Crisis Management

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

Structured Approach in the Crisis Management Team

From Situation Briefing to Implementation

Professional crisis management relies on clear structures, transparent processes, and targeted communication. Especially in crisis management teams, which operate under time pressure and high uncertainty, a methodical approach determines the success or failure of measures. The visualisation presented here illustrates the process of Situation Briefing and Working Phase, embedded in the fundamental principles of Goals, Strategies, and Priorities.

1. The Situation Briefing as the Core of Crisis Management Team Work

The situation briefing is the central component of decision-making in the crisis management team. It is divided into three phases and corresponds to a systematic control loop, as described in numerous manuals and standards (cf. Federal Office of Civil Protection and Disaster Assistance [BBK], 2020; ISO 22320:2018).

Phase 1

Assessment

The process begins with the Assessment of the situation. Information is gathered, evaluated, and prioritised to create a common situational picture.

• Questions of Determination: What facts are available? Which information is uncertain or missing? What framework conditions need to be considered?
• Practical Example: After the attack on Berlin’s Breitscheidplatz in 2016, it was crucial for the crisis management team of the security authorities to create a reliable situational picture within minutes to manage coordination and communication.

„A reliable situational picture is the foundation of any further crisis management. Missing or unclear information significantly increases the risk of incorrect decisions“ (BBK, 2020, p. 35).

A situational picture does not only emerge in an emergency. Those who continuously monitor the external situation do not start from scratch in a crisis but are aware of the developments leading up to the event. This is the purpose of the monthly resilience report.

Phase 2

Assessment

In this phase, the crisis management team examines various courses of action. The advantages and disadvantages are weighed, and potential developments are anticipated.

This weighing is nothing more than a risk assessment under time pressure: Each course of action carries its own risks, and each impacts the organisation’s objectives—not just the threat currently being countered. Focusing solely on the damage overlooks the option that seems inconvenient but ultimately proves better. Three questions per option quickly lead to a viable picture: What deviation from the goal is expected in the worst case, how likely is it, and what future decisions does it preclude? What exactly a risk is and why it encompasses both directions—negative deviation as well as opportunity—is described in detail in the article Risk Management.

• Risk Assessment: Each option is measured against the same criteria: expected deviation from the goal, probability of occurrence, reversibility of the decision, and the question of what room for manoeuvre it leaves open for later.
• Anticipation: This involves the ability to think in scenarios and evaluate the impact of individual measures on future developments.
• Practical Example: During the COVID-19 pandemic, many crisis management teams faced the question of whether an immediate business closure or a staggered home office strategy would be more effective. The assessment heavily depended on the dynamics of infection rates and the political framework conditions.

„Crisis management teams must think in scenarios. Only then can they develop measures that are viable even under uncertainty“ (BSI, 2021, p. 22).

Phase 3

Decision

Based on the assessment, a decision is made. This condenses the discussion into a clear course of action.

• Central Requirements: Decisions must be documented, communicated, and verifiable.
• Practical Example: In the 2021 flood disaster in the Ahr Valley, delays in decision-making in parts of the command structures were a critical factor. Decisions such as evacuations should have been implemented more quickly and decisively.

„Decisions in the crisis management team are not an end in themselves but must lead to consistent implementation“ (ISO 22320:2018).

2. The Working Phase

Following the decision is the implementation. This phase is the actual working phase, where measures are initiated, managed, and monitored.

Phase 4

Implementation

• Control: The effectiveness of the measures is continuously reviewed. Adjustments feed back into the next situation assessment.
• Practical Example: In widespread power outages (blackout scenarios), it becomes evident that implementation only works if processes such as emergency power supply or communication channels have been tested and documented beforehand (see DKKV, 2019).

3. Interaction of Situation Briefing and Working Phase

The visualisation highlights the cyclical nature of crisis management team operations:

1. Situation assessment,
2. Evaluation,
3. Decision,
4. Implementation.

The results of the implementation feed directly back into the next assessment. This creates a continuous control loop, comparable to the principles of the PDCA cycle (Plan–Do–Check–Act), as used in management systems (e.g. ISO 22301^[1], ISO 27001^[2]).

4. Success Factors for Crisis Management Teams

For this structured approach to work, several factors are crucial:

• Clarification of Roles and Responsibilities: Clear responsibilities within the team (see BBK, 2020).
• Discipline in the Phases: No mixing of discussion (Phase 2) and decision (Phase 3).
• Communication: Precise, unambiguous language without ambiguities.
• Transparency: Every decision is documented in a comprehensible manner.
• Flexibility: Adjustments are possible at any time, as situations are highly dynamic.

5. Conclusion

The model provides a scientifically grounded and practical guide for the work of crisis management teams. It combines the necessity of structure with the ability for flexibility.

For crisis coordination, this means:

• Speed through clarity,
• Confidence in action through transparency,
• Resilience through forward-thinking.

A crisis management team that consistently applies this model lays the foundation for successful crisis management – from the initial situation assessment to sustainable implementation.

Further Models in Crisis Management

Crisis management models can be divided into several key functional areas, each addressing different requirements of a crisis.

Lifecycle Models structure the entire course of a crisis from preparation through management to the return to normal operations.
Leadership and Decision-Making Models support the work of the crisis management team by providing clear procedures for situation assessment, decision-making, and action management.
Communication Models focus on structured internal and external information dissemination during a crisis.
Incident and Technical Response Models focus on the systematic handling of technical or digital disruptions, defining detection, response, and recovery.

Together, these categories form the methodological foundation for professional, comprehensive crisis management.

Lifecycle Models in Crisis Management

Lifecycle models form the structural foundation of crisis management. They categorize a crisis into clearly defined phases, enabling organizations to systematically plan responsibilities, processes, and governance requirements. Through their phase-oriented logic, they support both the strategic development of a crisis management system and the operational implementation during actual situations.

The following models are internationally and nationally recognized lifecycle frameworks.

PPRR Model

The PPRR Model (Australian Government, 2011) divides crises into four logical sections. Each phase has its own purpose and describes the organizational, structural, and operational activities that must occur there.

Phases:

Prevent describes all measures aimed at reducing the likelihood or impact intensity of a crisis. This includes hazard analyses, structural prevention, technical protective measures, organizational controls, and risk treatment. The goal is to systematically mitigate or eliminate known risks.

Prepare encompasses all activities necessary to prepare an organization for a crisis. This includes plan development, role definition, training, exercises, communication structures, and resource building. This phase ensures readiness and creates the conditions for an effective response.

Respond describes the structured management of an occurred crisis. This includes situation assessments, coordination, decision-making processes, crisis communication, and operational measures for damage limitation. This phase addresses the actual ability to act during a disruption or threat.

Recover focuses on the return to orderly operations. This includes restart processes, restoration of damaged resources, lessons learned, and measures for gradual normalization.

The benefit of the PPRR Model lies in its clear, easily understandable structure that maps the entire crisis cycle. Organizations can develop emergency and crisis manuals, establish continuous improvements, and position themselves stably with clear responsibilities in all phases.
Governance-relevant is the clear assignment of responsibilities and competencies. PPRR enables the clear separation between preventive roles (e.g., risk management), preparatory roles (e.g., BCM, staff work), operational roles during the crisis, and functions responsible for recovery. Additionally, the model supports the development of binding guidelines and compliance structures.
Organizations use PPRR in business continuity programs, emergency manuals, risk analyses, and training concepts. The logic is suitable for exercises, the development of alert procedures, and the structuring of restart plans.

An advantage of the model is its clarity and comprehensive coverage of a crisis course. It is also applicable across industries and internationally widespread.

A disadvantage is the limited elaboration of operational decision-making mechanisms during the response. The „Recover“ phase is relatively open and often requires supplementary detailed models.

4R Model

The 4R Model by FEMA (2015) combines classic crisis phases with a stronger emphasis on resilience orientation.

Phases:

Reduction (Risk Mitigation) encompasses all preventive measures aimed at reducing risks or minimising their impact. This includes structural protective measures, risk treatment strategies, and strategic resilience planning for operators of critical facilities within the KRITIS Resilience Plan.

Readiness (Preparedness) refers to all organisational preparation processes. This includes training, exercises, plan development, capacity building, and establishing functional coordination mechanisms.

Response (Reaction) covers the operational management of a disruption. This phase includes situation assessment, decision-making processes, coordination of multiple departments, and the deployment of available resources.

Recovery (Restoration) describes the systematic return to normal operations. This includes infrastructure repairs, restart processes, psychological support, and organisational adjustments.

The benefit of the model lies in its strong focus on resilience. It closely integrates risk mitigation and preparedness, enabling a comprehensive view of all organisational protective measures.
Governance-wise, the model integrates risk management, security management, and business continuity into a unified framework. Responsibilities range from strategic risk reduction goals to operational training requirements and recovery processes.
The model is frequently used in companies to harmonise risk policy, BCM guidelines, prevention programmes, and recovery logics.

An advantage is the strong resilience perspective, which many other models do not represent with such clarity. It is also well compatible with existing governance systems.

A disadvantage is that individual phases are defined differently in the literature, particularly the „Reduction“ phase. Additionally, the operational depth is less than in tactical models.

FEMA Crisis Cycle

The FEMA Crisis Cycle (FEMA, 2016) is the mandatory crisis standard of the United States and divides the crisis progression into mitigation, preparedness, response, and recovery.

Phases:

Mitigation (Damage Mitigation) focuses on reducing the impact of future crises. This includes risk analyses, structural defence measures, and strategic protection concepts.

Preparedness (Preparation) encompasses the organisational and technical preparation for a crisis, including training, exercises, resource planning, and communication structures.

Response (Reaction) includes all operational measures during a disruption, such as crisis management team work, decision-making processes, communication, and deployment coordination.

Recovery (Reconstruction) describes the restoration and normalisation after a crisis, including repairs, restart processes, and institutional learning processes.

The benefit of this model is that the FEMA cycle provides an internationally comprehensible structure that guides both governmental actors and companies in complex crisis scenarios. It facilitates coordination between organisations and creates a unified framework for preparation, operational management, and recovery. Furthermore, the model enhances compatibility with risk management and resilience strategies, as all phases are embedded in an overarching context.
Governance-wise, the FEMA Crisis Cycle offers clear guidelines for roles, responsibilities, cooperation mechanisms, and reporting obligations. This particularly strengthens inter-organisational coordination processes and ensures that companies and authorities build on common structures. This significantly eases collaboration in cross-border or cross-organisational crises.
In practice, the FEMA cycle is primarily used for crisis manuals, emergency response plans, contingency plans, exercises, and coordination with authorities. It often serves as a framework for developing standardised procedures and coordinated deployment structures in complex crisis situations.

An advantage of the model is its clear, internationally understandable structure, which can be easily applied to various types of organisations. Another advantage is the strong institutional anchoring in authorities and large organisations, which facilitates cross-border collaboration.

A disadvantage arises from its strong focus on governmental mechanisms, requiring companies to partially adapt the model to reflect operational specifics.

BSI Emergency Management Model

The BSI Standard 200-4^[3] in version 1.0 from May 2023 defines four phases: Preparedness, Response, Recovery, and Normal Operations. The model is specifically aimed at German companies and authorities and is closely linked to information security and BCM requirements.

Phases:

Preparedness includes risk analyses, emergency planning, protective measures, role definitions, and organisational preparations. The aim is to reduce disruptions and impacts and to establish readiness.

Response describes active crisis management through staff work, situation assessment, communication, and damage minimisation.

Recovery involves the orderly restoration of affected processes, systems, and resources.

Normal Operations refers to the complete return to regular operational states and post-event review.

The benefit of this model lies in its high regulatory compatibility and clear structuring of processes, roles, and reporting lines. It is particularly suitable for organisations that need to meet requirements such as KRITIS, NIS2^[4], data protection, or ISO-based management systems. Its strong focus on traceability, documentation, and auditability provides a stable framework for auditable and robust emergency and crisis structures.
Governance-relevant aspects include the clear responsibilities defined by the standard, such as for emergency managers, business continuity officers, or leaders in crisis situations. The standard requires documented processes, regular reviews, defined reporting structures, and a mandatory continuous improvement process. This creates a systematic governance framework that ensures both internal security and external auditability.
In practical application, the model forms the basis for emergency manuals, recovery plans, crisis guidelines, internal regulations, and the integration of emergency and BCM structures into existing management systems. It is also frequently used for audits, maturity assessments, and regulatory compliance evidence.

An advantage of the model is its high structural quality, which enables reliable, auditable, and governance-compliant implementation. Furthermore, it is specifically adapted to German conditions, facilitating integration into corporate and governmental contexts.

A disadvantage is the comparatively high documentation effort, which can be resource-intensive, especially for smaller organisations. Additionally, the model depicts operational decision-making processes in less detail, necessitating supplementary leadership models for actual crisis management.

Leadership and Decision-Making Models in Crisis Management

Leadership and decision-making models describe how a crisis management team operates, makes decisions, processes information, and controls actions. They are thus the operational core of crisis management. While lifecycle models structure the entire course of a crisis, leadership and decision-making models focus on the specific working methods during the crisis: situation assessment, decision-making, coordination, communication, and implementation. They ensure that crisis management teams can act quickly, coherently, and reliably, especially under time pressure, uncertainty, and high complexity.

RACER Model

The RACER Model (International SOS & Control Risks, 2020) describes a structured process by which crisis management teams gather information, assess it, form themselves, make decisions, and resolve the situation. In the Report phase, incoming reports, signals, or indicators are collected. Assess involves structured situation assessment, risk evaluation, and prioritisation. In the Convene phase, the crisis management team is activated and made operational. Execute describes the implementation of decisions, including communication. Resolve addresses the transition back to a non-crisis state and subsequent post-event review.

Phases:

Report – In this phase, all relevant information, reports, sensor values, disruptions, or external indications are received. The aim is to obtain an initial, as complete as possible, picture of the perceived situation. This phase includes the collection of status information, alerts, escalation reports, or automated technical signals.

Assess – This is where the initial situation assessment takes place. The crisis management team or the initially responsible person evaluates the significance of the event, the risks involved, the foreseeable impacts, and whether activation of the crisis management team is necessary. This phase involves risk assessment, prioritisation, and derivation of an initial situation picture.

Convene – In this phase, the crisis management team is formally activated. The necessary personnel are convened, roles are assigned, and communication channels are established. This includes the operational establishment of the team’s working capability: room opening, digital systems, communication tools, dial-in, and role clarification.

Execute – This is where the actual crisis work takes place. Decisions are made, measures implemented, communication channels activated, resources coordinated, and operational steps initiated. The phase encompasses all tactical and strategic actions as well as the continuous updating of the situation.

Resolve – This phase describes the transition out of crisis mode. This includes recovery steps, return to regular operations, handover to line organisations, and conducting post-event reviews, lessons learned, and documentation.

The benefit of the RACER model lies in its clear sequence and rapid applicability. The phases create a logical structure that functions immediately in both small and large organisations, enabling a stable working rhythm. From a governance perspective, RACER creates verifiable points of responsibility, clear triggers for team convening, and traceable decision paths. Each phase generates documentable outputs that are legally and organisationally robust even in retrospect. In practice, RACER is particularly suitable for operational crisis meetings, rapid situation assessments, early activation decisions, and initial coordination in complex scenarios.

A benefit is the high simplicity and low implementation effort. Another advantage is its universal comprehensibility.
A drawback is that the model only partially maps complex decision architectures and should be supplemented for extensive teams.

For organisations looking to professionalise their crisis management team work, our Network for Security and Resilience offers targeted support:

• Planning and conducting realistic crisis exercises (including scenarios, if-then decisions, role assignment).
• Support in crisis management – from organisational setup to situation communication.
• Needs-based support in developing structured processes, decision-making procedures, and documentation.

If you are interested in practical exercises or further developing your crisis management team work, feel free to contact us. Together, we create robust structures that hold up in an emergency.

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are summarised.

1. BBK (Federal Office of Civil Protection and Disaster Assistance). (2020). Handbook for the Crisis Management Team. Bonn. ↑
2. DKKV (German Committee for Disaster Reduction e. V.). (2019). Learning from Disasters – Analysis of Power Outages in Europe. Bonn. ↑
3. ISO (International Organization for Standardization). (2018). ISO 22320:2018 – Security and resilience – Emergency management – Guidelines for incident management. Geneva. ↑
4. Australian Government. (2011). Emergency management in Australia. Attorney-General’s Department. ↑
5. Federal Emergency Management Agency. (2015). National preparedness goal (2nd ed.). U.S. Department of Homeland Security.
6. Federal Emergency Management Agency. (2016). National response framework (3rd ed.). U.S. Department of Homeland Security.