Crisis communications for membership organisations, members first

01/ Crisis communications plan for associations

Decide the roles before the phone rings.

A crisis plan is mostly a list of names and decisions made in calm conditions.

Four roles matter: a lead who decides, a spokesperson who speaks, a writer who drafts, and a gatekeeper who logs every inbound call, email and post.

In a membership body add a fifth: whoever can speak for the board or council, because members will ask whether their elected leaders know.

Keep the plan short enough to read on a phone, and test it once a year with a scenario.

02/ Which crisis is it?

Size the incident before you speak.

Our triage questions. Each “yes” moves the incident up a level and adds a duty or an audience.

03/ The members-first order

Tell the people who own you first.

The order matters as much as the words.

Staff and the board come first, because they will be asked and must not learn it from the news.

Members come next, ideally minutes before any public statement, in a plain email from the chief executive or president.

Then regulators where a duty applies, partners and sponsors, and finally the media and your public channels.

A regulatory deadline can override the order: an ICO report or a Charity Commission report does not wait for the member email.

04/ Holding statements

Say what you know, and when you will say more.

A holding statement buys time without looking evasive.

It confirms what happened in one sentence, says what you are doing, names who is affected if you know, and gives a time for the next update.

It never speculates on cause or blame, and never names an individual who is the subject of an allegation.

Accuracy is the one thing journalists are held to as well: IPSO's Editors' Code requires the press to correct significant inaccuracies promptly and to distinguish comment from fact (IPSO Editors' Code, clause 1). Keep your own statement to facts, so a correction is easy to request.

05/ Data breach communications

Seventy-two hours runs from when you knew.

A notifiable personal data breach must be reported to the ICO “without undue delay, but not later than 72 hours after becoming aware of it” (ICO, personal data breaches: a guide).

Not every breach is notifiable: the test is whether it is likely to result in a risk to people’s rights and freedoms. The ICO publishes a self-assessment to help decide (ICO self-assessment).

If the breach is likely to result in a high risk, the affected members must also be told without undue delay, and you must keep a record of every breach, notifiable or not (ICO guide).

Information can be given to the ICO in phases, so a partial report on time beats a complete one late.

Your member message and your ICO report must say the same thing. Draft them side by side.

07/ Defamation basics

Serious harm is the threshold.

In England and Wales a statement is not defamatory unless its publication has caused, or is likely to cause, serious harm to the claimant's reputation; for a body that trades for profit, that means serious financial loss (Defamation Act 2013, s.1).

The Act's main defences are truth, honest opinion and publication on a matter of public interest (Defamation Act 2013, sections 2 to 4).

Two risks are particular to associations: a statement about a member being disciplined, and a member forum where others post about named people.

Statements about named individuals go to a lawyer before release. This is general information, not legal advice.

08/ The post-crisis review

Within a month, write down what changed.

The review is where a crisis becomes a better plan.

Hold it once the incident is closed, with everyone who had a role, and keep it blame-free so people say what actually happened.

For a charity, the Commission looks for steps taken to limit the impact and, where possible, to prevent a recurrence (Charity Commission). The review is the evidence of those steps.

Report back to members in proportion to how much they were told at the time.