How do you write a communication plan?

Australia’s corporate regulator confirmed in June a formal investigation into three KPMG Australia partners, following whistleblower allegations that the firm misused confidential client data to win audit contracts.

The firm’s chief executive and its audit chief had already resigned the week before.

Blue-chip clients started asking questions of their own. Dexus said its 2026 accounts would not be signed off by the partner previously handling them, and pension fund REST, which uses KPMG as internal auditor and tax agent, said it was seeking more information.

Reserve Bank Governor Michele Bullock told a Senate hearing that KPMG would not be reappointed to the bank’s whistleblower service.

None of that unfolded in a single afternoon. It built over weeks, in public, one disclosure at a time.

When a communication plan does not exist before a crisis, an organisation ends up answering questions in the order journalists ask them, not the order that protects stakeholders, staff, and the truth.

Every business faces its own version of this problem, whether the trigger is a data breach, a product recall, or a governance failure that surfaces through a whistleblower. The mechanics are always the same. Someone outside the organisation asks a question the organisation has not yet prepared to answer, and the gap between the question and the answer becomes the story.

Peter Wilkinson has spent over 50 years watching that gap play out, first as a journalist chasing the story a company was failing to control, now as the adviser called in to close it before it opens.

Most plans start in the wrong place: the message. Before a word is drafted, list every audience that needs to hear from the organisation directly, and in what sequence. The Board, then employees, because they should never learn about a crisis from a news alert. Then clients, suppliers, and regulators next if disclosure obligations apply. Sometimes media comes after, not before.

This is genuinely an issues management discipline, not a crisis one. Early, structured monitoring across media, social, regulatory, and stakeholder channels tells you which risks are already visible before they escalate, which is the entire premise behind a proper issues management approach. A stakeholder map built during a live crisis is always incomplete, because someone is inevitably discovered halfway through and added late. A stakeholder map built in advance is simply consulted, checked off, and executed.

A communication plan needs three distinct messages, each doing different work. The incident message states the facts and the timeline, cleanly and without spin. The company message sets out values and the commitment to fix what went wrong. The personal message is the leader’s own, in their own words, showing they understand what the failure actually cost people.

Boards often collapse these into one bland paragraph, because a committee wrote it and nobody wanted to sound too exposed. That caution is precisely why the statement reads as evasive. Consistency across all three messages, not caution, is what audiences actually notice.

A plan is only as fast as its slowest approval step. The organisations that respond well in the first hour have already decided, in writing, who speaks, who approves, and who is briefed but silent. That decision cannot be made once the story has broken.

This is where senior, confidential counsel earns its keep long before an incident occurs. An adviser who already understands the business does not need an onboarding conversation at eleven at night. They need the phone number.

Trust = Truth + Transparency + Traceability. That third element is the one most plans still ignore. Your history is traceable in seconds now. Every past statement, every promise, every prior denial sits somewhere searchable, ready to be compared against whatever the organisation says next.

A communication plan that only manages the current moment, without checking it against everything the organisation has said before, is building on sand. Genuine reputation management work treats consistency over time as the actual asset being protected, not the headline of the week.

The final step is the one so many skip. A plan that has never been rehearsed is a plan that exists only on paper. Run it as a simulation, with real time pressure and a genuinely difficult scenario, and the gaps surface immediately: the spokesperson who freezes, the approval chain nobody had tested, the regulator nobody remembered to loop in.

Proper crisis communications preparation happens well before the event, not during it. That is the difference between an organisation issuing a considered statement within hours and one still drafting its first line while clients quietly walk out the door.

Simulation also reveals whether the plan actually matches how the organisation behaves under real pressure, rather than how it hopes to behave in theory. A plan that survives a rehearsal with a genuinely hostile scenario, sharp questions, and a tight deadline is a plan you can trust when the deadline is real.

A communication plan is not a document you file away. It is a decision, made in calm conditions, about how the organisation will behave under pressure. Write it before you need it, and you will never have to write it while the story is already running.