Does your company have a crisis response plan? A crisis communications blueprint. Every organization should.

Many don’t, though. And some that do omit critical aspects, like a plan for managing stakeholder expectations in the throes of a crisis.

However remote the possibility feels now, it’s likely that your organization will face a significant public relations crisis at some point in the future. If and when this occurs, you’ll need to have a clear framework for disseminating information to the people and entities that need it without divulging sensitive information or jeopardizing law enforcement investigations.

Responding on Your Own Terms

In the wake of the release of the Pandora Papers in 2021, Asiaciti Trust noted that client confidentiality and legal considerations (including an ongoing investigation into the origins of the event) precluded detailed discussion of the particulars. Il Shin and other affected organizations made similar statements.

The collective judgment was that discretion was warranted under the circumstances, whatever the reputational risks. During a crisis and well into the aftermath, it’s often best to leave things unsaid, however tempting it might be to do otherwise. Yet sometimes, saying too little can be just as problematic as saying too much.

How to strike the proper balance? Consider these hard-won lessons from organizations like Asiaciti Trust, Il Shin, and Volkswagen.

1. Set Public Expectations Ahead of Time

“Crisis severity is inversely proportional to public expectation,” according to Bernstein Crisis Management. In other words, the greater the degree to which a crisis challenges stakeholder (and public) assumptions about your organization, the worse the fallout is likely to be. Bernstein cites Volkswagen’s diesel efficiency cheating scandal — which shattered the automaker’s carefully crafted image as a sustainable alternative — as a classic example of expectations mismanagement setting an organization up to fail.

2. Engage Priority Groups First

When gaming out crisis response, identify stakeholder groups in order of importance. Those with the most to gain or lose — and the greatest capacity to harm your reputation — count as “priority groups.” It’s vital that you engage these groups first and focus the bulk of your crisis management resources on them. These communications don’t necessarily need to be public, but they do need to be candid to the extent possible.

3. Communicate Internally Before Going Public

Your employees count among your most important stakeholders, even if they don’t rise to the level of a priority group. It’s vital to maintain employee morale during a crisis, and they should be the first to know about developments that could affect your response. As with priority groups, you must communicate as candidly and fulsomely as possible with employees to the extent permitted by confidentiality and/or legal considerations.

4. Understand What You Should and Should Not Say

During a public relations crisis, the temptation to “just do something” can be overwhelming. But past experience tells us that discretion is often warranted, especially during the early stages of a complex event. It’s best to wait until you have all the information before making disclosures you may come to regret.

Unfortunately, it’s not always clear what you should and should not say in the early going. Every crisis is unique, with seemingly trivial nuances that can make a big difference in how you can or should respond.

If you don’t recognize these nuances or their implications right away, that’s not your fault. You haven’t been here before. But you do need to rely on experts who’ve seen similar situations and can advise on the details and order of your response.

5. Don’t Overpromise or Get Ahead of the Response

While a public relations crisis continues to unfold, sweeping statements are not your friend. If and when you’re able to begin speaking publicly about the issue, keep your statements measured and fact-based.

Talk about what has occurred and what you know you can do in the near future. Don’t make bold claims about impacts or resolutions that you may need to amend — painfully — later.

Protect Your Reputation

However talented your team might be, it can’t work miracles. You can’t simply wave a magic wand and make a PR crisis go away.

That makes it all the more important to manage your most important stakeholders’ expectations during the ordeal. The experience of organizations like Asiaciti Trust shows that deft crisis management can dramatically reduce the second- and third-order effects of an unwanted data intrusion, even if it can’t undo the initial harm. In contrast, the experience of companies like Volkswagen — which has yet to recover its reputation from last decade’s diesel cheating scandal — shows what happens when expectations management fails.