Most Companies are Not Prepared for a Crisis

We need to do more to strengthen our crisis resilience, says risk, crisis and business continuity management expert Caroline Sapriel.

If there was ever a mantra for crisis management, a good one would be, "If you fail to plan, you are planning to fail." While Benjamin Franklin is said to be the source of this quote, it has been cited by many who emphasize the game-changing impact of planning for survival and success. Preparation and planning are vital to crisis survival, recovery and business continuity. In reality, many organizations are not prepared or not prepared enough.

Anticipate, Prevent & Mitigate

A crisis is often said to be unpredictable. The world has become riskier in the last decade, with conflict, political instability and violence driving the increased risk. This growing risk of disasters and humanitarian crises at the global level can cause a crisis for organizations. The World Economic Forum’s latest Global Risks Report 2025 highlights the risks leadership expect to face now and in the coming decade. Misinformation and disinformation are the top-ranked short- to medium-term concerns (two-year period) for the second consecutive year, followed by extreme weather events. Environmental risks are the greatest source of long-term concern (ten-year period), and are expected to intensify over the next decade. The top four long-term risks are extreme weather events, biodiversity loss and ecosystem collapse, critical change to earth systems and natural resource shortages, while misinformation and disinformation follow in fifth place. Given these increasing risks and the extent of our exposure to them in recent years, it is clear that we need to do better at strengthening our crisis resilience.

Whether it’s a global pandemic, armed conflict, a cyber attack or a misinformation social media blowout, nobody is immune to the consequences of a crisis, regardless of industry or geography. The same applies to a crisis where an organization or institution are directly implicated, such as fraud, sexual harassment, corruption, or product safety violations. In a book I co-authored with long-time associate Dirk Lenaerts, we examined some of the biggest crises over the past three decades. We applied two criteria to assess how effectively a crisis was handled (by the company, government or institution involved): the level of attribution of responsibility and the response in terms of how the crisis was handled, with each assigned high, medium or low. One of the differentiators between a crisis with a good, bad or truly ugly outcome was preparation.

In an interconnected world, a crisis has far-reaching consequences and will eventually affect all of us. So, to sustain operations during a crisis or resume or restore activities afterwards, organizations must invest time and resources to prevent or mitigate the impact of a crisis, as well as prepare to respond quickly to emerging and unexpected chaos. Decisions and actions made before, during and in the aftermath of a crisis can dramatically affect a company’s reputation, financial performance, and even survival. Preparation can make a difference.

Boost Resilience & Recovery

A crisis management plan helps organizations deal with adverse events. It's a roadmap for challenging conditions that prepares managers and employees in the face of unexpected situations and circumstances. An effective crisis management plan provides organizations with:

•          The steps to act quickly and appropriately under pressure •          Clear roles and responsibilities for crisis response teams

•          Clear guidelines for communicating with internal and external stakeholders •          Critical information, practical action checklists and templates •          The tools to minimize long-term damage to their reputation.

This preparation enables leadership teams to anticipate and be ready for likely escalations. It also helps to protect people and assets while addressing the needs of other stakeholders. Planning and preparation allow compliance with regulatory requirements or contractual obligations that can help reduce legal complications. Despite this, many companies are not prepared for a crisis.

Capterra’s 2023 Crisis Communication Survey of senior leaders found that less than 50% of businesses in the US have a formal crisis communications plan. Another 28% have an informal crisis communications plan, and 23% don’t have (or aren’t sure if they have) one. Research shows that the level of preparation differs between larger and smaller businesses. Small and medium-sized companies are less likely to incorporate crisis management measures due to fewer resources. While smaller companies might be more agile and react faster when faced with a crisis or shock compared to larger organizations, research shows they’re often less prepared to deal with them.

Aware of Risks, But Preparation Is Limited

Fusion Risk Management surveyed employees from organizations around the world and found that among US employees, 28% believe their companies are not prepared for disruptions such as natural disasters, cyberattacks or tech failures. Among international employees, 23% said their organizations were not prepared. The research found that while aware of the risks brought on by natural and human-caused events, organizations fell short in some areas of readiness. Most surveyed in the US said their organizations have written plans to address natural disasters (83%), cyber threats and attacks (65%), and active shooters (62%). Among the international participants surveyed, 68% indicated their companies had written plans for cyberattacks, with the second most popular type of written plan being for a natural disaster (62%), and the third was for a potential tech failure (50%).  

While some preparation is in place, many companies aren’t regularly assessing their vulnerabilities and checking if plans are current and relevant to emerging threats. The Fusion study found that in the US, 53% of organizations update their emergency preparedness plans annually, while 28% don’t regularly test or update their plan at all. Internationally, 49% of organizations annually update their plans, while 19% do not regularly test or update them.

The Perils of Poor Preparation

Poor or lack of preparation makes crisis management much more challenging. In the heat of a crisis, untrained staff can be indecisive and even panic. Preparation and training empower employees to respond more effectively to an unfolding situation. Testing and exercising plans via emergency and crisis simulation practices help increase awareness of what to do and equip teams with skills to enhance decision-making and response actions. Preparation also includes planning for investigating and documenting the incident, which will help determine insurance coverage and speed up the claims process. Robust crisis readiness includes clear communication guidelines for employees, media, partners and other stakeholders. Digital tools provide a practical resource for strengthening the robustness and sustainability of crisis resilience programmes cost-effectively and efficiently. CrisisScan™, a unique proprietary crisis readiness diagnostic platform created by my company, CS&A, helps organizations assess and benchmark their preparedness year-on-year so that clear improvement objectives can be defined and tangible results achieved.

Another cost-effective way to enhance crisis leadership and response skills is CrisisEcademy™, our suite of dynamic crisis management and communication eLearning courses. A critical aspect of preparedness and response is to ensure that designated spokespersons know what to say, especially when under pressure: OnPoint™, our unique proprietary App, facilitates credible communication and contains reputational damage during adverse times. This resource and other crisis software solutions enhance organizations’ resilience before, during and after a crisis. (Learn more about CS&A’s crisis management solutions here.)

Crisis preparedness is a must-have and not merely a nice-to-have for organizations. Like a life jacket, which you hope you’ll never need, you know where to find it and how it works if you do.

Don’t wait for a crisis to occur to test your readiness. Strong crisis preparedness can minimize negative fallout and promote a faster recovery. Let’s flip the adage of failing to plan, you are planning to fail. Instead, aim to master crisis resilience by investing time and resources in preparation, training and practice. Only then can you navigate uncertainty from survival to success.

Caroline Sapriel is Managing Partner of CS&A International, a consultancy specialising in risk, crisis, and business continuity management. With over 30 years of experience in risk and crisis management, she is recognized as a leader in her profession and acknowledged for her ability to provide customized, results-driven counsel and training at the highest level.