Crisis Scenario Rehearsal

Aim: Prove you can verify, decide, and communicate inside 2 hours without chaos.

Roles in the room (assign before starting)

• Incident Lead (overall): ________
• Verification Lead (truth testing): ________
• Comms Lead (holding line): ________
• Legal/Risk: ________
• Security/IT: ________
• Exec Sponsor (final decision rights): ________

Pre-brief (2 minutes)

Ground rules:

• No speculation.
• No forwarding the artefact.
• One voice externally, one channel for updates.

Timeline and injects (45 minutes total)

0:00–0:05 Set the scene (5 mins) Facilitator: “It’s 09:10. A screenshot and audio note are circulating on WhatsApp and X claiming to be a CEO statement about [topic]. Staff and partners are asking if it’s real.”

Decisions to capture:

• Who is verification lead?
• Who has the stop button?
• Where is the source-of-truth channel?

0:05–0:15 First 30 minutes actions (10 mins) Prompt: “What happens in the first 30 minutes?”

Checklist:

• Freeze autoposting / scheduled comms (yes/no)
• Preserve evidence (links, screenshots, timestamps)
• Set internal instruction to staff (do not amplify)
• Create one inbound route for queries

Artefact to produce live:

• A 4-line internal note to staff (draft it now)

0:15–0:25 The 2-hour window (10 mins) Inject 1: “A journalist emails: ‘Can you confirm the CEO statement?’” Inject 2: “A key partner asks for confirmation before they brief their board.”

Prompt: “What do we publish inside 2 hours, without amplifying the claim?”

Artefact to produce live:

• Holding statement (choose: cautious / firm / customer-first)
• Source-of-truth update line with next update time

Decision rights check:

• Who approves holding line?
• What evidence threshold is required to say ‘not authentic’?

0:25–0:35 Verification and escalation (10 mins) Inject 3: “Security reports signs of coordinated impersonation attempts using brand assets.”

Prompt:

• What gets logged?
• What gets escalated to regulators or platform partners (if applicable)?
• What is the customer/partner safety advice (if any)?

Artefact to produce live:

• Decision Log entry (date, owner, approver, claims, sources, final link)

0:35–0:43 24-hour plan (8 mins) Prompt: “Assume you’ve verified what’s real. What do you do in 24 hours?”

Checklist:

• Verified narrative + remediation steps
• Stakeholder briefings (board, regulators if needed, strategic partners)
• Trust repair plan (actions, owners, timing)

Artefact to produce live:

• 5-bullet 24-hour action list with owners

0:43–0:45 Debrief (2 mins) Ask:

• Where did we lose time?
• What was unclear (authority, disclosure, logging)?
• What one change would improve our 2-hour response most?

Outputs to send after the session:

• Updated roles/decision rights map
• Holding statement pack chosen
• Incident protocol updated
• Rehearsal date booked for next quarter