How to Build a Crisis Management Team

A crisis management team does not become operational the day an incident occurs. It is operational because its members have learned to make decisions with incomplete information, to coordinate stakeholders with differing priorities, and to maintain critical operations under pressure. Knowing how to build a crisis management team, therefore, means developing a sustainable collective capacity—not merely organizing a one-time awareness campaign.

For organizations subject to strict requirements regarding availability, compliance, or security, this training is part of business continuity governance. It must link crisis scenarios to the Business Continuity Plan (BCP), the Disaster Recovery Plan (DRP), cybersecurity measures, regulatory obligations, and communication mechanisms. The goal is not to establish standardized responses at all costs, but to enable rapid, justifiable decisions that are consistent with the organization’s priorities.

Start by defining the crisis management team’s mission

The first mistake is to form a team without clarifying its mandate. A crisis management team is neither a scaled-down executive committee nor a team dedicated solely to communications. Its role is to assess a deteriorating situation, set priorities, allocate resources, and steer the organization back to a controlled state.

The scope must be clearly defined: What events warrant its activation? Who can trigger it? What decisions can it make without additional approval? What thresholds require notification of senior management, authorities, customers, or partners? These answers determine the competencies to be developed and the expected level of autonomy.

In a cyber crisis, for example, the response team must be able to balance the need to isolate a system, ensure the continuity of a priority service, preserve evidence, and meet reporting obligations. In an industrial or logistics crisis, trade-offs may involve personal safety, site availability, supply chains, and contractual obligations. The methodological foundation is the same, but the scenarios, stakeholders, and critical decisions vary by sector.

How to Build a Crisis Management Team with Clear Roles

An effective team does not rely on bringing together all available experts. It relies on clearly defined roles, identified substitutes, and well-defined points of contact with operational teams. The number of participants must remain consistent with the decision-making process: a team that is too large slows down decision-making, while a team that is too small risks overlooking major impacts.

The following positions must be filled, with a clear distinction between the incumbent and the substitute:

• The crisis manager sets priorities, approves trade-offs, and escalates decisions to the appropriate level of governance.
• The crisis coordinator sets the pace of the meetings, maintains an overview of the situation, tracks actions, and ensures traceability.
• Business and technical leads assess the impacts, propose response options, and oversee implementation within their scope.
• The communications manager develops messages for employees, customers, partners, the media, and government agencies, in coordination with the legal and compliance departments.

Depending on the context, the involvement of information systems security, human resources, safety, legal, data protection, or regulatory affairs may be essential. However, these representatives should not be involved only during an annual exercise. They must be familiar with the activation procedures, decision-making processes, and constraints of other business units.

The training must also address the issue of absences. An organization that relies on a single person to manage a crisis has a governance vulnerability. Deputies must be trained to the same standard, have the necessary access, and participate in drills in active roles.

Train people in decision-making methods, not just procedures

Crisis management procedures are necessary, but they are not enough when the situation changes every fifteen minutes. Team members must master a decision-making discipline: distinguishing confirmed information from assumptions, assessing the consequences of a course of action, documenting trade-offs, and reevaluating decisions as the situation changes.

An operational training program must, in particular, teach participants how to establish a shared understanding of the situation. This requires providing precise answers to a few questions: What do we actually know? Which activities, people, data, or infrastructure are affected? What is the next irreversible deadline? What actions are being taken, by whom, and with what expected outcome?

The crisis log plays a vital role here. It records events, decisions, responsible parties, times of action, and evidence. It facilitates handoffs between teams, supports external communication, and serves as a key resource for lessons learned. Without this traceability, the response team risks confusing a collective perception with an objective assessment of the situation.

The training must also address decision-making biases. Confirmation bias, focusing on the technical incident at the expense of the business impact, or seeking immediate agreement can delay an appropriate response. The crisis manager must know how to request an alternative option, clarify the level of uncertainty, and make decisions even when not all data is available.

Reinforce skills through realistic exercises

A team does not prepare for a crisis by simply reading a plan. Drills turn procedures into collective reflexes and reveal the gaps between the theoretical plan and reality. They must be progressive: tabletop exercises, cell simulations, communication drills, and finally, scenarios involving response teams and key service providers.

Realism doesn’t necessarily mean a complex scenario. A well-designed scenario incorporates incomplete information, conflicting inputs, time constraints, and plausible external demands. An application outage, for example, might be accompanied by a rumor on social media, a call from a key client, and a request from a regulatory authority. The team must then demonstrate its ability to prioritize these issues rather than treat each one with equal importance.

The evaluation criteria must be known before the exercise begins. These may include response time, the quality of the initial assessment, the clarity of decisions, follow-up on actions, the consistency of messages, or escalation to higher levels of governance. Evaluating speed alone would be too narrow an approach: a decision that is made quickly but is poorly documented or inconsistent with the organization’s obligations can make the situation worse.

Feedback should be provided immediately after the event and again after analysis. Its purpose is not to assign blame to individuals, but to identify concrete areas for improvement: an outdated contact list, unclear decision-making authority, an underestimated dependence on a supplier, or an unworkable communication procedure. Each action must have an owner, a deadline, and a method for verification.

Linking Training to Business Continuity and Governance

Establishing a crisis response team separate from other resilience mechanisms creates predictable gaps. Members must understand continuity objectives, critical activities, maximum downtime thresholds, recovery strategies, and essential dependencies. Otherwise, the team risks making decisions that are technically sound but incompatible with business priorities.

This link is particularly critical in cyber crises. The response to an incident is not limited to containment and investigation. It must include service recovery, conditions for returning to production, relationships with suppliers, communication with stakeholders, and notification requirements. Coordination between crisis management, incident response, the Business Continuity Plan (BCP), and the Disaster Recovery Plan (DRP) must therefore be tested, not merely described in separate documents.

Recognized standards, particularly ISO 22301, provide a useful framework for integrating this preparedness into a management system. They do not replace training, but they help structure responsibilities, competencies, exercises, performance evaluation, and continuous improvement. For a mature organization, training can thus be linked to internal control, audit, and compliance objectives.

Developing a Sustainable Training Program

The appropriate format depends on the organization’s maturity and its exposure to risks. A newly formed team will need a common foundation regarding activation procedures, roles, communication, and the conduct of crisis meetings. An experienced team will benefit more from sector-specific simulations, multi-site scenarios, or exercises involving senior management, service providers, and external stakeholders.

Training must be updated following a major transformation—such as a technology migration, merger, regulatory change, change in a critical service provider, or modification to the governance structure. It must also be incorporated into the onboarding process for new managers who may join the team. Crisis management skills that are neither maintained nor passed on quickly erode.

Finally, the professional development of stakeholders can be enhanced through structured training programs and certifications focused on business continuity and crisis management. DRI France supports this skill-building process with an approach based on recognized standards and their application in professional settings.

The value of a crisis management team is rarely apparent before an incident occurs. That is precisely why its preparedness deserves the same level of scrutiny as that applied to technical systems and compliance controls: explicit responsibilities, proven skills, and decisions that have been practiced before they become critical.

This post is also available in: