Crisis communication agency: the three engagement models, the contract to sign before anything happens, and how to judge the work

A crisis communication agency is retained for three distinct jobs, and the one you buy decides what you get. Readiness is the work done while nothing is wrong: the plan, the rehearsals, the trained spokespeople, the pre approved holding statements and the contact tree. Response is the work during the event: the first statement, the media and stakeholder handling, the monitoring, and the sequencing of who hears what and when. Recovery is the work afterwards: corrections, the search and review repair, and the changes you can point to. Most organisations buy response alone, under pressure, at the highest price and with no room to negotiate. The ones who get real value sign a readiness and standby agreement first, so the response is a phone call rather than a procurement exercise.

This page covers choosing and contracting a crisis firm. For the long tail of a crisis in search results, see search engine reputation management.

The three engagement models

Model	What you get	When it is the right buy
Readiness retainer	Risk audit, a written plan, spokesperson training, scenario rehearsals, holding statement library, annual refresh	Any organisation with a regulator, a factory, a fleet, customer data, or a public leadership team
Standby agreement	A signed contract, agreed rates, a named team, a stated response time and out of hours contacts, with little or no monthly fee	Lean teams that want the contract done in advance without a full readiness programme
Emergency engagement	A team mobilised during a live incident, usually billed at a premium day rate or a fixed incident fee	When something is already happening and nothing was signed

The highest return item on that table is the standby agreement, because the expensive part of an emergency engagement is not the rate. It is the hours lost to a conflict check, a non disclosure agreement, a purchase order and a briefing, while the story moves.

Match the firm to the kind of crisis you can actually have

Run your own risk list first, then hire for the two or three scenarios that are plausible for you.

• Product safety and recall. Regulatory notification sequencing, customer contact at scale, and language accurate enough to survive a legal review while still being understandable.
• Data breach. Coordination with legal counsel and forensics, a notification timeline driven by data protection law rather than by communications preference, and messaging that holds up when more is discovered later.
• Leadership conduct. Employment law coordination, internal communications as the primary audience, and a plan for the board and investors ahead of the press.
• Operational accident or injury. A response built around the people affected, one trained spokesperson, and strict discipline about speculation on cause.
• Financial or regulatory action. Disclosure literacy, careful language about continuing proceedings, and separate tracks for investors, employees and customers.
• Social and influencer backlash. Platform literate judgement about when responding helps and when it feeds the story, and a clear line on what gets corrected publicly.

Ask each firm to name the scenarios they handle most and show the work. A generalist who has never run a regulated notification is the wrong choice for a breach, however good their media relationships are.

What the first hour should look like

This is the right thing to ask a shortlisted firm to walk you through, because it exposes whether they have a method or a reputation.

• Verify before anything is said. Establish what is known, what is suspected and what is unknown, and keep those three columns separate in every internal document.
• Convene a named group, not a crowd. A decision maker, legal, operations, communications and whoever owns the affected function.
• Issue a holding statement fast. Confirm awareness, state what you are doing, state when you will say more, and say nothing about cause. Silence in the first hour is itself a statement, and it is the one that gets reported.
• Tell the people closest to it first. Those affected, then employees, then customers, then regulators and partners on their required timeline, then media.
• One spokesperson, one set of facts. Everyone else routes enquiries. Mixed messages from two executives are the most common self inflicted damage in a live incident.
• Start the log, and start monitoring. Every decision with the time and who made it, and a named person watching media, social, review sites, forums, employee channels and search results.

Settle these terms while nothing is happening

• Response time and out of hours cover. A stated time to a first call, a number that is answered at 2am, and a named deputy.
• Named consultants, with substitutes agreed. You are buying specific judgement, so name them in the contract.
• Conflict checks done in advance, against competitors and counterparties. Finding a conflict during an incident costs you the firm.
• Confidentiality and data handling. Non disclosure signed, a secure channel agreed, and a rule that case material is never used in a credentials pitch without written consent.
• How they work with your lawyers. Agree in advance who arbitrates when legal and communications advice pull apart, and how privilege is preserved when drafts circulate.
• Fees in both states. The readiness or standby fee, the emergency day rate, the cap or review point, and expenses.
• An escalation ladder. Who on your side can authorise a statement at midnight, and who signs off if they are unreachable.

Questions for the shortlist

• Describe an incident you ran that went badly. What did you get wrong and what changed in your method afterwards?
• Who answers the phone at 2am on a Sunday, and who is their deputy?
• Walk me through your first hour for the scenario most likely to hit us.
• How do you work alongside external counsel, and how do you preserve privilege on drafts?
• What do you do when the facts change after we have made a statement?
• How do you handle the internal audience, and who writes to employees?
• What are you not good at, and who would you bring in for it?

How to judge the work

Sentiment scores alone are a poor measure, because sentiment in a real crisis should be negative. Measure what the response controls.

• Time to first statement, from the moment the organisation knew.
• Accuracy of coverage, and the corrections secured where articles got it wrong.
• Message presence. The share of coverage that includes the action you are taking, not just the allegation.
• Stakeholder sequence. Did every group hear from you before they heard from somebody else, on the timeline the rules required.
• Decay curve. Volume of mentions over the following ninety days, against the first week.
• The search result page at ninety days. What a customer or a candidate sees when they search your name. This is the part of a crisis that lasts longest and the part most firms hand back unfinished.

Two things to refuse

Be wary of a firm that offers to get coverage removed. The legitimate routes are a correction, a right of reply, a complaint to a press regulator, or a legal process run by lawyers, and all of those are specific and evidenced. Be equally wary of anyone selling search result suppression. The honest version is publishing better material, correcting inaccurate records at source and using the platform's own documented process, covered in what qualifies for review removal and how public relations and search work together.

What does a crisis communication agency cost?

It is priced in two states. A readiness or standby arrangement is a recurring or annual programme fee set by the scope of the audit, the training and the rehearsals. A live incident is billed at a premium rate because it consumes a senior team at no notice. Ask for both numbers in writing, and what triggers the switch between them.

Do we need one if we already have a PR agency?

Ask your current agency the first hour question and the 2am question. Some full service firms have genuine crisis capability and a rota; many have excellent media relationships and no incident method. If the answer is thin, a standby agreement with a specialist alongside them is the usual arrangement.

Who should the spokesperson be?

One trained person, senior enough to be credible and close enough to the facts to be accurate. For serious harm, that is usually the chief executive, briefly and once. For technical detail, a named expert. Train both before they are needed, on camera, with hostile questions.

What belongs in a crisis plan?

A scenario list with an owner for each, the decision group and their contact details including personal numbers, the escalation ladder, holding statement templates per scenario, the stakeholder notification order with legal deadlines marked, the approved spokespeople, the monitoring setup, the log template, and a one page version that fits on a phone screen.

The part of the record that now answers for you

Ninety days after an incident, a customer, a candidate or a journalist checking your company is as likely to ask an assistant as to run a search. ChatGPT, Gemini, Perplexity, Claude and Google's AI Overviews each assemble a description of a company from whatever the open web holds, and they answer differently from each other, so one may still be summarising the first and least accurate article written about the event while another has moved on. Check it during the recovery phase rather than after: ask each assistant what it says about your company and the incident, record which sources it cites, then work on those sources. AI Knows Us runs that comparison across the five and reports the pages behind each answer, and the first scan needs no account.