Risk management and crisis management answer different questions. Risk management examines uncertainty around objectives and the choices available. Crisis management organizes a strategic response when an exceptional situation threatens the organization. This article explains how they connect, how to recognize escalation, and how a small or medium-sized organization can prepare a workable response without building an oversized manual.
What is the difference between risk and crisis management?
Risk management is coordinated work to understand and address uncertainty affecting objectives. It operates during planning, delivery and change, including during a crisis. A risk is not simply a disaster waiting to happen. Uncertainty can change the outcome of a decision in more than one direction. The practical question is what could affect an objective and what the organization will do about it.
Crisis management concerns exceptional situations requiring timely strategic decisions, often with incomplete information and competing priorities. It includes preparation and learning, not only reaction. ISO 31000:2018 provides risk management guidance. ISO 22361:2022 addresses crisis management capability, leadership, communication and learning. These are guidance references, not promises that disruption can be eliminated.
| Question | Risk management | Crisis management |
|---|---|---|
| Main focus | Uncertainty affecting objectives | An exceptional threat requiring strategic response |
| Typical decisions | Accept, change or avoid exposure and review controls | Set priorities, authorize action and coordinate communication |
| Working records | Assessment, treatment owners and review evidence | Situation reports, decisions, actions and communications |
| Timing | Continuous, including during disruption | Prepared in advance, activated when needed and reviewed afterwards |
When does an incident become a crisis?
An incident may be handled through established operational arrangements. It can become a crisis when its consequences exceed normal authority, available resources or known solutions. The label depends on context. A short service interruption might be routine for one organization and critical for another because of safety, vulnerable customers or a time-sensitive commitment.
Use agreed escalation criteria instead of waiting for a dramatic event. Consider potential harm to people, interruption of priority services, loss of reliable information, legal obligations and damage to stakeholder confidence. Specify who receives the alert, who can activate the crisis team and who acts if that person is unavailable. Review uncertain situations early. Do not assume that a quiet period means the threat has passed.
A practical supplier disruption example
Consider an illustrative distributor relying on one supplier for an essential component. Before disruption, management examines the dependency, checks alternative sources and decides what inventory or contractual arrangements are justified. The risk owner records assumptions and tests whether the proposed alternative can actually deliver.
If supply stops, operations first establish what happened and which orders are affected. Leadership may need to prioritize customers, approve exceptional spending and review commitments. If normal arrangements can manage the situation, a full crisis activation may be unnecessary. If the disruption threatens the business or requires decisions across several functions, the escalation criteria may be met.
To make the decision concrete, assume stock covers 2 days and the supplier expects to resume within 1 day. Treat that expectation as unconfirmed: procurement checks the evidence and alternative capacity while operations reviews critical orders. If the estimate changes to 5 days and the alternative remains unconfirmed, the gap calls for an immediate review against escalation criteria. The team presents options and consequences to the authorized decision maker rather than waiting for stock to run out. These timings are hypothetical illustrations of changing evidence, not universal thresholds defining a crisis.
The example is not an ATMACSS client case. Its purpose is to show that a risk register alone does not make decisions during disruption. Prepared authority, accurate information and workable alternatives must connect to the register. Afterwards, actual experience should change the assessment and future purchasing decisions.
Build a small, usable crisis arrangement
Begin with the decisions people will need to make. Name a crisis lead and deputies, identify the people who can advise on operations, finance, personnel and communication, and document approval limits. A small business may combine roles, but responsibilities must remain explicit. Keep contact information available through an alternative channel if the normal system fails.
Prepare a short situation report with a timestamp, verified facts, unknowns, affected activities, immediate priorities and decisions required. Separate confirmed information from assumptions. Assign an owner to investigate each important gap. A report that mixes rumours and facts can send a capable team in the wrong direction.
Keep a decision log showing the decision, available evidence, decision maker, action owner and next review point. This is especially useful when decisions must change. Recording the reasoning makes it possible to explain why an earlier choice was reasonable and why new evidence now requires a different response.
Communicate without inventing certainty
Decide who approves messages and who communicates with staff, customers, suppliers and other relevant parties. State what is known, what action is being taken and when another update is expected. Avoid unverified causes, blame and promised recovery times unsupported by evidence. Use a consistent core message, adapted to what each audience needs to do.
Any reporting obligation must be checked against the organization’s actual jurisdiction, activity and contracts. There is no universal notification deadline that applies to every crisis. Include the responsible specialist in planning and keep the relevant obligations accessible. Protect personal and confidential information while ensuring that decision makers receive the facts they need.
Test decisions, then close the gaps
A tabletop exercise is a discussion-based rehearsal of a plausible scenario. Start with a disruption, then introduce new information that tests escalation, authority and communication. Observe whether participants can find contact details, distinguish facts from assumptions and make decisions within their assigned roles. Record the gaps rather than treating attendance as evidence of readiness.
Useful measures include the time needed to establish a verified situation picture, whether deputies were reachable and whether agreed corrective actions were completed and tested. Set targets appropriate to the scenario and business needs. Speed alone is insufficient: a quick unsupported decision can increase harm. Rehearse again after significant changes in people, systems or dependencies.
Before the exercise, agree acceptance evidence: an alert reaches the lead or deputy, the situation report separates knowns from unknowns, a decision stays within authority, and an approved message identifies the next update time. If the deputy cannot be reached, record the finding, corrective-action owner and due date, then test the revised contact route. Updating a telephone number alone does not prove successful contact. Keep the finding open until effectiveness is demonstrated or an authorized owner approves a documented treatment of the remaining gap.
Also identify who can end crisis arrangements and return responsibility to normal management. Base that decision on stable activities, understood residual risks and handover of outstanding actions to named owners. Afterwards, review decisions, successes and difficulties, then update risk assessments, continuity arrangements and exercises. This connects learning from the crisis back to risk management, rather than ending the work with a message that the situation has stabilized.
Where should your organization start?
Select one priority activity and one credible disruption. Identify the owner, escalation criteria, critical dependencies and first decisions. Use the exercise to determine what needs development before expanding the arrangement. ATMACSS can discuss a defined scope through its risk management service and corporate training and coaching.
Bring your existing risk assessment, continuity arrangements and examples of unresolved responsibility gaps to the discussion. Contact ATMACSS to discuss your requirements. Agree the outputs and review responsibilities before work begins. No consultant or management system can guarantee that every crisis will be prevented.