Issues, Risk and Crisis Communication

Introduction and Context

Public relations management is tested most severely when an organisation faces uncertainty, scrutiny and potential harm. An issue is a matter of concern that may affect an organisation’s legitimacy, relationships or operating environment. A risk is the possibility that an event, action or condition will produce harmful consequences. A crisis is a serious threat that creates urgency, disrupts normal operations and requires decisions under intense public attention.

These concepts are related but not identical. Issues may develop gradually; risks may remain invisible until activated; crises require immediate coordinated action. Effective communication does not eliminate operational risk. Rather, it helps an organisation understand its environment, reduce avoidable harm, communicate responsibly and support recovery.

In contemporary practice, crisis communication is shaped by 24-hour news, social platforms, employee journalism, artificial intelligence, citizen reporting and rapidly changing expectations of transparency. Stakeholders often judge an organisation not only by what happened but also by whether it acted competently, fairly and honestly.

Learning Objectives

By the end of this chapter, students should be able to:

• distinguish issues, risks, incidents and crises;
• identify emerging issues and communication vulnerabilities;
• assess risk using qualitative and quantitative reasoning;
• design a crisis plan, response team, protocol and holding statement;
• manage real-time communication, misinformation and stakeholder expectations;
• support recovery, reputation repair and organisational learning; and
• evaluate crisis communication ethically and strategically.

1. Core Concepts

Issues

An issue is a topic, condition or controversy about which stakeholders, institutions or the public have competing interests or concerns. Issues may involve safety, labour practices, environmental impact, data privacy, diversity, political regulation or corporate conduct. An issue becomes strategically important when it can influence organisational decisions, stakeholder behaviour, regulation or reputation.

Issue management is therefore proactive. It involves environmental scanning, interpretation, stakeholder engagement, policy development and, where appropriate, organisational change. A public relations department should not merely monitor what people say; it should help management understand why an issue matters and what action is credible.

Risk

Risk refers to uncertainty about the effects of an event or decision on organisational objectives. Communication risk includes the possibility that inaccurate, delayed, insensitive or inconsistent communication will increase harm. Examples include:

• publishing an unverified claim;
• releasing personal information;
• using language that appears to blame victims;
• allowing different departments to issue contradictory statements;
• failing to communicate with employees before external audiences; and
• treating a public concern as a public relations problem when it is actually an operational failure.

Incident and crisis

An incident is an event that may be managed through normal procedures. A crisis exceeds routine capacity, threatens important values or causes significant uncertainty and public concern. A crisis may be sudden, such as a product contamination event, or smouldering, such as a long-term pattern of harassment complaints.

A useful distinction is:

2. The Strategic Environment of Issues

Issue life cycle

Issues often move through stages: emergence, amplification, formalisation, decision and resolution or transformation. A concern may begin with a small group, gain media or online attention, attract political interest and eventually lead to regulation or organisational change. The life cycle is not mechanical; issues can accelerate suddenly or reappear after apparent resolution.

Early identification provides more strategic options. At the emergence stage, an organisation can listen, investigate and modify practice. At the crisis stage, choices are narrower and more expensive.

Environmental scanning

Professional scanning combines multiple information sources:

• traditional and digital news;
• social listening and search trends;
• customer complaints and service data;
• employee feedback and whistleblowing channels;
• regulatory and legislative developments;
• competitor and supply-chain intelligence; and
• research from civil society, scholars and professional bodies.

Scanning must be interpretive rather than purely technological. A high volume of online discussion does not necessarily indicate high societal importance, while a low-volume concern may involve severe safety or legal exposure.

Stakeholder mapping

Stakeholder analysis should consider power, legitimacy, urgency, vulnerability and the organisation’s dependency on each group. Stakeholders may include employees, customers, communities, regulators, investors, suppliers, journalists and advocacy organisations. Vulnerable groups deserve special attention because equal communication treatment is not always equitable communication treatment. People with limited digital access, language barriers or heightened exposure to harm may require alternative channels and tailored support.

3. Risk Assessment for Communication Managers

Risk assessment helps prioritise preparation. A simple qualitative model classifies each risk according to likelihood and impact. A common planning convention is:

Here, likelihood and impact are ordinal ratings, such as 1 to 5. The product is a prioritisation aid, not a probability of loss. It assumes that the rating scales are defined consistently and that multiplying them is suitable for the organisation’s planning purpose.

For example, if a data disclosure is rated likelihood 3 and impact 5, its priority score is 15. A different risk rated likelihood 5 and impact 2 scores 10. The first may deserve greater senior attention even though the second is more frequent. Organisations should not rely on the score alone: legal duties, ethical severity and potential harm to vulnerable people may justify escalation.

A risk register can include:

The communication manager should ask:

1. What could happen?
2. Who could be harmed or affected?
3. What evidence would confirm the event?
4. Which authority has decision rights?
5. What must be communicated, to whom and when?
6. What information cannot legally or ethically be disclosed?
7. What operational action must accompany communication?

4. Crisis Communication Models and Principles

Situational Crisis Communication Theory

Situational Crisis Communication Theory (SCCT), associated with W. Timothy Coombs, argues that response strategy should reflect stakeholders’ attribution of responsibility and the organisation’s crisis history. A practical classification is:

• Victim crises: the organisation is also harmed, as in a natural disaster or malicious interference.
• Accidental crises: an unintended event occurs despite ordinary controls.
• Preventable crises: inadequate conduct, negligence or deliberate wrongdoing contributes substantially.

As perceived responsibility increases, stakeholders generally expect stronger corrective action, accountability and apology. The model is a guide, not a script. The organisation must first establish facts and avoid using theory to minimise genuine harm.

Image repair and legitimacy

Image repair approaches identify strategies such as denial, evasion of responsibility, reducing offensiveness, corrective action and mortification. These strategies should never replace truthfulness. Denial is appropriate only when evidence demonstrates that the allegation is false or the organisation is not responsible. Corrective action and apology are more credible when supported by measurable change.

Legitimacy theory explains why crises threaten more than reputation. Organisations depend on a social licence to operate: stakeholders must regard their activities as acceptable within prevailing norms. Communication can defend legitimacy, but legitimacy is ultimately sustained by conduct, governance and accountability.

Crisis communication principles

Effective crisis communication is:

• fast enough to reduce harmful uncertainty, but not so fast that it spreads unverified information;
• accurate and transparent about what is known, unknown and being investigated;
• empathetic, recognising human impact before discussing image;
• consistent, while allowing updates as facts develop;
• accessible, using appropriate languages, formats and channels;
• action-oriented, explaining what stakeholders should do; and
• accountable, identifying responsibility and corrective measures where justified.

5. Crisis Planning and Organisation

A crisis plan is a living management system, not a document stored in a drawer. It should include:

1. crisis definitions and escalation criteria;
2. likely scenarios and stakeholder impact assessments;
3. contact details and alternates for key personnel;
4. roles, authority and succession arrangements;
5. notification and approval protocols;
6. media, employee, customer and regulator procedures;
7. holding statement templates;
8. monitoring, documentation and record-retention procedures;
9. accessibility, translation and safeguarding arrangements;
10. simulation, training and review schedules; and
11. recovery, evaluation and lessons-learned processes.

Crisis team structure

A cross-functional team commonly includes a senior incident leader, operations or safety lead, communications lead, legal or compliance adviser, human resources representative, technology or security lead and stakeholder liaison. The communications lead coordinates information flow but should not independently invent operational facts.

Clear authority prevents two common failures: everyone waiting for approval, and multiple people issuing incompatible statements. A decision log should record the time, evidence, decision-maker, action and rationale. This supports accountability and later evaluation.

Escalation triggers

Triggers may include fatalities or serious injury, regulatory notification, major service disruption, credible cyber compromise, rapidly spreading misinformation, public demonstrations, executive misconduct allegations or sustained media attention. Triggers should be specific enough to activate the plan but flexible enough to accommodate context.

Holding statements

A holding statement is a short initial message issued while facts are being verified. It should:

• acknowledge awareness of the event;
• express concern for affected people;
• state what the organisation is doing;
• provide any immediate safety or service instruction;
• identify the next update time or channel; and
• avoid speculation, unsupported blame and premature legal conclusions.

Illustrative holding statement:

“We are aware of reports concerning an incident at our distribution facility. Our immediate priority is the safety and wellbeing of employees and members of the public. Emergency services and our internal response team are assessing the situation. We are verifying the facts and will provide an update through our website at 18:00. We ask people not to enter the affected area and to follow official safety instructions.”

This statement is useful because it is informative without claiming facts that have not been confirmed.

6. Real-Time Response

Crisis response is a cycle of detection, verification, decision, communication, monitoring and revision. The first operational period should establish a common operating picture: what happened, when and where; who is affected; what hazards remain; what is confirmed; and what is unknown.

A practical information classification is:

• confirmed: supported by reliable evidence;
• probable: supported by preliminary evidence but not final;
• unconfirmed: reported but not verified; and
• false: contradicted by credible evidence.

Only confirmed information should normally be presented as fact. Probable information may be used with explicit qualification when a decision requires it. Unconfirmed claims should be investigated rather than amplified unnecessarily.

Channel selection should reflect stakeholder need. A website or dedicated information page provides an authoritative record; social media provides rapid distribution and listening; email or SMS supports directly affected people; media briefings support public explanation; and internal channels help employees become informed participants rather than accidental sources of rumour.

The organisation should communicate with employees early, subject to safety and legal constraints. Employees need practical instructions, a route for questions and guidance on confidentiality and public posting. Treating staff as an afterthought often produces distrust and inconsistent informal communication.

7. Misinformation, Disinformation and AI

Misinformation is inaccurate information shared without an established intent to deceive. Disinformation is deliberately deceptive or manipulated information. Both can increase fear, obstruct emergency action and damage trust. A response should begin by assessing reach, credibility, potential harm and the value of correction.

Correction is most effective when it states the accurate information clearly, provides evidence where possible and avoids repeating a harmful falsehood more than necessary. The organisation should not engage every anonymous account. It should prioritise claims that affect safety, public behaviour or consequential decisions.

Artificial intelligence can support monitoring, translation, thematic analysis, simulation and drafting. However, generative systems may invent facts, reproduce bias, expose confidential information or produce inappropriate emotional language. Human review is mandatory for crisis content. Sensitive data should not be entered into unapproved systems, and records should show how AI-assisted material was checked.

Synthetic audio, video and images create additional verification challenges. Organisations should maintain authenticated channels, use clear provenance practices and coordinate with platforms and authorities when impersonation or malicious manipulation occurs.

8. Ethics, Law and Governance

Crisis communication involves competing duties. Transparency must be balanced with privacy, due process, national security, commercial confidentiality and the prevention of further harm. Legal approval is important, but legal defensiveness should not become a reason for misleading silence.

Core ethical duties include:

• truthfulness and correction of errors;
• respect for affected people and families;
• protection of personal and sensitive information;
• non-discrimination and accessibility;
• avoidance of victim-blaming;
• independence from undisclosed conflicts of interest; and
• preservation of evidence and communication records.

Regulatory requirements vary by jurisdiction and sector. Health, financial services, education, aviation, food, data protection and employment contexts may impose specific notification duties. Practitioners must therefore work with qualified legal and compliance professionals while retaining responsibility for clarity and public understanding.

9. Recovery and Organisational Learning

Recovery is more than restoring media coverage to normal. It involves repairing relationships, addressing harm, restoring service, demonstrating corrective action and rebuilding legitimacy. Stakeholders look for evidence that the organisation has learned rather than merely waited for attention to decline.

A post-crisis review should examine:

• detection: when could the issue first have been identified?
• decision-making: were roles and escalation rules clear?
• communication: were messages accurate, timely and accessible?
• coordination: did departments, partners and authorities share information effectively?
• impact: who was harmed or excluded?
• equity: were vulnerable groups adequately supported?
• outcomes: did trust, behaviour or operational performance change?
• learning: which policies, controls and training will be changed?

Evaluation should combine quantitative and qualitative evidence. Possible indicators include response time, correction time, stakeholder reach, service restoration time, complaint patterns, employee understanding, media accuracy, misinformation persistence and trust research. Metrics should not reward volume alone. A high number of posts may indicate confusion rather than success.

A useful evaluation distinction is output versus outcome. An output is an activity, such as publishing an update. An outcome is an effect, such as affected customers understanding what action to take. Strategic evaluation asks whether communication contributed to safety, informed decisions, accountability and recovery.

10. Illustrative Case: The Riverside Water Advisory

Background

Riverside Utilities, a fictional regional water provider, receives laboratory results suggesting possible bacterial contamination in one supply zone. A technician posts an anxious message online before the company has completed verification. Within an hour, residents share claims that the entire city’s water is unsafe.

Problem

The organisation must protect public health while avoiding unnecessary panic. It must coordinate with public health authorities, verify the test, inform employees and communicate in a rapidly changing information environment.

Analysis

The potential impact is high because drinking-water safety involves health and vulnerable populations. The initial social post is unconfirmed, but it is a credible trigger because it originated near the testing process. The risk is operational as well as reputational. A defensive denial would be inappropriate before verification.

Approach

The crisis team activates its plan. Operations isolates the relevant zone and conducts confirmatory testing. The communications lead establishes a single information page, contacts the health authority and sends employees an internal briefing. A holding statement advises residents in the affected zone to follow public health instructions, explains that testing is under way and gives a specific update time. The company responds to the “entire city” claim by clearly distinguishing the affected zone from areas not covered by the advisory, without repeating sensational wording in headlines.

When testing confirms contamination, Riverside issues a formal boil-water advisory in coordination with the authority, provides translated instructions, arranges bottled water for vulnerable residents and explains the cause and corrective action. When tests later show the water is safe, the company publishes evidence, maintains a help line and commissions an independent review.

Outcome

The organisation experiences criticism for the technician’s premature post and for delays in the first public update. However, coordinated action limits exposure, provides practical safety guidance and identifies weaknesses in staff posting rules and laboratory escalation.

Learning points

The case demonstrates that communication cannot substitute for safety controls. Early acknowledgement is preferable to silence when public health may be affected. Precise geographic information reduces unnecessary panic. Trust is strengthened when updates include uncertainty, evidence, practical instructions and independent accountability.

Challenges and Limitations

No crisis model predicts human behaviour perfectly. Stakeholders may interpret the same message differently, and cultural context influences expectations of apology, authority and disclosure. Risk scores can create false precision. Monitoring systems may overrepresent highly active online groups. Legal review can slow response, while excessive speed can spread error. Finally, reputation-focused communication may become unethical if it displaces care for affected people.

The strongest safeguard is integration: competent operations, realistic planning, trained people, ethical governance and communication that reflects actual organisational conduct.

Best-Practice Checklist

Before a crisis, map stakeholders, test contact systems, prepare accessible templates and run simulations. During a crisis, protect life and safety, establish facts, communicate empathy and action, update at stated times, correct consequential misinformation and document decisions. After a crisis, provide evidence of remedy, engage affected stakeholders, evaluate outcomes and change systems—not merely messages.

Chapter Summary

Issues are emerging concerns; risks are potential harmful consequences; incidents are manageable events; and crises exceed routine capacity and create urgent threats. Strategic public relations begins with environmental scanning, stakeholder analysis and risk prioritisation. Crisis communication is most credible when it is fast, accurate, empathetic, accessible, coordinated and supported by real operational action.

A crisis plan should define scenarios, roles, escalation triggers, approval procedures, channels, holding statements, monitoring and recovery. Situational Crisis Communication Theory helps relate response strategy to perceived responsibility, but no model replaces evidence and ethical judgement. Real-time response requires a common operating picture and careful separation of confirmed, probable, unconfirmed and false information. Misinformation should be corrected proportionately, while AI tools require human oversight and data governance.

Recovery depends on accountability and organisational learning. Evaluation must examine outcomes such as safety, understanding, trust and service restoration rather than counting communication outputs alone. Ultimately, crisis communication is a management responsibility grounded in conduct, competence and respect for stakeholders.

Key Terms

Issue: An emerging concern or contested topic that may affect organisational decisions or legitimacy.

Risk: Uncertainty about the effects of an event or decision on objectives.

Communication risk: The possibility that communication will increase harm or reduce trust.

Incident: An event manageable through normal procedures.

Crisis: A serious, urgent threat that exceeds routine organisational capacity.

Issue management: Proactive identification, analysis and response to emerging concerns.

Environmental scanning: Systematic observation of information relevant to an organisation.

Stakeholder: A person or group that affects or is affected by an organisation.

Risk register: A structured record of risks, causes, controls, ratings and owners.

Escalation trigger: A condition that activates higher-level response procedures.

Holding statement: An initial, limited message issued while facts are being verified.

Crisis team: A cross-functional group responsible for coordinated crisis decisions.

SCCT: Situational Crisis Communication Theory, which links response strategy to responsibility attribution and crisis history.

Legitimacy: Stakeholder acceptance that an organisation’s conduct is appropriate.

Misinformation: Inaccurate information shared without established intent to deceive.

Disinformation: Deliberately deceptive or manipulated information.

Common operating picture: A shared, current understanding of events, evidence and impacts.

Corrective action: Concrete steps taken to prevent recurrence or reduce harm.

Organisational learning: Changes to knowledge, systems, policy and behaviour arising from experience.

Review Questions

Short Answer Questions

1. Distinguish an issue, a risk, an incident and a crisis.
2. What is the purpose of a holding statement?
3. Identify four essential members or functions of a crisis team.
4. Explain the difference between misinformation and disinformation.
5. Why should crisis evaluation distinguish outputs from outcomes?

Long Answer Questions

1. Explain how environmental scanning and stakeholder mapping support issue management.
2. Discuss the principles of effective crisis communication and their practical importance.
3. Describe the main components of a comprehensive crisis communication plan.
4. Explain how Situational Crisis Communication Theory can guide response strategy while recognising its limitations.
5. Discuss the ethical and governance challenges involved in communicating during a public safety crisis.

Analytical / Application Questions

1. A company discovers a possible cybersecurity breach, but technical verification will take twelve hours. Design the first six hours of its communication response, including stakeholders, channels, message content and escalation decisions.
2. An organisation is accused online of hiding a product defect. The allegation is unverified but is spreading rapidly. Analyse whether it should issue a correction, a holding statement or no immediate public response. Justify your decision.
3. Using the Riverside Water Advisory case, propose three changes to policy, training or technology that would reduce the likelihood or impact of a similar crisis. Explain how each change would be evaluated.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes an issue from a crisis?

A. An issue is always internal, while a crisis is always external.

B. An issue is an emerging concern, while a crisis is an urgent threat exceeding routine capacity.

C. An issue requires no management, while a crisis requires only publicity.

D. An issue is factual, while a crisis is always based on misinformation.

Correct Answer: B. An issue is an emerging concern, while a crisis is an urgent threat exceeding routine capacity.

Question 2

In the qualitative model Risk priority = Likelihood × Impact, what is the priority score when likelihood is 4 and impact is 5?

A. 9

B. 15

C. 20

D. 25

Correct Answer: C. 20

Question 3

Which element is most appropriate in a holding statement?

A. A definite conclusion before facts are verified

B. Speculation about who is legally responsible

C. An acknowledgement, immediate action and a time for the next update

D. A criticism of people sharing unconfirmed information

Correct Answer: C. An acknowledgement, immediate action and a time for the next update

Question 4

According to Situational Crisis Communication Theory, which crisis category generally involves the highest perceived organisational responsibility?

A. Victim crisis

B. Accidental crisis

C. Preventable crisis

D. Natural-disaster crisis

Correct Answer: C. Preventable crisis

Question 5

What is the primary purpose of a crisis escalation trigger?

A. To identify when higher-level response procedures should begin

B. To prevent employees from receiving information

C. To replace operational safety controls

D. To guarantee that media coverage will stop

Correct Answer: A. To identify when higher-level response procedures should begin

Question 6

Which practice best supports real-time accuracy?

A. Publishing every rumour so the organisation appears transparent

B. Separating confirmed, probable, unconfirmed and false information

C. Waiting until all uncertainty has disappeared before communicating

D. Allowing each department to issue its own interpretation

Correct Answer: B. Separating confirmed, probable, unconfirmed and false information

Question 7

Which statement correctly describes disinformation?

A. Accurate information shared through an official channel

B. An accidental delay in an internal email

C. Inaccurate information shared without any known intent to deceive

D. Deliberately deceptive or manipulated information

Correct Answer: D. Deliberately deceptive or manipulated information

Question 8

Which is an outcome rather than an output of crisis communication?

A. Publishing an online update

B. Holding a media briefing

C. Affected customers understanding what action to take

D. Sending an employee email

Correct Answer: C. Affected customers understanding what action to take

Question 9

Why should employees be included early in crisis communication?

A. They can replace emergency authorities

B. They need practical instructions and may otherwise rely on rumours

C. They are legally responsible for all public statements

D. They can prevent all criticism on social media

Correct Answer: B. They need practical instructions and may otherwise rely on rumours

Question 10

What is the most appropriate use of generative AI in crisis communication?

A. Allowing it to publish unreviewed statements automatically

B. Using it to disclose confidential data for faster analysis

C. Using it for support such as drafting or monitoring with mandatory human review

D. Allowing it to decide whether an organisation should apologise

Correct Answer: C. Using it for support such as drafting or monitoring with mandatory human review