What are the essential steps for creating an effective crisis management plan for a small business?

A crisis management plan is not a folder in a drawer. It is a set of decisions a small business makes before pressure lands, so judgement never has to compete with panic.

Most owners never write one down. The plan for crisis management exists half-formed in someone’s head, until the first hour of a real crisis proves it was never a plan at all.

Most owners assume a corporate crisis management plan belongs to listed companies with a comms team on staff. It doesn’t.

A large organisation can usually absorb a bad week of headlines. It has other divisions, other stories, somewhere else for attention to land.

A small business rarely has that cushion. The owner’s own judgement gets tested first, and often alone.

This overlaps with broader crisis communications practice, just scaled for a business with no dedicated team behind it.

Speed compounds the exposure. A single complaint or a filmed incident can reach a wide audience within hours, often before the full picture is known.

Waiting to respond is never neutral. It reads as evasion.

The correct starting point for any business crisis management plan isn’t the document itself. It’s naming, in advance, the one person authorised to approve what gets said.

I ask every small business owner the same question first: if something went wrong tomorrow, who decides what we say?

Most can’t answer immediately. That gap is the real risk.

Ambiguity over who speaks is most dangerous exactly when it’s hardest to resolve, mid-crisis, under pressure, with a journalist already calling.

In August 2024, the Sydney Morning Herald published a months-long investigation into Swillhouse Group, the founder-led business behind several well-known Sydney venues. Former staff alleged sexual assault, harassment and on-shift drug use, and that management minimised complaints.

Swillhouse’s public response arrived a day after the story broke. It apologised for staff feeling “unsupported and at risk.”

That framing read as minimisation, not acknowledgment, because several allegations were recent.

The fallout spread fast. Gourmet Traveller dropped Restaurant Hubert from its guide within days. Sponsors abandoned the group’s debut festival, Swillfest, which was cancelled within days of the report. Founder Anton Forte stood down from the board of the Australian Restaurant and Cafe Association.

None of that damage stayed contained to one venue. It spread across the whole group, because the group had no visible plan for containing it.

Every credible company crisis management plan rests on the same six elements, no matter its size. Skip one, and a manageable issue turns existential.

1. Map the realistic scenarios first.

Scenario mapping means listing the crises specific to your business, not a generic industry checklist.

A hospitality group maps harassment complaints and workplace safety. A retailer maps a data breach. A tradesperson maps a serious injury on site.

This is the foundation of good issues management. Most crises are visible as smaller issues long before they escalate into a public one.

2. Name one decision-maker.

This means naming, in advance, the single person, or small nimble team, authorised to approve what gets said. It isn’t a committee.

A crisis run by committee moves too slowly to matter. For most small businesses, the team is the owner plus one or two trusted people, not a rotating cast of advisers.

3. Prepare the three messages early.

Every credible crisis response needs three distinct messages. The incident message states the facts and timeline. The values message states what the business is doing. The personal message, from the founder directly, states what they feel and will personally see through.

A weak personal message sounds lawyered: “We take these matters seriously and are committed to reviewing our processes.” A strong one sounds like a person: “I’m responsible for this business, and I will make sure everyone affected is heard and looked after myself.”

Leaving out that third message is the most common failure among privately owned operators. It’s also the one that rebuilds trust fastest.

4. Build a notification chain.

Decide in advance who needs to be told, and in what order.

Ensure staff hear it from the business before they see it online. A staff member who learns of a serious allegation through social media loses confidence quickly.

Ensure the board or any silent partners are briefed before a public statement, not after. Ensure clients and suppliers hear directly, in a short, calm message, before they read it in a press report.

Getting that sequence wrong is a common, avoidable mistake.

5. Draft holding statements early.

A weak holding line minimises: “We’re aware of the situation and take all feedback seriously.” A strong one commits: “We take these claims seriously. We’re establishing the facts and will update you within 24 hours.”

The plan itself is the strategy: the decision to acknowledge quickly and confirm slowly. The holding statement is the tactic built from that decision.

Refine it through basic media training, so whoever fronts a camera isn’t improvising for the first time.

6. Test the plan before you need it.

How often should a crisis management plan be reviewed? At least once a year, and whenever the business changes meaningfully: new venues, new risks, new people in key roles.

A plan that has never been rehearsed is only a theory. Staff who have practised it once tend to follow it under pressure. Staff who have only read it tend to default to saying nothing at all.

Most owners know they should have a plan. Few build one.

The reasons repeat: time is scarce, and an external adviser can feel like a discretionary expense, until the crisis stops being abstract.

Building a crisis management plan in Australia doesn’t require a retainer. A basic version can be built in a day or two, tested once a year, and updated whenever the business changes.

A tested plan costs a modest amount of time each year. An untested one can cost the entire business, as it nearly did for Swillhouse across a matter of days in 2024.

Larger organisations often keep this discipline current through an ongoing arrangement such as Wilkinson Confidante. A small business doesn’t need that infrastructure to benefit from the same principle, only the habit of treating the plan as current, not filed away.

A plan can’t manufacture trust it hasn’t earned. It can’t undo a bad decision made in year one.

Trust = Truth + Transparency + Traceability. A defensive line, once posted, is searchable indefinitely.

In a privately owned business, there’s rarely a clean line between the company’s reputation and the founder’s own. Customers and staff are judging the person behind the business, not a corporate entity several layers removed.

This is the pattern that recurs across the crisis files handled at Wilkinson Group: the businesses that struggle most are the ones where nobody had decided, in advance, who speaks and what they’ll say.

That same discipline, truth, transparency, traceability, is what underpins good reputation management long after the immediate crisis has passed.

A business crisis management plan for a small business comes down to six decisions, made before pressure lands:

1. Map the realistic scenarios.
2. Name one decision-maker.
3. Prepare the three messages: incident, values, personal.
4. Build the notification chain.
5. Draft holding statements early.
6. Test the plan every year.

The businesses that handle a crisis well are rarely the ones with the longest document. They’re the ones where the owner already knows who they’ll call first, and what they’ll say before anyone asks.

Write the plan on an ordinary day. The first hour of a real one is not the time to start.