In the dozens of corporate crises I've coached leadership teams through — from senior-executive departures to data breaches to customer-trust incidents to founder-cofounder splits — the same pattern holds: the leaders who navigated well had a sequence in mind. The leaders who flailed had reactions instead of a sequence.
This isn't about preventing crises. Most are unpreventable. It's about what to do in the first 90 days after one hits — when every decision is being made under pressure with incomplete information, and the cumulative effect of those decisions determines whether the organization recovers or unravels.
Below is the 90-day sequence I walk leadership teams through. Three phases: triage (day 0–7), stabilization (week 2–4), recovery (month 2–3). Each phase has specific objectives and a clear end-state that defines when you transition to the next.
Phase 1: Triage — Day 0 through Day 7
The first 168 hours are the most consequential. Three objectives.
Stop the bleeding
The first action in any crisis is containment. Whatever the crisis is — a security breach, an executive resignation, a customer incident, a product failure — the first question is: is this still getting worse, and what stops that?
Specific moves:
- Identify the active failure. Not the root cause yet — just what's deteriorating in real time.
- Take whatever action stops further damage, even if it's blunt. Take the system offline, freeze the deal, pause the campaign, sideline the executive in question. You can refine later; momentum is on the side of further damage if you don't act.
- Establish a single source of truth. One channel — Slack channel, war-room thread, or daily standup — where all incident- related communication flows. Side-channels create misalignment that costs hours.
Set up command structure
The second action is deciding who decides. Most crisis escalations get worse because nobody's clear on who has authority to make which calls.
The structure I recommend for the first week:
- Incident commander: one named person, end-to-end authority for the crisis response. Usually the CEO for executive-level crises, the CTO for technical incidents, the CRO for customer incidents.
- Communications lead: one named person responsible for all external communication (customers, press, investors, regulators).
- Operations lead: one named person responsible for the internal team — making sure people have what they need, are aligned, and aren't burning out.
- Daily war-room standup: 30 minutes, 9am, every day. Status, decisions needed, blockers. End-of-day async update by EOD.
Communicate externally — fast and honestly
The third triage action is owning the narrative before someone else does. The companies that recover quickly from public crises communicate within the first 24–48 hours, even if the message is incomplete. The ones that don't usually face a worse second wave once external speculation outpaces internal reality.
The first communication should answer:
- What happened (in plain language, no spin).
- What we know vs. what we're still investigating.
- What we're doing about it.
- When we'll provide the next update (commit to a specific time).
That's the template. Even imperfect communication on day 2 is better than perfect communication on day 14.
End-of-week-1 checkpoint
Before transitioning to stabilization, the leadership team should be able to answer:
- Is the active failure contained? (yes/no)
- Is the command structure in place and accepted? (yes/no)
- Have we communicated externally to all affected parties? (yes/no)
- Do we have a daily rhythm running? (yes/no)
If any of these is "no," you're still in triage. Don't move to stabilization until they're all "yes."
Phase 2: Stabilization — Week 2 through Week 4
Once the immediate damage is contained, the next three weeks are about building durable operating ground while you investigate the underlying issues.
Investigate without preconceptions
A real incident review takes 1–3 weeks. Done well, it produces:
- A factual timeline of what happened, hour by hour where relevant.
- Identified contributing factors (plural — almost no crisis has a single root cause).
- Specific systemic gaps that allowed it to happen.
- Recommended interventions to reduce the probability of recurrence.
Done badly, it produces a blame document. The difference: a good investigation focuses on systems and decisions; a bad one focuses on people. Both contain the same individuals, but the framing determines whether the organization learns or scapegoats.
Stabilize the team
Crisis takes a toll on the people closest to it. By week 2, the team that responded heroically in week 1 is starting to burn out. The leadership job in stabilization is to prevent the burnout from becoming the next crisis.
Specific actions:
- Rotate first-responders out of the war room for at least 3–5 days each. Bring in second-line replacements.
- Acknowledge the cost publicly within the team. Not as a speech — as a written note, a one-on-one conversation, a meaningful gesture.
- Restart non-crisis work selectively. Letting the rest of the company drift while the crisis team handles the incident creates a longer-term cultural problem. By week 3, normal operations should be 70% restored.
Communicate the second wave
By week 2, the initial communication is stale. Stakeholders need an update. The second-wave communication is different from the first:
- Less about what happened, more about what's being done.
- Specific milestones with dates.
- Acknowledgment of impact on the people affected.
- Beginning to point toward the path forward.
This is the communication that determines whether stakeholders feel informed or abandoned. The difference is measurable in customer churn, employee retention, and (for public companies) stock volatility over the next 60 days.
End-of-month-1 checkpoint
Before transitioning to recovery, the team should be able to answer:
- Is the investigation complete or on track?
- Are we operating at 70% normal capacity?
- Has the team rotation prevented burnout casualties?
- Have we communicated a clear path forward externally?
Phase 3: Recovery — Month 2 through Month 3
The recovery phase is where most companies get it wrong. The crisis feels over; people want to move on; the leadership team is exhausted. The temptation is to declare victory and return to normal.
This is exactly when the systemic improvements that prevent recurrence don't get made. The crisis fades from memory, the investigation report sits unread, and 14 months later a variant of the same incident happens again.
The recovery phase has three specific objectives.
Implement the systemic changes
Take the investigation's recommendations and assign each to a named owner with a deadline. Not "the team will look at this" — Sarah owns implementation of X, deliverable by date Y.
Track the recommendations through to completion in your normal operating cadence. Most should be done within 90 days post- incident; the longer-horizon ones should have monthly check-ins.
Conduct the after-action review
A formal post-mortem with the full leadership team and the people closest to the response. Honest, with the goal of organizational learning, not assigning blame.
The questions:
- What worked in our response that we should institutionalize?
- What didn't work that we should change?
- What did we learn about the organization that we didn't know before?
- What's our risk profile now vs. before the incident?
Document the answers. Reference them when the next crisis hits.
Restore trust
The hardest and longest recovery work is trust restoration — with customers, employees, investors, partners. This is the work that determines whether the company emerges stronger or permanently weakened.
Specific actions:
- Personal outreach to the most affected stakeholders by name. Not template emails — real conversations.
- Visible commitment to the systemic changes. Don't just implement them — communicate the implementation.
- Cadence of follow-up for 6–12 months. The crisis ends in the company's mind long before it ends in stakeholders' minds.
What separates good crisis leadership from bad
After a decade of coaching teams through these, the patterns:
Good crisis leaders:
- Move fast on containment, even with incomplete information.
- Set up clear command structure within the first 24 hours.
- Communicate honestly and frequently, even when the news is bad.
- Protect the team from burnout.
- Take the systemic-improvement work seriously after the immediate crisis ends.
Poor crisis leaders:
- Wait for full information before acting (the crisis worsens during the wait).
- Try to manage by committee with unclear authority.
- Hide bad news, hoping it'll improve before disclosure.
- Run the team into the ground.
- Declare victory too early and skip the systemic work.
The patterns are observable in real time. The good news is that crisis-leadership skills are learnable — the framework above is literally a teachable sequence. The leaders who internalize it respond better to the next crisis. The ones who don't repeat the same mistakes.
You can't prevent every crisis. You can absolutely build the muscle of responding well. Walk the next leadership offsite through this 90-day sequence as a tabletop exercise. The hour you spend now will save days when the real incident hits — and some kind of real incident will hit, eventually, regardless of how well-run the organization is.
