Published on June 16, 2025
Last updated on June 17, 2025
Businesses of all sizes will face a crisis at one time or another. It's naive to assume any organisation is immune to crises. Even with the most robust crisis management, unexpected issues can still emerge.
This is exactly why an effective crisis management plan is needed. No matter the issue a business faces, it must be able to respond in a timely manner if it is to recover or to minimise fallout if recovery is not possible.
There are some crises that management will never be able to predict coming. That does not excuse a lax response or poor preparation for the future.
A crisis can best be defined as a situation that can cause significant threat and damage to the business in some form. It might be unexpected, happening over a few days or even hours, or it could be years in the making, having been buried and ignored by those who should have responded to its warning signs.
A business crisis can be:
A crisis can also be small or large. An incident like computers in an office going offline for the day may not seem like a big issue to those outside the company, nor may it have a big impact on staff who may work elsewhere such as on a factory or warehouse floor, but it can have a knock-on effect that builds and builds if not adequately addressed.
A business crisis can be caused by a variety of issues. Business crises aren't always the result of poor management; many are triggered by forces beyond our control. These forces can be:
No two crises will also look the same. A company may put all their resources and energy into protecting against a certain type of crisis, only to be impacted by another that they have not adequately prepared for. Some of the most common business crises include:
A financial crisis occurs when a company lacks the money and capital they need to continue operations. It can take the form of bankruptcy, insolvency, or even a sudden drop in the market or economy. When a company begins to struggle financially, it may choose to make cost cutbacks or search for a new source of funding unless the crisis worsens.
A labour crisis is tied to the ability of a workforce to do their job. Poor work conditions may build into demands for change and the threat of strike action from unions. Sudden workplace accidents can cause questions about an employer's reputation and safety. Poor morale can also contribute to issues in retention and recruitment.
A reputational crisis is born due to negative publicity and controversies that centre on a company or individuals who work there. It may be tied to other crises, and will often come with a decrease in customer or client trust and a shift in public perception.
Natural disasters, including weather events like storms, floods, earthquakes, or wildfires, can make it dangerous for operations to continue. Even if natural disasters do not occur in the vicinity of the business, they could affect supply chains or customer availability. A natural disaster on the other side of the world can still have an impact on an ill-prepared organisation.
Cyber attacks are becoming ever more of an issue, especially for small and medium organisations. Even traditional industries are modernising and have moved their administration to software. Production lines are run by computers as much as they are by human hands. A well-timed cyber attack can bring any company to a standstill, and, depending on the complexity of the attack, it can be a while before systems are back online.
No matter how many tests and quality checks a product goes under, functions or equipment can fail, and a flawed product hits the shelves. Unfortunately, this can cause a major crisis for a business. Bad products must be recalled and disposed of, resulting in a revenue drop from loss of sales and recuperation. Production needs to be halted to find the issue that caused the failure, and the business reputation can take a hit as clients sever contracts and the public voices their disappointment.
When a crisis hits, no one can predict what will happen next. The precise effects of a crisis will vary depending on the nature of the incident and how quickly the designated crisis team can react. Common effects of corporate crises can include:
Businesses face crises every day, both in the UK and beyond. However, there have been some notable cases that are worth examining to show that even the biggest and most established of businesses can be struck with a crisis that they did not anticipate.
British supermarket M&S was targeted over Easter weekend by cyber attackers, with the Co-op being targeted by the same hacking group a few weeks later in May. Ransomware was used to infiltrate and shut down M&S's operations, whereas the timely decision was made at the Co-op to take their systems offline before the ransomware could infiltrate the system and cause major damage.
Both attacks caused widespread disruption. The M&S website was inaccessible to customers for a while and only resumed taking online orders in June. Meanwhile, the Co-op was unable to deliver stock to many of its stores, causing issues in more remote communities who rely on the supermarket.
Newsagent and high street retailer WHSmiths has attempted to sell their struggling shops after a 6% fall in sales in the first months of 2025, compared to performance from the year before. With 5,000 staff at risk across over 500 stores, the sale has created a crisis as workers are left unsure of their future.
Regardless of whether a buyer is found or not, it is likely that all stores will not remain open. Hundreds of staff may potentially lose their livelihoods, and this outcome has left a shadow over WHSmith's already declining reputation amongst the British public.
(Photo Courtesy of Thames Water)
Thames Water, the UK's largest water supply and waste management company, has been under intense scrutiny due to repeated environmental violations, including sewage spills and failure to upgrade treatment facilities. In May 2025, Thames Water was fined a combined £122.7 million by the regulatory body Ofwat for breaches related to its wastewater operations and improper dividend payments.
The company's financial instability, with debts around £20 billion, has further damaged its public image and has introduced a fresh debate surrounding nationalising utilities in England.
ISG Ltd, once one of the UK's largest construction contractors, collapsed into administration in September 2024. The abrupt collapse disrupted numerous high-profile projects, including the £170 million fit-out of Google's London headquarters and various public infrastructure projects. Clients were forced to find replacement contractors, leading to project delays and increased costs.
At the time of its collapse, ISG had total debts of approximately £1.1 billion, including £308 million owed to suppliers and £89.4 million to HMRC. The sudden administration left many subcontractors and suppliers facing significant financial losses. The collapse resulted in immediate redundancies for most of ISG's 2,380 UK employees. By December 2024, only 22 staff remained to assist administrators. Over two-thirds of former employees also pursued legal claims regarding the manner of their redundancies.
Every business needs to have a plan in place for when a crisis strikes. The worst time to decide what to do is after the incident has already happened; there should already be a robust plan in place for employees to follow. Best practices for crisis management should look like:
The first action any team should take when developing a crisis communication plan is to conduct a risk assessment to find the weaknesses within operations. Establishing risk appetite and other metrics can inform the severity and promptness of a plan should an incident arise. Individual risk assessments should be conducted for every part of the business; this is not a one-size-fits-all activity.
Crisis management plans need to be thorough. They have to detail every level of a response, from who is receiving the notification to what communication channel and then what the next steps are. No detail is too much. When plans have been finalised, they should all be placed in a business continuity management system so they are all in one place and easily accessible in the event of an emergency.
Just as you should not be developing the plan in the middle of a crisis, so should you ensure that you are not putting the plan to the test for the first time in a real crisis. Running simulations and stress tests can help an organisation determine how effective their plans are and highlight where weaknesses could still cause issues.
When a crisis is ongoing, regular communication must be pushed out to waiting parties. This could be internal communication to concerned staff, or it could be to the media if the public's eyes are watching. Multiple communication channels should be set up in prioritised order (e.g. SMS messages are sent out if email systems are offline), and templates should be created with the marketing and communications team to agree on language and tone used in communications if appropriate.
A dedicated BCMS will allow you to track and update plans easily. Many companies make the mistake of thinking they can create crisis management plans once and then never address them. However, crises change, the world of business constantly evolves, and plans need to shift too. Ensure that plans are reviewed and updated regularly so that the right course of action will be taken when disaster strikes.
No matter how much we prepare, disruption can be inevitable in business. There are too many factors out of our control to be able to perfectly avoid it. What we can do is prepare and test our response. No matter whether it is a cyber attack or a freak weather event, we can work ahead of time to ensure that plans are in place to fight off a crisis before it can cause lasting damage.
Ensure that all plans and strategies are kept in one easily accessible location and standardise your entire approach to business continuity and operational resilience. C2's Meridian BCMS gives companies this high level of finesse and control, allowing your leaders to create and update even the most complex of plans.
Book a demo and transform your company's commitment to developing thorough and detailed crisis management plans.
Founder & CEO at Continuity2
With over 30 years of experience as a Business Continuity and Resilience Practitioner, Richard knows the discipline like the back of his hand, and even helped standardise BS25999 and ISO 22301. Richard also specialises in the lean implementation of Business Continuity, IT Service Continuity and Security Management Systems for over 70 organisations worldwide.
Founder & CEO at Continuity2
With over 30 years of experience as a Business Continuity and Resilience Practitioner, Richard knows the discipline like the back of his hand, and even helped standardise BS25999 and ISO 22301. Richard also specialises in the lean implementation of Business Continuity, IT Service Continuity and Security Management Systems for over 70 organisations worldwide.