← University
Crisis Communication During a Disruption
0 of 4

A regional accounting and advisory firm with 3 offices across southern Alberta discovered on a Thursday morning that its central file management system had become inaccessible. The firm employed 47 staff members across its locations and served approximately 1,200 active clients, ranging from individual tax filers to mid-sized manufacturing operations and several non-profit organizations. The system outage initially appeared to be a routine technical failure, but within 4 hours the firm's IT contractor confirmed that the disruption stemmed from a ransomware attack that had encrypted client files, internal communications archives, and the firm's scheduling and billing platforms.

The timing could not have been worse. The disruption occurred 6 weeks before the personal tax filing deadline, during the busiest period of the firm's annual cycle. Client documents submitted electronically over the preceding 3 months remained locked within the compromised system. Staff members at all 3 locations found themselves unable to access work files, communicate through internal channels, or confirm upcoming appointments with clients. The firm's managing partner and operations director faced immediate decisions about what to tell employees who were arriving at their desks to find their workstations frozen, what to communicate to clients who had entrusted sensitive financial documents to the firm, and whether regulatory notification was required given the nature of the data potentially affected.

The firm maintained a general business continuity plan that addressed premises emergencies and key personnel loss, but the plan had not been updated in 2 years and contained only a brief paragraph on communications during a disruption. No media relations protocol existed. The firm had a modest social media presence — a business page with approximately 800 followers and an occasional professional networking account — but no designated spokesperson and no experience managing public attention during an adverse event. Within 24 hours of the initial discovery, a local business reporter contacted the firm's reception line seeking comment on rumours of a cyberattack affecting a professional services provider in the region.

The firm's leadership now confronted overlapping communication challenges: keeping staff informed and functional across multiple locations, notifying clients whose data might be affected, determining what obligations existed toward professional regulators and privacy authorities, managing supplier relationships while payment systems remained offline, and responding to media inquiries without making statements that could create legal exposure or inflame public concern. The decisions made over the following 72 hours would shape whether the disruption remained a difficult but survivable incident or escalated into a reputational and operational crisis that threatened the firm's long-term viability.

Crisis Communication Principles: What Works Under Pressure and What Fails

When a crisis strikes an organization, the first instinct is often to focus on operational recovery: restoring systems, securing premises, addressing immediate safety concerns, and getting back to business as usual. These priorities are entirely appropriate, but they represent only part of what determines whether an organization survives a disruption with its reputation, stakeholder relationships, and operational capacity intact. How an organization communicates during a crisis frequently matters as much as the technical response itself. Poor communication can transform a manageable incident into a catastrophic failure of public trust, while effective communication can actually strengthen stakeholder confidence even when the underlying situation is serious. Understanding what works under pressure and what fails is not merely a matter of public relations instinct. It requires deliberate preparation, an understanding of human psychology during uncertainty, and alignment with the standards and expectations that govern organizational conduct across Canadian jurisdictions.

Crisis communication as a discipline emerged from decades of research into organizational failures where the communication response either mitigated or amplified the damage caused by the original incident. The foundational principle is deceptively simple: stakeholders need accurate, timely, and appropriately detailed information to make decisions that protect their own interests and to maintain trust in the organization providing that information. This principle operates whether the stakeholders are employees needing to know whether to report to work, customers wondering if their data has been compromised, regulators assessing compliance obligations, or community members concerned about environmental or safety impacts. The challenge is that crisis conditions create precisely the circumstances under which clear communication becomes most difficult. Information is incomplete, the situation is evolving, multiple parties are demanding answers simultaneously, and the stakes of saying something incorrect feel paralyzingly high. Organizations that have not prepared for this reality often default to silence, evasion, or premature reassurance, each of which tends to make the situation worse rather than better.

That’s the free preview

You’ve reached the end of what’s open to read. The rest of this lesson is part of a $79 course — purchasing unlocks it, or sign in if you already have access.