Crisis communications: when something goes wrong

This guide is for leaders and volunteers at small charities who want to be ready if something goes wrong: an accident at an event, a data breach, money that goes missing, a complaint that spreads online, or a staff member or volunteer in the news. Most small charities never face a big crisis, but many face a small one, and how you respond often matters more than what happened. After reading, you will know what to do in the first 24 hours, who should speak, and how to stay honest when you don't have all the answers.

What counts as a crisis

A crisis is any event that could seriously harm the people you serve, your volunteers, or the trust people place in you. Examples:

• Someone is hurt during your program
• Personal data about donors or clients is lost or stolen
• Money is missing or misused
• A serious complaint about a volunteer or staff member
• A negative news story or a social media post that spreads fast
• A natural disaster that stops your services

Not every complaint is a crisis. A grumpy comment online is usually just a comment. The test is: could this hurt people or badly damage trust if we handle it poorly?

Before anything happens: a one-page plan

You will think more clearly if you decide some things in advance. Write a one-page crisis plan with:

• Who leads the response. Usually the board chair or executive director.
• One spokesperson, plus a backup. Only this person speaks to media or posts official statements.
• Who must be told, and how fast: board, insurance company, lawyer, bank, police, funders, and any regulator.
• Phone numbers for these people, stored where more than one person can reach them.
• Logins for your website, social media, and email list, so you can post an update even if one person is unavailable.

Review the plan once a year at a board meeting.

The first 24 hours

Hour 1: make people safe

Safety comes before statements. If anyone is hurt or at risk, call emergency services. Protect the people you serve. If data may be exposed, stop the leak (for example, change passwords or take a page offline).

Hours 1 to 3: gather facts and your team

• Call your crisis lead and spokesperson.
• Write down what you know, what you don't know, and how you know it. Note times.
• Preserve evidence. Don't delete emails, posts, or files, even embarrassing ones.
• Tell your board chair if they don't already know.
• Call your insurance company. Many policies require you to report incidents quickly.
• Get legal advice if the situation involves injury, possible crime, data, or employment issues.

Hours 3 to 12: tell the people most affected first

People directly affected should hear from you before they read about it online. That may be families, volunteers, staff, or donors. Use a phone call where you can. Be kind, be clear, and tell them what you are doing and how to reach you.

Hours 12 to 24: a short public statement, if needed

Not every crisis needs a public statement. If the issue is already public, or likely to become so, a short holding statement helps. It says:

1. What happened, in plain facts you are sure of
2. That you care about the people affected
3. What you are doing now
4. When you will update people next

Hypothetical example: "On Tuesday evening, a volunteer was injured while unloading our food delivery. They were treated at the hospital and are recovering. We are reviewing what happened and how we handle deliveries. We will share an update by Friday."

Honesty is your best protection

Some honest habits:

• Say sorry when you are at fault. A real apology names what went wrong and what you will change. Check wording with a lawyer if there is legal risk, but don't let fear stop you from showing that you care.
• Don't blame individuals in public. Deal with people privately and fairly.
• Protect privacy. Never share names, health details, or personal information about the people involved without consent.
• Don't speculate about causes, and don't comment on any legal case beyond the basic facts.
• Stay out of politics. A 501(c)(3) charity must not support or oppose candidates, even when a crisis becomes political.

If personal data is involved

A data breach (when personal information is lost, stolen or exposed) has its own rules. The FTC's data breach guide says all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information. The rules differ by state. The FTC advises you to talk to legal counsel, notify law enforcement where appropriate, and tell affected people what happened and what they can do to protect themselves. Get advice early, because some state deadlines are short.

Media and social media

• Only your spokesperson talks to reporters. Everyone else says: "Thank you, I'll ask our spokesperson to call you."
• Return reporters' calls. "No comment" sounds like you are hiding something. A short, honest statement is better.
• Post one official update in one place (your website or main social channel) and point to it everywhere else.
• Answer questions in comments with the same facts. Don't argue. Delete only content that is abusive, threatening, or exposes private information.

After the crisis

When things calm down, hold a short, blame-free review:

• What happened, and why?
• What did we do well?
• What would we do differently?
• What will we change, and who will do it by when?

Tell the people affected what you changed. Following through is how you rebuild trust.

The CDC runs a free program called Crisis and Emergency Risk Communication (CERC), built for health emergencies. Its materials are useful reading for any organization that might one day need to communicate under pressure.

Your crisis checklist

• Name a crisis lead, a spokesperson, and a backup for each
• Write a one-page plan with key phone numbers
• Make sure at least two people can log in to your website and social accounts
• Know how to contact your insurance company and a lawyer
• Draft a holding statement template you can adapt quickly
• Review the plan with your board once a year

No organization gets everything right. Charities that come through a crisis with their reputation intact are usually the ones that acted fast, put people first, and told the truth.

If you want help writing your crisis plan, ask a member charity for help through the Exchange.

General information, not legal, tax or financial advice. Rules change and every situation is different, so check the official sources and talk to a qualified professional before you act.