Is your organisation crisis ready?

When the CEO of Australian telco Optus first learned of its devastating 2022 data breach, she was about board a plane from LAX to Sydney.

The Qantas plane had no wifi.

It’s that compounding of real-life complications that so often impedes a crisis response.

As it did for Optus.

The Optus data breach impacted nine million customers

How would your C-suite react if this happened to your organisation?

Here are five practical questions to test your crisis readiness right now.

1. When a journalist calls your team for comment on a sensitive issue, do you have a clear protocol for what happens in the next 60 minutes?

Who gets notified? Who decides whether to respond, and who manages the response?

Approval bottlenecks are among the most common points of failure. The communications team has a statement ready. Legal and regulatory want to review it. The CEO is unreachable.

Two hours pass. The journalist publishes without your comment.

At that point, the delay becomes part of the story.

2. When did you last update your crisis communications plan, and does it include scenarios involving AI-generated misinformation or social media pile-ons?

If your plan was last reviewed pre-2023, it was probably written before the threat environment your organisation faces today.

Deepfakes of executives. Fabricated product failures. AI-generated news clips. These are emerging threats that can throw your real crisis response off kilter. Think of the fake Astronomer CEO apology that went viral after the Coldplay 'kiss cam' scandal.

Or this year's DoorDash whistleblower post on Reddit exposed as an AI-generated hoax.

The decline of trust in businesses means that, in a crisis, you’re already on the backfoot before the misinformation starts to slop in.

It's worth mapping these scenarios out. Think through how you would respond, before you need to.

3. If a crisis broke at midnight on a Friday, who has the authority to sign off on a response?

Spare a thought for the Heathrow Airport CEO who slept through a major emergency because his phone was on silent.

News cycles and social media don’t wait for the Monday morning meeting. Who do you call on your team for the after-hours scramble in an overnight emergency? Are they genuinely empowered to act, or are there others who need to be alerted first?

4. Do your CEO, CFO, and Head of HR give consistent answers when asked what your organisation stands for?

Message inconsistency suggests the work hasn’t been done to align the business on your purpose, values and commitments.

Your ability to speak to those values, to all stakeholders and with one voice, is vital when your leadership is under pressure. It’s not something you can improvise in a crisis.

5. Has your team run a live crisis simulation with the clock ticking and real pressure applied?

Knowing your plan and being able to execute it under pressure are two very different things.

Tabletop exercises, with realistic scenarios, real time constraints, and genuine pressure, will reveal much about your team's decision-making that no document audit could.

If a crisis simulation feels uncomfortable, it’s only a fraction of what the real thing is like.

Many organisations have reviewed their plan. Far fewer have actually tested it within the last 24 months.

What the answers tell you

If you hesitated in answering more than two of these questions, you have work to do.

It means the gap between your assumed preparedness and actual readiness is wider than it should be.

Closing that gap takes time: building or reviewing a crisis plan, testing it under pressure, training the people who have to execute it, and aligning roles and messages across the leadership team.

The best time to engage a crisis communications consultant is at least six months before you think you'll need one.