Crisis management

What it means

Crisis management is preparing for and handling unexpected events that threaten a company's operations. These may include losing a key supplier or customer, a cyber attack, fire, flood, an accident, serious illness or departure of the owner, or a sudden loss of financing.

It covers a crisis team with clear roles, scenarios for the most likely crises, procedures for the first hours and days, crisis communication and a recovery plan. It is closely linked to risk management, which aims to prevent crises, and to the business continuity plan.

For a small company it is not about thick manuals but about answers to a few questions: who decides when the owner is unavailable, where backups and access credentials are kept, who calls key clients and how long the company can survive without income. Those answers should be written down and accessible.

How it works in practice

It helps to run through crisis scenarios as an exercise once a year. For example: what do we do if ransomware encrypts the accounting system the day before a tax return deadline? The exercise reveals missing contacts, outdated backups or unclear responsibilities before a real crisis hits.

In IT incidents, the disaster recovery plan and tested backups are decisive. When a supplier fails, alternative suppliers and adequate stock help. When a key person falls ill, documented processes and cover arrangements help, so that knowledge does not live in one person's head.

The financial side is a cash reserve and knowing how many months of fixed costs the company can cover. It is also worth checking insurance, such as business interruption or cyber cover, and knowing exactly what it covers and how quickly a claim must be notified.

What to watch out for

Crisis management is not the same as the legal concept of a company in crisis, which in the Commercial Code refers to a company that is insolvent or close to it. An operational crisis can, however, quickly turn into a financial one, and then strict rules apply to directors and shareholders.

The biggest mistake is assuming it will not happen to us. Plans written once and never updated are useless in a crisis because they contain old phone numbers, former employees and cancelled services. Reviewing them fits well with the year-end close or the annual risk review.