Not every problem is a crisis, and treating every problem as one is itself a risk. An issue is an emerging matter of stakeholder concern: a gap between what an organisation does and what its stakeholders expect, which could affect the organisation if it is left unmanaged. A crisis is a sudden and unexpected event that threatens to disrupt an organisation's operations and poses both a financial and a reputational threat (Coombs, 2007). The difference is partly one of time. Issues develop over months or years and leave room to act; crises compress decisions into hours. Many crises are issues that were noticed and not managed.

Issues management is the discipline of scanning for these gaps early and closing them before they erupt. In the practitioner literature (e.g. Regester and Larkin, 2008) it is presented as a cycle: identify the issue, analyse its likely trajectory and impact, decide the organisation's position, act, and evaluate the result. Acting matters most, because an issue is often resolved by changing what the organisation does, not what it says; evaluation then shows whether it worked. Module 5 mapped Fellwise's stakeholders by salience and power–interest; the same map tells an issues manager whose expectations are moving, and how much it matters. Regulation is a common source of issues: Regulation (EU) 2024/3015, for example, will bar products made with forced labour from the EU market from 14 December 2027, turning supply-chain labour standards into a compliance issue for any brand selling there.

Lifecycle models give the work a shape. Fink (1986) described a prodromal stage of warning signs, an acute stage set off by a triggering event, a chronic stage of lasting effects and investigation, and resolution. Coombs (2007) uses a simpler frame of pre-crisis, crisis and post-crisis. Both are heuristics rather than laws: real crises loop back, and online they can skip the warning stage entirely. Their value is to remind managers that much of the useful work happens outside the acute phase, in prevention and preparation beforehand and in learning afterwards.

The practical tool for the pre-crisis stage is the issues register: a living list of emerging issues, each with its source, the stakeholders affected, the likelihood and impact of escalation, the organisation's current position, an owner and a review date. Its weakness is that it records only what someone has thought to write down, so it needs input from beyond the communications team: customer service, procurement, the workshop floor and social listening.

Once an issue becomes a crisis, the first strategic question is how much responsibility stakeholders will attribute to the organisation, because that attribution drives reputational damage. Situational Crisis Communication Theory (SCCT) builds on attribution theory to link the two (Coombs, 2007). Its first tests found the predicted relationship: the more responsibility people attributed to the organisation, the lower they rated its reputation (Coombs and Holladay, 2002).

SCCT groups crisis types into three clusters. In the victim cluster the organisation is itself a victim and attributions are weak: natural disasters, rumours, workplace violence and product tampering. In the accidental cluster attributions are minimal because the harm was unintended: challenges, in which stakeholders claim the organisation is acting inappropriately, and technical-error accidents or product harm. In the preventable cluster, sometimes called intentional, attributions are strong because the organisation knowingly placed people at risk, acted inappropriately or broke the rules: human-error accidents and product harm, and organisational misdeeds (Coombs, 2007). Two intensifiers then adjust the assessment. A history of similar crises, or an unfavourable prior reputation, raises attributions, so an accidental crisis may be judged as harshly as a preventable one.

Response strategies are grouped by how far they accept responsibility. Deny strategies (attacking the accuser, denial, scapegoating) try to break the link between the organisation and the crisis. Diminish strategies (excuse, justification) try to reduce perceived responsibility or harm. Rebuild strategies (compensation, apology) accept responsibility and offer something to those affected. Bolstering (reminding, ingratiation, victimage) is secondary and only supplements the others. The guidance is to match the response to attributed responsibility. First give instructing information, telling people how to protect themselves, and adjusting information, expressing concern and explaining corrective action. For a victim crisis with no intensifiers this may be enough. Add diminish strategies for a victim crisis with an intensifier and for an accidental crisis without one, and move to rebuild for an accidental crisis with an intensifier and for every preventable crisis. Reserve deny for rumours and unwarranted challenges. Never mix deny with diminish or rebuild, because the contradiction erodes the whole response (Coombs, 2007).

SCCT is unusually well tested for a communication theory, but much of the evidence comes from experiments in which participants read hypothetical cases. It also models reputation, not legal liability, which is why lawyers and communicators can pull in opposite directions over an apology.

Social media has changed the tempo of crises more than their nature. An allegation can reach a national audience before a communications team has confirmed a single fact, and stakeholders expect a visible response within hours rather than at the next news cycle. Jin, Liu and Austin (2014) developed the social-mediated crisis communication (SMCC) model to explain how publics create, consume and share crisis information across social media, traditional media and word of mouth, and tested how the origin of a crisis and the form and source of information influence people's responses. The practical implication is that the organisation is one voice among many, not the gatekeeper of the story.

Two further concepts help. A paracrisis is a publicly visible threat, often an online campaign, that warns of a possible crisis and has to be managed in full view (Coombs and Holladay, 2012). Stealing thunder means disclosing bad news before others do: Arpan and Roskos-Ewoldsen (2005) found that organisations that broke news of their own crisis were judged more credible than those whose crisis was revealed by someone else.

The key first-hour tool is the holding statement: a short response, drafted as a template before any crisis, that can be approved and published quickly. A good one acknowledges what is being said, separates what is known from what is not yet known, says what the organisation is doing and when it will next update, shows concern for anyone affected, and claims nothing that has not been verified. It buys time without saying "no comment", which tends to read as evasion. Its tone should be the brand's voice under pressure, not legal boilerplate. Apply the pressure test and swap test from Module 3: if a rival could publish your holding statement unchanged, it is not yet in your voice.

Misinformation and AI-generated fakes add a verification step. A convincing fake screenshot, audio clip or video of an executive can start a crisis about something that never happened; in SCCT terms it is a rumour, where denial is appropriate once the organisation is sure. Sensible practice is to verify before responding, keep originals of official statements and media for comparison, point people to a single official channel, report impersonating content to the platforms, and avoid amplifying a fake by repeating its claims in detail. Deny too early and the organisation may deny something true; wait too long and the fake sets the story.

When the acute phase passes, attention turns to repairing reputation and learning. Benoit's image repair theory, set out in Benoit (1995) and applied to corporate crises in Benoit (1997), starts from the premise that reputation is threatened when an act is seen as offensive and the organisation is held responsible for it. It identifies five broad strategies. Denial covers simple denial and shifting the blame. Evasion of responsibility includes provocation, defeasibility (lack of information or control), claiming an accident and pleading good intentions. Reducing offensiveness includes bolstering, minimisation, differentiation, transcendence, attacking the accuser and compensation. Corrective action promises to fix the problem and prevent it happening again. Mortification admits responsibility and apologises.

The typology overlaps with SCCT but comes from a different tradition. Benoit's approach is rhetorical: a vocabulary for analysing what organisations actually said, usually case by case. SCCT is predictive and tested experimentally. A common pairing uses SCCT to choose the overall posture and Benoit's strategies to analyse and refine the messages. Benoit (1997) argues that an organisation at fault should admit it promptly, and that corrective action is especially persuasive because it shows the problem will not recur. Apology still worries lawyers. In England and Wales, section 2 of the Compensation Act 2006 provides that an apology does not of itself amount to an admission of negligence or breach of statutory duty, but it is no general shield. It does not stop factual admissions within an apology being used as evidence, and Scotland's Apologies (Scotland) Act 2016 goes further. No repair strategy can rescue an organisation whose conduct has not changed.

Recovery is not a single statement. A recovery plan sets out, group by group, what each stakeholder needs to see and hear to restore trust, who owns each relationship, what evidence will be published and when, and how progress will be tracked. The map from Lesson 5.2 is its natural backbone: groups with high power and interest need direct engagement, not press statements.

The post-crisis stage then turns to learning. A blame-free learning review asks what happened, why, what worked, what did not and what must change in plans, training and operations. Its output should update the issues register from Lesson 6.1, the templates from Lesson 6.3 and the crisis plan itself; a review that is filed rather than acted on lets the same weaknesses resurface.