5.7 Crisis management and contingency planning

Learning objectives

• Define a crisis, crisis management and contingency planning.

• Describe the main types of crisis a business can face, including product recalls, cyberattacks and natural disasters.

• Explain the difference between crisis management and contingency planning.

• Explain how transparency, communication, speed and control affect the success of crisis management.

• Describe the steps of contingency planning, including risk assessment and business continuity planning.

• Calculate the expected cost of a risk and use it to compare the cost of a contingency plan with its benefit.

• Evaluate the impact of contingency planning on an organisation in terms of cost, time, risks and safety.

Introduction

Every business faces events that could stop it from operating: a fire in a factory, a faulty product, a cyberattack, a flood or the failure of a key supplier. Crisis management is the way a business responds to such an event once it has happened. Contingency planning is the preparation a business makes before it happens, so that the response is quicker, cheaper and safer. The two are closely linked, and a business that plans well for crises usually manages them better.

The topic connects to all four key concepts. A crisis is a sudden and unwanted change that tests how well a business can adapt. Responding to it often needs creativity, because no plan fits every situation exactly. How a business treats customers, employees and the public during a crisis raises questions of ethics, such as whether to admit fault quickly or protect its reputation. Planning for risks also supports sustainability, because it helps a business survive shocks that would otherwise force it to close.

What a crisis is

Most problems a business faces are part of normal management: a machine breaks down, a member of staff leaves, sales are lower than forecast for a month. A crisis is different in scale and speed. It is an unexpected event that threatens the business seriously, needs an urgent response and creates a lot of uncertainty about what will happen next.

Four features distinguish a crisis from an ordinary problem. It is a surprise, or at least its timing is. It is a threat to something that matters, such as people’s safety, the business’s finances, its operations or its reputation. It creates urgency, because harm grows with every hour of delay. And it brings uncertainty, because managers rarely have full information when they must act. A problem with only one of these features, such as an expected fall in sales, is usually not a crisis.

A crisis affects many stakeholders at once. Customers may be harmed or let down, employees may be at risk or unable to work, suppliers may not be paid, shareholders may see the share price fall, and local communities and governments may be affected. This is why crisis management is a responsibility of senior managers and not of one department.

Types of crisis

Crises can be grouped by their cause. Some start outside the business and are beyond its control; others start inside it, from a mistake, a fault or a decision. The table shows the main types, each with a real example.

The table shows that crises vary in how predictable they are. Natural disasters and pandemics cannot be prevented by a business, but their likely effects can be planned for. Product failures, technology failures and many reputational crises start inside the business or its supply chain, so better quality assurance and testing can reduce how often they happen.

Sources: Wikipedia, “2011 Thailand floods” (citing World Bank, Reuters); Wikipedia, “Samsung Galaxy Note 7”, 2016; Wikipedia, “2017 cyberattacks on Ukraine”; Microsoft, 20 July 2024; FDIC and Roku SEC filing via Wikipedia, “Collapse of Silicon Valley Bank”; NTSB, 2024; BBC News, 20 February 2018.

Product recalls

A product recall is one of the most common crises in manufacturing, food and car making. The business asks customers to stop using a product and return it, or brings it back for repair, because it may be unsafe. Recalls are expensive: the business pays for collecting, replacing or refunding the products, for investigating the fault and often for compensation, and it loses sales while trust is low.

Samsung’s Galaxy Note 7 shows how a recall can turn into a larger crisis. Samsung suspended sales and began a recall in September 2016 after batteries overheated and caught fire. Some replacement phones then caught fire too, so in October 2016 Samsung recalled the phone worldwide and stopped production for good. Its later investigation found faults in batteries from two different suppliers, and it introduced an eight-point battery safety check for future products. The case shows that a quick response is not enough if the cause of the problem has not been found.

Sources: Wikipedia, “Samsung Galaxy Note 7” (citing US Consumer Product Safety Commission, The Verge, Samsung Newsroom), 2016–2017.

Crisis management

Once a crisis has started, the business must respond. Crisis management covers everything managers do from the moment the crisis is recognised until the business is operating normally again. It is reactive: it deals with an event that is already happening.

The stages of crisis management

Crisis management usually moves through four overlapping stages. The details differ between crises, but the order is similar.

1. Recognise and contain. Managers confirm that a crisis is happening, protect people first, and stop the harm from spreading, for example by halting production, withdrawing a product or disconnecting infected computers.

2. Respond. A crisis team takes charge, gathers facts, decides on actions and informs stakeholders. Resources are moved to where they are needed.

3. Recover. The business restores normal operations: systems are rebuilt, stock is replaced, customers are compensated and staff return to their usual work.

4. Learn. Managers review what went wrong and what worked, then change processes and update plans so that the business is better prepared next time.

Most large organisations set up a crisis management team: a small group of senior managers with the authority to make fast decisions, usually including the chief executive, the heads of operations, finance, HR and legal, and a communications lead. The team meets as soon as a crisis is recognised and acts as the single source of decisions and information until the crisis is over.

The poisoning of Tylenol painkillers in Chicago in 1982 is still used to show crisis management at its best. After seven people died from capsules that had been tampered with, Johnson & Johnson stopped production and advertising, warned the public not to take the capsules, and recalled an estimated 31 million bottles worth over US$100 million across the United States. It relaunched the capsules in new triple-sealed packaging in November 1982. Tylenol’s market share fell from about 35% to 8% during the crisis but recovered within a year.

Sources: Wikipedia, “Chicago Tylenol murders” (citing The New York Times, 1982 and 1983).

Contingency planning

Contingency planning is preparation for things that might go wrong. Managers think in advance about the events that could seriously disrupt the business, decide how they would respond, and put in place the resources the response would need. A contingency plan is sometimes called a “plan B”: it is used only if the event happens, but it has to exist before then.

Contingency planning is proactive. It does not stop a flood or a cyberattack from happening, but it reduces the harm when one does. A good plan states who does what, in what order, with which resources, and how the business will keep its most important activities running while the problem is fixed.

The diagram shows the five steps of contingency planning. Each step depends on the one before it, and the last step leads back to the first, because risks change as the business and its environment change.

Step 1: identify possible risks

Managers list the events that could seriously disrupt the business. They look at every function and every link in the supply chain: what would happen if the main factory closed, a key supplier failed, the IT systems stopped, a product was found to be unsafe or a senior manager left suddenly? Tools such as STEEPLE analysis help managers think about external risks (political, economic, environmental and legal changes), and a SWOT analysis helps them see where internal weaknesses make the business vulnerable.

Past crises, those of competitors and industry reports are useful sources. Employees who do the work every day often know where the weak points are, so many businesses ask staff at every level to suggest risks.

Step 2: assess likelihood and impact

Not every risk deserves the same attention. A risk assessment judges each risk on two dimensions: how likely it is to happen, and how much harm it would cause if it did. Risks that are both likely and severe come first; risks that are unlikely and minor may simply be accepted.

The risk matrix shows a common way to present a risk assessment. Likelihood runs down the side and impact across the top, so each risk falls into one cell. A data breach that is likely and severe is an extreme risk that needs action now, whereas a rival’s price cut is likely but has only a minor impact. Many businesses turn the matrix into numbers by scoring likelihood and impact from 1 to 5 and multiplying them.

Expected cost of a risk

When managers can estimate a probability and a cost in money, they can calculate the expected cost of a risk: the average loss per year if the same situation were repeated many times. This is the same idea as the expected value used in decision trees. It allows managers to compare the cost of a contingency measure with the loss it should prevent.

Step 3: plan responses and resources

For each priority risk, managers decide what the business will do if it happens. The plan names who is responsible, how they will be contacted, what actions they take and in what order, and which resources they will use. Responses usually fall into four groups:

• Avoid the risk by stopping the activity that causes it, for example by not storing hazardous chemicals on site.

• Reduce the risk by making it less likely or less harmful, for example with fire sprinklers, staff training or a second supplier.

• Transfer the risk to another party, mainly through insurance or contracts with suppliers.

• Accept the risk when the cost of any response is greater than the expected loss, and keep a cash reserve to deal with it.

Plans also prepare communication in advance: contact lists for staff and key customers, draft statements for the media and social media, and a named spokesperson. Writing these before a crisis saves hours when time matters most.

Insurance is an important way to transfer risk, but it does not remove every loss. After the NotPetya cyberattack, the food company Mondelez claimed for the damage under its insurance policy, but its insurer, Zurich, refused to pay on the grounds that the attack was an act of war excluded from the policy. Mondelez sued for about US$100 million, and the dispute was settled in 2022 on confidential terms. A contingency plan therefore checks what insurance actually covers.

Sources: Wikipedia, “Petya (malware family)” (citing The Register, 2019; Cybersecurity Dive, 2022).

Step 4: test the plan

A plan that has never been tested may not work. Businesses test plans with drills (such as fire evacuations), tabletop exercises, in which managers talk through a realistic scenario step by step, and full simulations, in which systems are switched to backups to check that they work. Tests show gaps: a contact list that is out of date, a backup server that takes days to start, or staff who do not know their role.

Step 5: review and update the plan

Risks change as the business grows, adopts new technology, enters new markets or changes suppliers. A plan written five years ago may not mention cloud software, social media or a new factory abroad. Plans are reviewed regularly, after each test and after every real crisis, so that lessons are added. This is why contingency planning is described as a cycle.

Business continuity planning

Many organisations organise their contingency planning around business continuity. A business continuity plan focuses on keeping the most important activities running during a disruption, or restarting them as quickly as possible, whatever the cause of the disruption. It starts from the question “which activities must not stop, and for how long could each one stop before the damage became serious?”

A business continuity plan typically lists the critical activities and the maximum time each can be stopped, backup sites or ways of working (such as working from home), backup copies of data held in a separate location, alternative suppliers, and the order in which systems will be restored. Information technology is now at the centre of most plans, because almost every activity depends on it.

The shipping company Maersk shows why. When the NotPetya malware spread through its network in June 2017, its computer systems around the world stopped working, and the disruption was estimated to have cost it US$200–300 million in lost revenue. Its continuity depended on how quickly it could rebuild its IT systems from backups and keep ships and ports working by hand in the meantime.

Sources: Wikipedia, “Petya (malware family)” (citing ZDNet, 2017, and Wired, 2018).

Crisis management versus contingency planning

The two terms are easy to mix up because they deal with the same events. The key difference is timing. Contingency planning takes place before a crisis, while there is time to think, compare options and gather resources. Crisis management takes place during and immediately after a crisis, when time is short and information is incomplete.

The timeline shows how the two fit together. A good contingency plan is the starting point for crisis management: the crisis team does not have to invent a response from nothing, because roles, contacts and backup arrangements are already in place. After the crisis, the lessons learned feed back into the next version of the plan.

The comparison shows that the two are stages of one process and work together. A business can manage a crisis without a contingency plan, but it will usually be slower and make more mistakes. A business can have a plan and still manage a crisis badly if managers do not follow it or if the crisis is one the plan did not foresee.

Factors that make crisis management effective

Some businesses come out of a crisis with their reputation intact or even stronger; others are damaged for years by a similar event. Much of the difference comes from how the crisis was handled. Four factors have the greatest effect on whether crisis management succeeds: transparency, communication, speed and control.

The diagram shows the four factors around the central aim. Each one brings benefits, and each has its difficulties.

Transparency

Transparency means being open and honest about what has happened, what the business knows and does not yet know, and what it is doing about it. A transparent business admits responsibility where it is at fault and does not hide information that stakeholders need to protect themselves.

Openness builds the trust a business needs in order to recover from a crisis. Customers and regulators usually react more harshly when a business is found to have hidden information than to the original mistake. Johnson & Johnson’s public warnings and nationwide recall in the Tylenol crisis are an example: by telling people not to use the product before it knew the full cause, it showed that it put customers’ safety first.

Being transparent also has costs and limits. Admitting fault can increase legal claims and compensation, so lawyers often advise caution. Sharing information too early can spread mistakes if the facts are not yet confirmed. Some information, such as details of a cyberattack, may help criminals if it is made public. Managers therefore have to judge how much to say, and when, without misleading anyone.

Communication

Communication in a crisis means giving the right information to each group of stakeholders, clearly, regularly and through the channels they actually use. Different stakeholders need different messages, but those messages must not contradict each other, so most businesses agree one consistent message and name one spokesperson.

The table shows why communication in a crisis is a planned activity and not just a press release. Social media has made it more difficult, because news and rumours spread within minutes and customers expect immediate replies. When a business says nothing, speculation spreads quickly, so even a short message saying what the business knows so far is better than none.

YouTube

CrowdStrike gave the interview within hours of the crash. Its chief executive confirmed that the problem was a faulty update and not a cyberattack, said that a fix had been released and apologised to customers. Clear, early communication of this kind reduces fear and rumours, even when the business cannot yet fix every problem its customers face.

Speed

Speed means recognising the crisis quickly and acting without delay. In most crises, harm grows with time: more customers use an unsafe product, more systems are infected, more flights are cancelled and more rumours spread. A fast response limits this harm and shows stakeholders that the business is taking the situation seriously.

Speed depends heavily on preparation. A business with a contingency plan, a trained crisis team and prepared statements can act within hours; one without them may lose days deciding who is in charge. However, speed has a risk of its own. Acting before the facts are known can lead to the wrong action, as Samsung found when replacement Galaxy Note 7 phones also caught fire because the cause had not been fully identified.

Control

Control means that the business, through its crisis team, stays in charge of both the response and the information about it. Managers decide what happens, in what order, and who speaks for the business, instead of reacting to events or to what the media and social media say. Control needs clear leadership and authority: a crisis team that can make decisions and spend money quickly.

A business that loses control of its story allows others, such as regulators, journalists or angry customers, to describe the crisis for it. Boeing’s handling of the Alaska Airlines door plug incident in January 2024 shows the difficulty. The aircraft were grounded by the US Federal Aviation Administration, and investigators, not Boeing, set much of the agenda; the National Transportation Safety Board later found that the door plug had been fitted without its four retaining bolts. Boeing’s chief executive publicly acknowledged the company’s mistake within days, and Boeing agreed to compensate airlines for the grounding.

Sources: Wikipedia, “Alaska Airlines Flight 1282” (citing NTSB preliminary report, 6 February 2024, and Alaska Air Group, April 2024).

How the four factors work together

The four factors depend on each other. Speed without control can produce confused or contradictory messages. Communication without transparency may be fast and well organised but loses trust as soon as hidden facts come out. Control without communication can look like secrecy. The most successful crisis responses combine all four: a business that takes control quickly, tells stakeholders openly what it knows and keeps them updated.

How much each factor matters depends on the type of crisis. In a product safety crisis, speed and transparency come first, because lives may be at risk. In a cyberattack, control matters more, and some details are kept confidential while systems are protected. In a financial crisis, communication with lenders and shareholders may decide whether the business survives.

The impact of contingency planning

Contingency planning has costs as well as benefits, so managers have to decide how much planning is worthwhile. Its impact is usually judged in four areas: cost, time, risks and safety. In each area there are gains and drawbacks, and the balance depends on the organisation and the situation.

Cost

Contingency planning costs money. Managers and specialist advisers spend time on it; backup systems, spare stock, second suppliers and backup premises have to be paid for; staff need training; and insurance premiums are a regular expense. For a small business with tight cash flow, these costs can be hard to justify, because they bring no visible return in a year without a crisis.

Against this, a crisis without a plan usually costs far more. Lost sales, compensation, repairs, fines and a damaged brand can add up to many times the cost of planning. A plan can also lower some costs directly: insurers may charge lower premiums to businesses with tested continuity plans, and lenders and large customers may prefer suppliers that can show they are prepared. The financial case for a contingency measure can be checked by comparing its cost with the expected cost of the risk it reduces.

Time

Planning takes time, often from senior managers whose time is scarce. Identifying risks, writing plans, training staff and running tests take hours away from day-to-day management and from projects that bring visible results. Plans must also be reviewed regularly, so the time cost is ongoing.

The benefit is time saved when a crisis happens. With a plan, the crisis team knows its roles, contacts and first actions, so it can respond in minutes or hours instead of days. Recovery is also faster, because backups, alternative suppliers and procedures are ready. In many crises, such as an IT failure at an airline or a contamination scare at a food producer, every hour of delay increases the cost, so time saved in the response can be worth far more than time spent on planning.

Risks

Contingency planning reduces risk in two ways. It lowers the likelihood of some crises, because the process of identifying risks shows weak points that can be fixed in advance, such as a single supplier for a vital component. It lowers the impact of crises that do happen, because the response is quicker and better organised. This makes the business more resilient and can reassure investors, lenders, customers and employees.

Planning has limits, though. No plan can foresee every event, and the most damaging crises are often the ones nobody expected. A detailed plan can create a false sense of security, so that managers stop looking for new risks. Plans can also become out of date quickly as technology, suppliers and markets change. A plan written for one type of crisis may even slow the response to a different one if staff follow it too rigidly.

Safety

For many crises, the most important impact of contingency planning is on safety. Fire drills, evacuation routes, procedures for chemical spills, and plans for product recalls protect employees, customers and the public. In industries such as aviation, food, chemicals, energy and healthcare, safety planning is also a legal duty, and failure can bring fines, criminal charges and the loss of a licence to operate.

Planning for safety has costs too: training time, safety equipment and the cost of stopping production to run drills. There is a risk that safety procedures become a routine to complete on paper rather than a real preparation. Still, safety is the area where the case for planning is strongest, because the harm prevented (injury or loss of life) cannot be undone by any later recovery. This links contingency planning to the ethics of a business and to its corporate social responsibility.

YouTube

Evaluation: is contingency planning worth it?

The table shows that contingency planning nearly always involves a trade-off: a certain cost now against an uncertain benefit later. How strong the case is depends on several factors.

• The size of the possible harm. Where a crisis could injure people or close the business, as in aviation, food or energy, detailed planning is essential. For a small business whose worst likely crisis is a short IT failure, a simple plan may be enough.

• The likelihood of the risk. Businesses in flood zones, in industries that are frequent targets of cyberattacks, or with long global supply chains face higher risks and gain more from planning.

• Dependence on single points of failure. A business that relies on one factory, one supplier, one IT system or one key person is more vulnerable, so planning brings larger benefits.

• Size and resources. Large organisations can afford specialist staff and backup sites; small businesses must focus on a few priority risks, but even a one-page plan with contact lists and backups is far better than none.

• Regulation. In some industries, such as banking, airlines and pharmaceuticals, regulators require continuity plans, so the decision is about quality, not whether to plan.

• Organisational culture. Plans only work if staff take them seriously, test them honestly and report weaknesses. A culture that hides bad news reduces the value of any plan.

On balance, some contingency planning is worthwhile for almost every organisation, because the cost of planning is usually small compared with the cost of an unprepared response. The question for managers is how much to plan and for which risks. A sensible approach is to focus on the risks with the highest likelihood and impact, to plan for the effects of disruption (loss of premises, systems, suppliers or staff) instead of trying to list every possible cause, and to test and update plans regularly so that they remain useful.

Case study: Delta Air Lines and the CrowdStrike outage (July 2024)

On 19 July 2024, at 04:09 UTC, the cybersecurity company CrowdStrike sent a routine content update to its Falcon software, which runs on millions of business computers to protect them from attacks. The update contained an error that its testing system had not caught, and every Windows computer that received it crashed and could not restart. CrowdStrike withdrew the update at 05:27 UTC, but the computers that had already crashed had to be repaired one by one, often by hand. Microsoft estimated that about 8.5 million Windows devices were affected, less than 1% of all Windows machines. Banks, hospitals, broadcasters and airports were disrupted around the world.

Airlines were among the worst affected, because check-in, crew scheduling and flight operations all depend on computer systems. Most airlines in the United States recovered within a day or two, but Delta Air Lines took about five days. Its crew-tracking system, which matches pilots and flight attendants to flights, could not cope with the huge number of changes the outage caused, so Delta lost track of where its crews were.

Delta cancelled about 7,000 flights during one of the busiest weeks of the summer, while American Airlines and United Airlines recovered relatively quickly. Delta’s chief executive said that about 40,000 servers had to be reset manually.

The chart shows Delta’s own estimate of the financial impact. Refunds to customers cut revenue by about $380 million, and extra costs, mainly reimbursing customers’ expenses and paying crews, added $170 million. Fuel not bought for the cancelled flights saved $50 million, so the net cost was about $500 million in a single quarter. Beyond the money, the US Department of Transportation opened an investigation into Delta’s treatment of passengers on 23 July 2024, after hundreds of complaints from passengers.

No one should be stranded at an airport overnight or stuck on hold for hours waiting to talk to a customer service agent.

— Pete Buttigieg, US Secretary of Transportation, quoted by the Associated Press, 23 July 2024

What the case shows about contingency planning

The cause of the crisis was the same for every airline, so the difference in outcomes points to differences in preparation and in the systems each airline relied on. Delta’s later annual report states that it had disaster recovery plans in place, yet its crew-tracking system became a single point of failure: once it could not process the changes, the whole operation could not recover, even after computers were working again.

A contingency plan that assumed computers could be restored quickly did not cover the situation in which a key system was overwhelmed by the scale of the recovery. The case shows the limit of planning for a cause (a computer failure) rather than for an effect (losing track of crews) and the value of testing plans at full scale.

CrowdStrike’s own response shows how the four factors of crisis management operate. It acted with speed: the faulty update was withdrawn within about 80 minutes and its chief executive spoke on television the same morning, confirming that it was not a cyberattack and apologising.

CrowdStrike’s transparency continued afterwards: it published a preliminary post-incident review explaining that a bug in its own testing tool had let the faulty update through, and promised changes such as releasing updates gradually to small groups of computers first and giving customers control over when updates are installed. Delta’s response looked weaker on control, because it could not tell customers when flights would operate, and on communication, because the government investigation focused partly on how passengers were treated and informed.

The table summarises the two responses against the four factors. It suggests that the business that caused the fault managed its part of the crisis faster than one of the businesses affected by it, largely because Delta’s recovery depended on its own systems and plans.

After the outage, the dispute moved into the courts. Delta said it would seek at least $500 million in damages, and in October 2024 it sued CrowdStrike in a Georgia state court. CrowdStrike argued that its contract limited its liability and that it was not responsible for Delta’s slow recovery. In May 2025 a judge allowed some of Delta’s claims, including gross negligence, to proceed. Whatever the legal outcome, passengers held Delta, and not CrowdStrike, responsible for its cancellations, so Delta still had to manage a crisis that began at one of its suppliers.

As evidence, the case has limits. Delta’s figures are its own estimates, published while it was preparing legal claims against CrowdStrike and Microsoft, so they may present the cost in the way most helpful to its case. Other airlines may have been less exposed because they used different software, not because they planned better. And one crisis says little about how often such events happen, which is what managers need to know to decide how much to spend on preparing for them.

• Explain why the same software fault caused a much larger crisis at Delta Air Lines than at other US airlines.

• Using the four factors of effective crisis management, analyse CrowdStrike’s response to the outage.

• Evaluate the impact that a more detailed contingency plan could have had on Delta in terms of cost, time and risks.

Sources: CrowdStrike, Preliminary Post Incident Review and Remediation Hub, July–August 2024; Microsoft, “Helping our customers through the CrowdStrike outage”, 20 July 2024; Delta Air Lines, Form 8-K, 8 August 2024, September quarter 2024 results release, 10 October 2024, and Form 10-K 2025; Associated Press, 23 July 2024; Flying Magazine, 2 August 2024; Wikipedia, “2024 CrowdStrike-related IT outages” (for the court rulings).

Exam practice

Questions on crisis management and contingency planning appear in Paper 2 at HL, and the ideas can support answers in Paper 3, where a social enterprise often faces risks such as a funding shortfall, a natural disaster or the loss of a key person. Questions range from definitions and “distinguish” questions to extended responses that evaluate contingency planning for a given organisation.

Short-answer questions often use a brief case. The next questions refer to the following case.

Kibo Coffee roasts coffee beans in Nairobi and sells them to 300 cafés and supermarkets in Kenya (hypothetical data). It has one roasting plant and buys most of its beans through a single exporter. Last year its website, which takes 70% of its orders, was offline for two days after a cyberattack. The managers have never written a contingency plan because “nothing serious has ever happened”.

Calculations on crisis risks usually involve expected cost, set up with estimates given in the case.

At HL, Paper 3 asks for a plan of action for a social enterprise. Contingency planning fits well there, because social enterprises often depend on one source of funding, one key person or one location.

Summary

• A crisis is an unexpected event that seriously threatens a business or its stakeholders and needs an urgent response.

• Crises include natural disasters, product failures and recalls, cyberattacks, technology failures, financial and reputational crises, supply disruption and pandemics.

• Contingency planning is proactive preparation before a crisis; crisis management is the reactive response during and after it.

• Contingency planning is a cycle: identify risks, assess their likelihood and impact, plan responses, test the plan, then review and update it.

• Expected cost (probability × financial cost) helps managers compare the cost of a contingency measure with the loss it should prevent.

• Transparency, communication, speed and control are the four factors that most affect whether crisis management succeeds, and they depend on each other.

• Contingency planning costs money and time but reduces risks and protects safety; its value depends on the likelihood and severity of risks, the size of the business, regulation and culture.

Self-check

• To do:

  I can define a crisis, crisis management and contingency planning.

• To do:

  I can describe the main types of crisis and give a real example of each.

• To do:

  I can explain the difference between crisis management and contingency planning, with the role of timing.

• To do:

  I can explain how transparency, communication, speed and control affect crisis management, using a real case.

• To do:

  I can describe the steps of contingency planning, including risk assessment and business continuity planning.

• To do:

  I can calculate the expected cost of a risk and compare it with the cost of a contingency measure.

• To do:

  I can evaluate the impact of contingency planning in terms of cost, time, risks and safety, and say what it depends on.