Every organisation that operates in public will, sooner or later, face a bad story: a product that fails, a service outage at the worst moment, an employee’s mistake caught on camera, a data incident, a leader’s careless remark. Most of those stories pass in a day. A small number become the thing the company is known for — the search result that will not fade, the example strangers reach for. That escalation is what people mean by a PR nightmare, and the important truth about it is this: the nightmare is rarely made by the original incident alone. It is made by the gap between what happened and what the company said and did next.

This article is a practical guide to both halves of that problem. The first half is prevention — not the impossible goal of never having a crisis, but the preparation that keeps a bad day from becoming a defining one. The second half is management: what to do in the first hours, how to behave through the days that follow, what never to do under pressure, and how recovery actually works once the peak has passed. It contains no rescue stories and no promises, because honest crisis doctrine does not need them. What it offers is the discipline that gives an organisation its best chance — prepared long before it is needed.

What Makes an Incident Become a PR Nightmare

An incident becomes a nightmare when it stops being a story about an event and becomes a story about the company’s character. A delayed flight is an event; a delayed flight where passengers learn the truth from other passengers while the airline says nothing becomes a judgement on the airline. Three ingredients usually drive the escalation. The first is harm or the appearance of harm — people affected, money lost, safety in question. The second is surprise compounded by silence: the longer the vacuum, the more it is filled by speculation, screenshots and the angriest available interpretation. The third is a values gap — the discovery that what the company did differs from what it claims to stand for. Emissions software that quietly cheated the tests it publicly celebrated damaged its maker far beyond the engineering failure, because the wrongdoing was deliberate and contradicted the brand’s promises. The lesson generalises: facts hurt, but the perceived cover story hurts more.

The Second Story: The Response Becomes the News

Journalists and audiences judge a crisis in two acts. Act one is the incident itself, over which the company may have had partial control at best. Act two is the response — and the response is entirely the company’s own work. A slow, evasive or contradictory response generates its own headlines: the apology that apologised for nothing, the statement that blamed the customers affected, the executive whose dismissive remark in an early interview became the clip everyone remembers from a disaster far larger than the remark itself. History’s most retold corporate crises are usually remembered for a sentence from act two, not for the original failure. That is strangely hopeful news, because act two is where preparation lives. You cannot schedule your crisis. You can absolutely rehearse your response.

Speed of events has changed the stakes but not the logic. A bystander’s video can circle the world before a communications team has finished its first call, and screenshots outlive every correction. None of that makes preparation pointless — it makes it the only part of a crisis you fully control. Organisations that cope well are almost never improvising brilliantly; they are executing, under pressure, decisions they made calmly months earlier.

Prevention Is the Real Discipline

The cheapest crisis is the one that never escalates, and most escalation is prevented in peacetime. Prevention is unglamorous: maintained documents, named people, rehearsed roles. It is also the highest-value work in this entire article, because a company mid-crisis has no time to invent any of it.

The Issues Register: Watching for Smouldering Problems

Most “sudden” crises were visible in advance to someone inside the building: the recurring complaint theme, the product weakness everyone routes around, the supplier under strain, the policy that reads badly out of context. An issues register is simply the habit of writing those down — a short, living list of the problems most likely to become public, each with an owner, a current status and a note on what would make it flare. Reviewed regularly by people senior enough to act, the register converts vague unease into managed work: fix the underlying issue, prepare the explanation, or consciously accept the risk with eyes open. It pairs with ordinary monitoring — watching news, reviews and social mentions of your name — not as surveillance theatre but as an early-warning sense. Complaints answered early and visibly are crises that never happen; the register is where the pattern behind the complaints gets solved.

The Preparation Kit: Facts, People and Draft Words

Three assets need to exist before anything goes wrong. The first is a maintained facts base: the accurate, current description of the company, its products, its safety and quality processes, its key numbers — the material the first accurate statement will be built from, kept where several people can reach it. The second is named decision-makers: who can approve a statement at 2 a.m., who speaks, who handles legal review, who talks to staff — decided in advance, with deputies, because the first hour of a crisis is the wrong time to discover the approver is on a flight. The third is pre-drafted holding statements: short templates for the foreseeable categories of trouble — an outage, a safety incident, a data issue, an allegation — each with blanks for the specific facts and, crucially, for the time of the next update. Alongside these sit the principles that govern all of it, of the kind set out in our guide to the principles of public relations: honesty, one accountable voice, and words that match actions. Templates do not make a company honest; they make honesty faster.

Spokesperson readiness belongs in the kit too. The person who will front a bad day should have faced hostile questions in rehearsal before facing them on camera: bridging from a question to the verified facts, declining to speculate without sounding evasive, expressing concern for affected people in words that are meant. Untrained spokespeople improvise adjectives; trained ones deliver facts.

The First Hours: Verify, Acknowledge, Commit to Updates

Verify Facts Before You Speak — but Speak

The first-hours tension is real: speaking before facts are verified risks saying something wrong; waiting for complete facts guarantees a vacuum others fill. The resolution used by competent teams is sequencing. Establish, fast, the small set of facts that are certain — what happened, when it was discovered, who is affected, what is being done right now — from the people closest to the event, and say exactly that much, no more. Everything else is labelled plainly as not yet known, with a commitment to when it will be addressed. Speculation is the enemy: an early confident guess that turns out wrong converts an incident into a credibility crisis. Equally, internal alignment comes before external statements — staff learning their employer’s position from the news is a failure mode of its own — and affected people come before audiences: customers, patients, families and partners directly harmed should hear from the company directly, not via a headline.

The Holding Statement: Known, Unknown, Next Update

The holding statement is the workhorse of the first hours. Its structure is simple enough to memorise: we are aware of the situation; here is what we know so far; here is what we do not yet know; here is what we are doing about it; here is when we will update you next — and then keep that appointment even if the update is only that work continues. It acknowledges the people affected before it defends the organisation. It avoids adjectives about the company’s own virtue. And it appears on the channels where the story is actually moving — the company’s own site and social accounts, and directly to journalists who are asking — rather than in a single press release fired into the void. Where a formal release is the right vehicle for the on-record statement, it should carry the same discipline: verified facts, named contact, promised next step. Our earlier piece on crisis press release distribution covers the mechanics of getting such a statement out.

One Voice, and Internal Audiences First

Contradiction is gasoline. In the first hours, well-meaning employees freelancing explanations on social media, regional offices issuing their own versions, and executives freelancing in interviews create the impression — sometimes the reality — of a company that does not know its own facts. The discipline is one voice: a single designated spokesperson and a single canonical statement that everyone else points to. That is not secrecy; internal audiences should in fact hear more, sooner — what staff are told, what they may say, and where to route enquiries, delivered before or alongside the public statement. Employees who understand the situation become a source of calm accuracy in their own networks; employees left in the dark become a source of leaks, and they will usually have the public’s sympathy for it.

The Days That Follow: Updates, Action and Evidence

If the first hours are about acknowledgement, the following days are about credibility earned in instalments. Updates arrive at the promised times — the single most persuasive signal that a company is in control of itself, whatever else is happening. Each update adds verified facts, retires earlier uncertainty honestly (“we said yesterday that X was unclear; we can now confirm Y”), and reports corrective action with evidence rather than adjectives: the service restored and independently checked, the product recalled and the remedy process opened, the investigation commissioned and its terms published. The people affected remain the first audience — refunds, support lines, direct contact, practical help — because journalists will ask them how they have been treated, and their answer becomes the story’s verdict.

Media handling under pressure follows the same ethic. Make accurate information easy to get: a named contact who answers, a page where the canonical facts and statements live, briefings that distinguish confirmed fact from ongoing work. Never punish scrutiny — a journalist pressing on a weak point is showing you exactly where public doubt sits. Social channels need the same discipline as statements: replies that are human and factual, no arguing with critics in public threads, no quietly deleting criticism (screenshots exist, and deletion converts criticism into a cover-up story), and a clear rule that personal accounts of executives are not a second press office. Where misinformation is materially wrong, correct it once, clearly, with evidence, and link the correction wherever the claim is spreading.

What Never to Do

Crisis doctrine is as much a list of prohibitions as of actions. Under pressure, tired people reach for exactly the moves that deepen the hole, so the prohibitions are worth stating plainly:

• Never lie, minimise or speculate. A false statement has a half-life of hours and a reputational life of years; “no comment” dressed as fact is discovered just as fast.
• Never blame the people harmed. Suggesting customers misused the product, passengers caused the chaos or victims misunderstood is the fastest known route from incident to outrage.
• Never hide behind process. “We take this seriously” plus nothing else reads as its opposite; seriousness is demonstrated by updates, actions and evidence.
• Never delete criticism wholesale or buy distraction. Mass deletion and sudden promotional noise are visible, screenshot-able, and convert critics into investigators.
• Never threaten journalists or critics. Legal menace deployed to silence coverage almost always becomes coverage, and worse coverage.
• Never let the lawyers and the communicators work in sequence. Legal risk and reputational risk must be weighed together, in the room, in real time — a statement that is legally perfect and publicly contemptuous fails, as does the reverse.

After the Peak: Recovery Is Follow-Through

Attention moves on long before trust returns, and the difference matters. Recovery is not a campaign; it is the audit of every promise made at the peak. Did the fix actually ship? Did the compensation reach the people affected? Did the investigation report, and were its recommendations implemented — and can the company show it? Companies recover standing by demonstrating, over following months, that the crisis changed something real: a process replaced, a leader held accountable, an independent check published. Deeds first, words second — and where words are needed, they should report the deeds, not announce a rebrand of the feelings. This is the long tail of the work described in our explainer on corporate PR: reputation rebuilt at company level, in the open.

The internal half of recovery is the post-crisis review, held while memories are fresh and chaired by someone allowed to be blunt. What did we know, when did we know it, where did the response snag — the approval that took three hours, the fact that turned out wrong, the channel nobody owned? The output is permanent change: the register updated, the templates rewritten, the kit restocked, the rehearsal repeated with the new lessons in it. Organisations that skip the review reliably meet the same crisis twice. Organisations that hold it discover the review’s quiet benefit: the second crisis — and there is usually a second — meets a team that has done this before.

The Small-Business Version

A small business has no crisis team, and its nightmares are scaled accordingly: the furious review thread, the local news story, the supplier failure on the busiest weekend of the year. The doctrine shrinks without changing shape. The facts base is one accurate page about the business. The decision-maker is the owner, named in advance with one deputy. The holding statement is three sentences the owner can adapt at midnight. The channels are the shop’s own accounts, its Google listing and direct replies to the people affected. What small businesses cannot afford is the distinctive small-business failure — the owner arguing in the comments at 1 a.m. The same prohibitions apply, doubled: no defensiveness, no blaming customers, no deletion sprees. A sincere, prompt, specific response — what happened, what has been fixed, what affected customers should do now — regularly turns a would-be pile-on into a demonstration of character that other customers read with approval. Small scale is a genuine advantage here: the person responding is the person responsible, and audiences can tell.

Frequently Asked Questions

How fast must we respond?

As fast as you can say something true. A short acknowledgement — aware, verifying, next update at a stated time — should come quickly, because silence is interpreted, never neutral. The full factual statement follows when facts are verified; speed never justifies guessing. The discipline that makes both possible is preparation: templates, named approvers and a facts base ready before the day arrives.

Should we always apologise?

Apologise for what is genuinely yours: the failure, the harm, the delay in responding. A sincere apology names the failing and the remedy; it does not confess to things that did not happen, and it is never the formula “sorry if anyone was offended”, which apologises for the audience’s reaction instead. Where responsibility is genuinely disputed or unknown, acknowledge the impact and commit to establishing the facts — concern and candour are possible before conclusions are.

Can a crisis ever do a company good?

Handle one well and a company can emerge with its competence more visible than before — but that is salvage, not strategy. Nobody should want the test, the outcome is never assured, and plenty of well-handled crises still cost heavily. The honest version of the claim is narrower: preparation converts some disasters into demonstrations. The aim of everything in this article is prevention and damage honestly limited — anything beyond that is luck, and luck is not a plan.

Conclusion

A PR nightmare, in the end, is rarely about the incident. It is about the gap — between event and response, between claim and conduct, between the update promised and the update delivered. Everything in this guide to preventing and managing a PR nightmare is a way of closing those gaps in advance: watch for the smouldering issues, keep the facts and the draft words ready, name the people, rehearse the voice. Then, when the bad day comes — verify before speaking but speak, acknowledge the people affected first, update when you said you would, fix things with evidence, and let the recovery be an audit rather than an advertisement. No preparation makes a company crisis-proof. It makes the company ready, and in a crisis, ready is the whole difference.