Crisis and Risk Communications: A Message-Mapping Approach for Corporate and Campus Teams
Crisis communication is easier to manage when the organization has already decided what it needs to say, who needs to hear it, who is authorized to speak, and how updates will be delivered.
That preparation should happen before an incident. During a crisis, teams may be working with incomplete information, competing priorities, unavailable leaders, overloaded systems, and intense pressure from employees, students, families, customers, media, and the wider community.
A practical crisis and risk communications program gives people a usable structure. One of the most effective tools for building that structure is a message map: a concise planning document that organizes key messages, supporting information, audience needs, actions, and update responsibilities for a specific scenario.
This approach is useful for corporate organizations, universities, colleges, and other institutions that need to communicate clearly while protecting people, sustaining operations, and maintaining confidence.
What message mapping accomplishes
A message map is not a press release written in advance. It is a decision-support tool.
For each credible scenario, the map helps a communications team answer:
What is happening?
What do we know, and what remains unknown?
Who is affected?
What should each audience do?
Which information must be released immediately?
Who approves the message?
Which channel is used first?
When will the next update occur?
What happens if the primary spokesperson, platform, or approval path is unavailable?
The CDC/ATSDR message-mapping template recommends organizing three key messages with three supporting points for each. This structure helps teams stay concise and avoid overwhelming an audience with every available detail.
A strong map should also identify the scenario, stakeholders, communication objective, delivery method, accessibility needs, and specific action expected from the audience.
Build a map for each credible scenario
Begin with the risks that could disrupt life safety, operations, continuity, or public confidence. The appropriate scenarios will differ by organization, but may include:
Severe weather or environmental hazards
Workplace or campus violence
Cybersecurity incidents and technology outages
Utility failures or facility disruptions
Public health concerns
Transportation incidents
Supply chain interruptions
Active investigations or incidents involving emergency responders
Events that affect access, instruction, staffing, or essential services
For each scenario, create a one-page map with the following components.
1. Situation summary
Describe the event in plain language. Include the location, time, affected function or population, and the threshold for activating the communications plan.
2. Key message one: What people need to know now
This should address the most urgent verified fact. If protective action is required, put that instruction first.
3. Key message two: What the organization is doing
Explain the response underway without speculating about causes, assigning blame, or making promises the organization cannot support. Identify activated procedures, operational actions, and coordination with appropriate authorities when confirmed.
4. Key message three: What people should do next
Give the audience a specific action, resource, or source of information. State when the next update will be issued, even if there is no significant change.
5. Known, unknown, and being verified
Separating these categories helps the organization communicate uncertainty honestly. It also reduces the risk that a preliminary report, rumor, or assumption will be mistaken for a confirmed fact.
6. Ownership and approval
Record the communications lead, operational subject-matter expert, decision-maker, legal or privacy reviewer when appropriate, and backup personnel. Include the source and time of the latest verified information.
Keep the language plain, direct, empathetic, and accessible. Avoid acronyms, technical language, long paragraphs, and unnecessary qualifiers.
Tier stakeholders by urgency and information need
A single message rarely serves every audience. Corporate and campus teams should maintain a stakeholder register that identifies each group’s information needs, urgency, responsibilities, preferred channels, backup channels, and accessibility or language requirements.
A practical structure may include three tiers.
Tier 1: People needing immediate protective information
This group may include employees, students, faculty, visitors, customers, contractors, residents, or others directly exposed to a hazard. It may also include incident commanders, supervisors, security personnel, and emergency responders.
These audiences should receive the fastest available life-safety instruction through the organization’s emergency alert or mass notification system.
Tier 2: People supporting operations and affected individuals
This tier may include managers, department leaders, human resources, facilities, information technology, academic affairs, families, suppliers, service providers, and critical partners.
Their messages should explain operational responsibilities, reporting procedures, support resources, continuity decisions, and how to direct questions.
Tier 3: Wider community and external stakeholders
This group may include media, regulators, local officials, neighboring communities, investors, alumni, customers, and the general public.
Messages should provide verified facts, describe the organization’s response, explain any public-facing impact, and direct people to a reliable source of ongoing information.
Tiering does not mean withholding important information. It means tailoring information so the most urgent audience receives the clearest action first.
Establish a notification cadence before the incident
Teams often make one of two mistakes: communicating too slowly while waiting for certainty, or sending frequent messages without meaningful information.
A notification cadence provides a middle path.
Set expectations for:
Initial alert: Confirm awareness, identify the affected area or audience, state the immediate action, and provide the official information source.
Stabilization update: Share verified developments, operational changes, and remaining unknowns.
Sustained response: Continue updates at a defined interval appropriate to the hazard and audience need.
Recovery update: Explain when the immediate threat has ended, what restrictions remain, where support is available, and what happens next.
The interval should be determined by risk, operational tempo, audience expectations, and channel capacity. If there is no significant change, say so. Silence can create an information gap that rumors quickly fill.
The Ready.gov crisis communications guidance emphasizes preparing messages in advance, maintaining current contact information, identifying audiences, and providing consistent communication throughout response and recovery.
Design for channel redundancy
No single channel should carry the entire communications burden.
Pair fast-alert channels with more detailed sources of information, such as:
SMS or emergency mass notification
Email
Voice calls or hotlines
Corporate intranet or campus portal
Public status webpage
Social media
Digital signage
Media briefings and press releases
Supervisors, department leaders, resident advisors, or other trusted intermediaries
In-person communication when appropriate
The purpose of redundancy is not to repeat noise. It is to improve reach when one channel is unavailable, delayed, inaccessible, or not monitored by the intended audience.
Each channel should point back to a designated source of truth. Messages do not need to be identical in length, but they should be consistent in facts, protective actions, and update timing.
Plan for failure as well. Identify backup alert administrators, alternate approval routes, offline contact lists, alternate connectivity, and procedures for a website or vendor outage. Test permissions and access before they are needed.
All channels should account for access and functional needs. Consider captions, screen-reader compatibility, readable contrast, translation, plain-language alternatives, hearing and vision access, and communication methods for people who may not be able to use a mobile device or digital platform.
Prepare holding statements and spokespersons
A holding statement is an approved bridge between the initial report and a more complete update. It should confirm awareness and response without guessing.
A useful structure is:
We are aware of [incident] affecting [location or audience] as of [time]. Our priority is [life safety or essential service]. We have activated [response action]. We can confirm [verified facts]. We are still determining [material unknowns]. Please [specific action] and use [official source] for updates. Our next update will be provided [time or interval].
Store templates in a remotely accessible location. Use fill-in fields for the incident, location, time, action, source, and next update. Do not pre-populate casualty figures, causes, legal conclusions, or other facts that cannot be known in advance.
Designate a primary spokesperson and a backup. Define who can issue emergency alerts, who can approve employee or student messages, who handles media inquiries, and who communicates with families or customers.
Prepare each spokesperson with:
Three headline messages
Scenario-specific questions and answers
Confirmed facts and known unknowns
Prohibited speculation
Escalation contacts
Privacy and confidentiality reminders
Accessibility and pronunciation guidance
A timestamped fact sheet
Spokespersons should be prepared to answer difficult questions without becoming defensive. A useful pattern is to acknowledge the question, state what is confirmed, explain what is being verified, provide the relevant action, and return to the official source.
Rehearse communications inside exercises
A communications plan is not validated because it exists in a document. Teams need to practice using it.
Start with a walkthrough or orientation to confirm roles, access permissions, contact information, templates, and approval paths. Then use a tabletop exercise to discuss decisions and communication responsibilities.
Add realistic injects, such as:
A key spokesperson is unavailable
A rumor spreads on social media
A website becomes inaccessible
Two departments provide conflicting information
A family member or customer requests details
A vendor or alerting platform is unavailable
An accessibility or translation requirement emerges
New information changes the protective action
As the program matures, conduct a functional exercise that tests actual drafting, approvals, alert activation, web updates, media coordination, and backup channels.
The Ready.gov exercise guidance describes walkthroughs, tabletops, functional exercises, and full-scale exercises as progressively more demanding ways to evaluate plans, clarify roles, and identify improvements.
Measure performance with practical indicators:
Time to approve and send the initial alert
Percentage of priority contacts reached
Time to publish a detailed update
Consistency across channels
Accessibility and translation performance
Accuracy and confidence of the spokesperson
Time required to correct misinformation
Time to activate a backup channel
Whether scheduled updates occurred
Whether corrective actions received owners and deadlines
Turn findings into an improved toolkit
After each exercise or real incident, update the message maps, contact lists, templates, approval procedures, channel permissions, and spokesperson materials.
A useful corrective action should identify:
What happened
Why it mattered
What needs to change
Who owns the change
When it will be completed
How the organization will verify improvement
Crisis and risk communications become more reliable when they are treated as an operational capability rather than a last-minute writing task. Message mapping gives corporate and campus teams a practical way to prepare for uncertainty, communicate with different stakeholders, and maintain a consistent rhythm across multiple channels.
Explore Alpha Research Group’s crisis and risk communications training to strengthen your organization’s preparedness, continuity, and emergency communications capabilities. Our customized emergency management training solutions support corporate and academic audiences with practical, flexible learning focused on real-world response needs.
Further reading
Comments