Most reputation crises are not lost because of what happened. They are lost because of what happened next.
A product failure, an allegation against a senior executive, a data breach, a leaked document, a social media storm: the triggering event matters, but the lasting damage is usually shaped by the response. In the first seventy-two hours, stakeholders — employees, clients, investors, regulators, journalists — form a judgement not only about the facts, but about the character of the organisation and the person leading it. That judgement is remarkably hard to reverse.
The following framework reflects how experienced leaders approach those first three days.
Hour zero: resist the urge to speak before you know
The instinct under pressure is to act immediately — to issue a statement, deny, reassure. It is often the wrong first move.
Before anything is said externally, leaders need a clear view of three things: what is known for certain, what is not yet known, and what could still emerge. Statements made on incomplete information have a way of becoming the story themselves when later facts contradict them. A premature denial that has to be withdrawn does more damage than the original problem.
This does not mean silence. A short holding statement — acknowledging the situation, confirming that it is being taken seriously, and committing to provide more information — buys time without creating hostages to fortune.
The first six hours: assemble a small team and establish the facts
Crisis decisions should be made by a small, trusted group, not by committee. Typically this includes the CEO or principal, legal counsel, a senior communications lead and one or two executives with direct knowledge of the issue. An independent advisor who is not personally exposed can help the group see the situation as outsiders will.
The priority is a fact base. What exactly happened? Who knew what, and when? What documents, messages or recordings exist? What is the legal exposure? Where are the people affected, and what do they need?
Establishing a single, maintained timeline of facts prevents the most common internal failure in a crisis: different people telling different versions of events.
Day one: decide what you stand for before deciding what to say
Communications follow decisions, not the other way around. Before drafting messages, leaders must decide their position on the substance.
Is the organisation at fault, partly at fault or not at fault? What will be done for those affected? Who is accountable, and what happens to them? What will change to prevent a recurrence?
Audiences forgive mistakes far more readily than they forgive evasion. A clear acceptance of responsibility, where it is warranted, combined with concrete action, almost always does better than a technically defensible but emotionally tone-deaf response. Equally, where the organisation is genuinely not at fault, a calm and evidenced position is stronger than defensive aggression.
Day one to two: sequence your audiences
One of the most damaging errors in a crisis is letting key stakeholders learn about it from the media. Employees, major clients, lenders, significant shareholders and regulators should, wherever possible, hear directly from the organisation — before or at the same time as the public.
The order matters. Regulatory obligations come first. Those directly harmed come next. Employees, who will be asked about the crisis by friends, clients and journalists, need enough information to avoid speculation. Then investors, partners and the wider public.
Each audience needs a message adapted to its concerns, but all messages must be consistent. Inconsistency between what the board hears and what the press reads is quickly discovered.
Choose the right voice
Who speaks is as important as what is said. In a serious crisis, stakeholders expect to hear from the person in charge. Delegating the response entirely to a spokesperson can look like distance or avoidance.
But visibility must be prepared. A leader who appears on camera without rehearsal, who is unsure of the facts or who reacts emotionally to hostile questions can turn a manageable situation into a defining one. Preparation — anticipating the hardest questions, agreeing what cannot be said for legal reasons, and practising concise, human answers — is not a luxury.
For public figures, the line between personal and professional reputation is especially thin. Personal statements must be weighed against legal advice, family considerations and long-term positioning, not just the pressure of the moment.
Days two to three: monitor, adjust and avoid fuelling the fire
By the second and third days, the dynamics usually become clearer. Is the story growing or fading? Are new facts emerging? Are particular audiences — a regulator, a major client, an activist group — reacting more strongly than expected?
This is the time to adjust, not to over-communicate. Repeated statements, public arguments with critics and reactive social media posts can keep a story alive long after it would otherwise have faded. Restraint, combined with visible progress on the commitments made, is often the most effective communication.
After the storm
The first seventy-two hours shape the narrative, but recovery takes much longer. Organisations that emerge stronger from a crisis do three things afterwards: they follow through visibly on what they promised, they conduct an honest review of what allowed the crisis to happen, and they invest in preparation for the next one — scenario planning, clear roles, and pre-agreed decision rights.
The best time to prepare for a reputation crisis is before it begins. The second-best time is in the first hour, with the right people in the room and the discipline to know before you speak.