Reflections on Crisis Management

Today, during a seminar at NUS Business School led by Alan Zeller, one key takeaway was clear: crisis management begins long before a crisis hits. Once a crisis is underway, reactive measures are often too little, too late.

I initially believed the difference between risk management and crisis management lay in timing, but it’s really about uncertainty. While risks can be identified and mitigated, crises are unpredictable. Building the capability to handle crises decisively is essential.

In more detail:

• Risk management involves assessing potential future events, focusing on their likelihood, severity, and impact speed, allowing organizations to preemptively address the most critical risks.

• Crisis management deals with the unpredictable, requiring proactive planning and flexibility, as crises often unfold in chains, demanding rapid and adaptable responses.

A major part of crisis management is crisis communication. How the situation is perceived can be as important as the operational response. Poor communication can turn a manageable crisis into a reputational disaster.

We analyzed real-life cases such as AirAsia’s plane crash and BP’s oil spill in the Gulf of Mexico. BP’s response, in particular, was a lesson in failure—poor communication and lack of accountability worsened the crisis and severely damaged the company’s reputation.

In today’s digital age, cybersecurity crises are an increasing concern, with data breaches and cyberattacks becoming more frequent. The ability to manage such crises can determine whether a company faces temporary disruption or long-term damage. That’s where Business Continuity Planning (BCP) becomes critical—not just as a reactive tool, but as an integrated part of crisis management. Ensuring that key operations continue during a crisis minimizes immediate fallout and allows organizations to recover swiftly. Without this preparation, even minor crises can escalate into major disruptions.