a single apology and a review. Most organisations shortcut it: an apology, a review, an expectation the story moves on. It rarely does, not without visible proof that something has actually changed.

Trust = Truth + Transparency + Traceability. That third element is what the KPMG situation will ultimately be judged on. Every commitment the firm makes now, about governance, about partnership structure, about how whistleblowers are protected, sits online, timestamped and easily retrievable, ready to be checked against whatever happens next.

Recovery after a scandal of this scale typically takes years, not months. It requires an honest account of what went wrong, changes that are genuinely verifiable rather than promised, and consistent communication sustained well past the point the media moves on. CEO reputation management in Australia increasingly means managing this long tail, not just the first fortnight of headlines.

None of these five steps works in isolation. Skip detection and the response looks reactive. Skip assessment and it’s either too slow or too aggressive. Skip the personal message in the communication step and recovery starts from a trust deficit facts alone can’t close.

A genuine crisis PR agency in Australia, one that has actually sat inside inquiries, product recalls and executive misconduct cases, reads which step is being skipped before the damage becomes visible externally. That’s pattern recognition, not a template, and it’s also the limit of what any framework can do: it won’t undo a genuine breach of trust on its own. Whether the underlying conduct actually changes is down to the people running the place, not the sequence.

1. Detect. Continuous monitoring across regulatory, internal and media channels, run as a standing function, not a reaction to one tip.
2. Assess. Senior judgment, not committee consensus, weighing legal exposure, regulatory posture and public narrative together.
3. Respond. A tested protocol executed within hours, not news cycles, built before the event rather than improvised during it.
4. Communicate. Three aligned messages at once: the incident, the company and the personal, delivered by the leader directly.
5. Recover. Verified, traceable change sustained well past the point the media moves on, not a single apology and a review.

Not to be confused with the 5 C’s of crisis management, a different mnemonic some frameworks use instead: commonly care, commitment, competence, clarity and consistency, or communication, coordination, control, containment and credibility. Memorising the letters matters less than executing the five steps above in the right order.

KPMG’s scandal isn’t finished. ASIC has multiple investigations running, a further parliamentary hearing is scheduled for 12 November 2026, and the firm’s pause on bidding for new federal contract work is due to lift, or not, at the end of September.

Whether the organisation recovers will depend less on any single statement and more on whether it has, belatedly, started walking the five steps in the right order.

Organisations that build this discipline before a crisis arrives spend far less time playing catch-up during and after one.