← University
Crisis Communication During a Disruption
0 of 4

A regional accounting and advisory firm with 3 offices across southern Alberta discovered on a Thursday morning that its central file management system had become inaccessible. The firm employed 47 staff members across its locations and served approximately 1,200 active clients, ranging from individual tax filers to mid-sized manufacturing operations and several non-profit organizations. The system outage initially appeared to be a routine technical failure, but within 4 hours the firm's IT contractor confirmed that the disruption stemmed from a ransomware attack that had encrypted client files, internal communications archives, and the firm's scheduling and billing platforms.

The timing could not have been worse. The disruption occurred 6 weeks before the personal tax filing deadline, during the busiest period of the firm's annual cycle. Client documents submitted electronically over the preceding 3 months remained locked within the compromised system. Staff members at all 3 locations found themselves unable to access work files, communicate through internal channels, or confirm upcoming appointments with clients. The firm's managing partner and operations director faced immediate decisions about what to tell employees who were arriving at their desks to find their workstations frozen, what to communicate to clients who had entrusted sensitive financial documents to the firm, and whether regulatory notification was required given the nature of the data potentially affected.

The firm maintained a general business continuity plan that addressed premises emergencies and key personnel loss, but the plan had not been updated in 2 years and contained only a brief paragraph on communications during a disruption. No media relations protocol existed. The firm had a modest social media presence — a business page with approximately 800 followers and an occasional professional networking account — but no designated spokesperson and no experience managing public attention during an adverse event. Within 24 hours of the initial discovery, a local business reporter contacted the firm's reception line seeking comment on rumours of a cyberattack affecting a professional services provider in the region.

The firm's leadership now confronted overlapping communication challenges: keeping staff informed and functional across multiple locations, notifying clients whose data might be affected, determining what obligations existed toward professional regulators and privacy authorities, managing supplier relationships while payment systems remained offline, and responding to media inquiries without making statements that could create legal exposure or inflame public concern. The decisions made over the following 72 hours would shape whether the disruption remained a difficult but survivable incident or escalated into a reputational and operational crisis that threatened the firm's long-term viability.

Internal Communication: Keeping Staff Informed Without Creating Panic

When a crisis strikes an organization, the instinct to control information often collides with the necessity of keeping employees informed. This tension sits at the heart of internal crisis communication, a discipline that requires balancing transparency with measured delivery, urgency with calm, and honesty with organizational stability. The failure to communicate effectively with staff during a disruption does not merely create confusion; it erodes trust, amplifies anxiety, and can transform a manageable incident into an organizational catastrophe. For Canadian small and medium-sized businesses, non-profits, and professional service firms, mastering this balance represents a core competency that separates resilient organizations from those that fracture under pressure.

The foundation of effective internal crisis communication rests on understanding that employees are not passive recipients of information but active participants in organizational response. When staff members lack clear, timely, and accurate information about a disruption, they do not simply wait patiently for updates. Instead, they fill information vacuums with speculation, share unverified accounts through informal channels, and make independent decisions that may conflict with organizational response plans. This phenomenon, sometimes called the rumour mill effect, operates with particular intensity during crises when anxiety levels peak and the perceived stakes of information become elevated. Canadian workplace standards and employment obligations create additional layers of consideration, as employers have duties to inform workers about conditions affecting their health, safety, and employment status. The Canada Labour Code, as of the date of authorship, establishes requirements for federally regulated employers regarding workplace safety communication, while provincial occupational health and safety legislation across British Columbia, Alberta, Saskatchewan, Ontario, and other common law provinces creates parallel obligations. Quebec's civil law framework, operating under the Civil Code of Quebec alongside the Act respecting occupational health and safety, generates distinct duties regarding employer-employee communication that merit careful attention from organizations with operations in that province.

That’s the free preview

You’ve reached the end of what’s open to read. The rest of this lesson is part of a $79 course — purchasing unlocks it, or sign in if you already have access.