Crisis Communications: Prep Checklist for NYC Boards

A crisis rarely arrives in the form your board imagined. It may begin with a service interruption at a program site, a data incident, a serious allegation involving a staff member, a fire or flood in a leased facility, or a public statement from a former employee that starts circulating before leadership has agreed on the facts. In New York City, where nonprofits often operate across multiple sites and serve communities with little tolerance for institutional delay, the first communications decisions can shape the organization’s credibility long after the immediate event has passed.

That is why a nonprofit crisis communication plan checklist should begin with governance, not with a press release. The board needs to know what it is responsible for, who has authority to speak, how the organization will continue operating if its building or systems are unavailable, and how the response will be tested before anyone is relying on it under pressure.

I think about this work as building a set of reliable habits rather than producing a perfect binder. A crisis plan is useful only if the people named in it can find the right information, make decisions with incomplete facts, and communicate without creating a second emergency. The goal is not to predict every possible incident. It is to make the organization less improvisational when the stakes are high.

Defining the Board’s Role in Crisis Governance

The most important governance decision is also the one that creates the most confusion: drawing a clear line between board oversight and staff operations.

During an emergency, the executive director and senior staff may be coordinating with first responders, securing a facility, supporting clients, contacting funders, managing employees, and responding to journalists at the same time. The board’s instinct may be to help by calling, texting, and asking for updates. Without an agreed protocol, that support can quickly become another demand on the staff’s attention.

The board’s role is to provide oversight, judgment, and institutional support without attempting to manage the response minute by minute. That means the board should be prepared to:

• confirm that the executive director has the authority and support needed to act;
• monitor whether the response remains consistent with the organization’s mission, legal duties, and values;
• ensure that material risks to clients, staff, finances, facilities, and reputation are being addressed;
• make decisions that genuinely belong to the board, including matters involving the executive director, significant financial commitments, or major changes to services;
• maintain appropriate communication with funders, insurers, regulators, and other stakeholders when board-level involvement is useful; and
• protect the organization from internal confusion by using the agreed communication channel rather than creating parallel reporting systems.

The board should not be asking five different staff members for five different versions of the same update. It should identify one point of contact—usually the board chair or a designated board secretary—and establish how often the board will receive updates. The executive director should not have to brief every board member individually while also running the response.

A board phone tree can be useful, but it should be a board process, not an additional staff assignment. The chair or another designated board member should own the list, confirm contact information, and understand how to reach members if email or the organization’s usual systems are unavailable. The phone tree should answer practical questions: Who activates it? What information is shared? Who contacts the board chair if the chair is unavailable? How are messages acknowledged? What happens when a board member cannot respond?

The same discipline applies to risk oversight. A board-level risk register does not need to become an elaborate document that no one reads. It should identify the risks the board must monitor and clarify which risks have been delegated to management. A New York City nonprofit might consider, among other areas:

• a serious incident involving a client, participant, student, patient, or resident;
• a cyberattack or exposure of confidential information;
• a loss of access to a program site or administrative office;
• an interruption to payroll, benefits, case-management systems, or other essential infrastructure;
• a public allegation involving the organization or a member of its leadership;
• a sudden departure, incapacity, or death of a key executive;
• a funding or contract disruption that threatens core services; and
• a crisis affecting a partner organization on which the nonprofit depends.

The board does not need to decide the operational response to each risk in advance. It does need to decide what would trigger board notification, what would require a special meeting, and which decisions cannot wait for the next regularly scheduled meeting.

Agree on authority before the emergency

Many boards assume that their bylaws or committee structure will automatically answer every question during a crisis. Often they do not. The organization should review its governing documents and applicable requirements with counsel, particularly where emergency decision-making, remote meetings, confidentiality, conflicts of interest, or delegated authority are concerned.

The plan should name alternates. If the executive director is unavailable, who can act? If the board chair is involved in the incident or cannot be reached, who assumes the board communication role? If the usual spokesperson is also responsible for operational coordination, who can step in?

These are not theoretical questions. A crisis plan that names only one executive, one board officer, and one phone number is not a resilient plan. It is a single point of failure.

The board’s job during a crisis is not to run the response. It is to provide the governance, authority, and calm that allow the people running the response to do their jobs.

It is also worth agreeing on what board members may and may not do publicly. A board member should not respond to a reporter independently, post a personal interpretation of an unfolding event, or forward an internal update to a community group without checking the protocol. Even a well-intentioned comment can be treated as an official statement when the speaker is identified as a board member.

This is where a nonprofit PR risk assessment becomes more than a communications exercise. It is a governance conversation about exposure, authority, and institutional behavior. The board should be able to say, in plain language, what the organization will protect first: the safety and dignity of people served, the integrity of the facts, the continuity of essential services, and the trust that makes the mission possible.

Mastering the Golden Hour: Immediate Response Protocols

The first hour is not the time to write elegant prose. It is the time to establish control over the facts, the decision-makers, and the channels through which information will move.

The term “Golden Hour” can be misleading if it suggests that every crisis follows a neat sixty-minute schedule. Some incidents unfold slowly. Others become public immediately. The useful idea is not a stopwatch; it is the need for early activation. The organization should have a practical board crisis response protocol for the first period after an incident is reported, even when the facts are incomplete.

The initial response should accomplish three things:

1. Activate the right people. Reach the executive director, the designated crisis lead, the board contact, legal counsel or insurance representatives when appropriate, and any operational leaders responsible for safety, facilities, technology, or client care.

2. Separate confirmed information from assumptions. Record what is known, how it is known, what remains unverified, and who is responsible for confirming it.

3. Decide what must be communicated now. Determine whether staff, clients, families, funders, regulators, partners, neighbors, or the public need an immediate holding statement.

The facts log is one of the simplest and most effective tools in a crisis. It should include the time of each update, the source, the level of confidence, and any action that follows. This prevents the organization from treating an early rumor as an established fact and helps the communications team understand how the situation has changed.

A holding statement should be short enough to approve quickly and flexible enough to remain accurate as more information becomes available. It usually needs to do five things:

• acknowledge that the organization is aware of the incident;
• state what the organization is doing to protect people and assess the situation;
• express concern for those affected without speculating about cause or responsibility;
• explain when and where the next update will be provided; and
• identify a point of contact for urgent questions.

The statement should not include details that could compromise an investigation, reveal private information, or create legal exposure. It should also avoid language that sounds evasive. “We are aware of reports and are gathering information” is more credible than pretending the organization knows nothing when staff and community members can see that something has happened.

The first communication is not the final explanation

A holding statement buys time, but it does not end the organization’s responsibility to communicate. The plan should establish a rhythm for updates, even if the update is that there is no new information to share. Silence can be appropriate when details are unconfirmed or privacy is at stake; unexplained silence often creates a vacuum.

The crisis team should decide in advance:

• who drafts the first statement;
• who has authority to approve it;
• when legal review is required;
• who posts to the website and social channels;
• how staff receive the message before or at the same time as the public;
• how questions from clients and families are handled; and
• how corrections are made if an earlier statement was incomplete or wrong.

The order of communication matters. Staff should not learn about a serious incident from a news alert or a social media post if the organization can reasonably brief them first. Clients and families may need a different message from funders or reporters. A community-facing nonprofit should also consider language access, disability access, and the practical ways people actually receive information. A website update alone may not reach the people most affected.

Speed still matters, but speed without verification is not responsiveness. A quick inaccurate statement can force the organization into a defensive posture for the rest of the crisis. The better standard is: move quickly on what is known, be direct about what is not known, and make clear when more information will follow.

Structuring the Crisis Communication Framework

A strong crisis plan has a visible structure. It does not have to be long, but it must connect communications to operations, governance, and continuity.

I find it helpful to organize the framework around four connected functions:

This structure keeps the communications plan from becoming a collection of sample statements detached from the organization’s actual capacity. A nonprofit cannot promise 24-hour media response if no one is assigned to monitor incoming requests. It should not direct clients to a phone line that depends on a building without power. It should not say that services continue uninterrupted when the organization has not identified an alternate site, staffing plan, or technology workaround.

Choose spokespeople deliberately

The spokesperson decision is often treated as a matter of hierarchy. It should be treated as a matter of credibility and capability.

The board chair may be the right voice when the issue concerns board accountability, executive leadership, or institutional values. The executive director may be the right voice for operational decisions and service continuity. A program leader may be the most credible person to explain how clients are being supported, particularly when the crisis affects a community that does not see senior leadership as its natural representative.

There is no universal answer, and the plan can designate different spokespeople for different situations. What matters is that the decision is made before the incident and that each person understands the limits of the role.

A spokesperson should be able to:

• explain the organization’s immediate priorities in plain language;
• acknowledge harm or uncertainty without making unsupported conclusions;
• protect confidential information;
• answer difficult questions without becoming defensive;
• stay consistent with written statements and internal updates; and
• redirect questions appropriately when another person or agency has authority.

A short media briefing is more useful than a script that sounds memorized. Practice should include hostile or repetitive questions, because real interviews rarely follow the order in which the organization prepared its talking points. The spokesperson needs a few durable messages, not a paragraph for every possible question.

Build channels around actual behavior

A crisis communications plan should list channels, but it should also explain what each channel is for. The website may be the organization’s formal public record. Email may be appropriate for staff and enrolled participants. Text messaging may be necessary when people need immediate instructions. Social media may help correct a fast-moving rumor, but it is a poor place to manage sensitive personal details.

The plan should include the credentials, backup access, and recovery procedures for each essential channel. This is especially important for small and midsize nonprofits where one staff member may be the only person who knows how to update the website, access the email platform, or administer social accounts.

The organization should also identify what it will not use. Personal accounts, unapproved group chats, and informal messaging threads can spread information quickly but make it difficult to preserve a reliable record. During a crisis, a record of decisions and communications is not bureaucratic overhead. It helps the organization understand what happened and defend the integrity of its response later.

Operational Continuity and Physical Plant Preparedness

Communications fail when operations fail. If the office is inaccessible, the phone system is down, the server is compromised, or staff cannot safely travel to a program site, no communications strategy can be separated from the practical question of how the organization will function.

Physical plant documentation is therefore part of crisis communications. A nonprofit should know where its utility shutoffs are located, who manages the building, which vendors must be called, what equipment requires special handling, and where staff can work if the primary site is closed. That information should be available both on-site and through a secure off-site location. A binder inside a locked office is not an off-site backup.

For many organizations, the documentation should include:

• a current floor plan with entrances, exits, utility shutoffs, fire equipment, and restricted areas;
• building management, landlord, security, insurance, and emergency vendor contacts;
• information about elevators, generators, backup batteries, refrigeration, medical equipment, or other site-specific systems;
• procedures for securing confidential paper files and equipment;
• alternate work or service locations, including access instructions;
• a list of systems that must be restored first; and
• arrangements for staff, clients, and visitors who need accessible routes or accommodations.

The goal is not to create separate plans for every possible disaster. It is to plan for the operational conditions that matter: the building is unavailable, power is interrupted, technology cannot be trusted, staff cannot reach the site, or the organization must reduce services temporarily.

Make continuity decisions before they become public

A crisis often forces the organization to decide which services are essential, which can be delayed, and which require a partner or alternate location. Those decisions should not be made for the first time while a reporter is asking whether the nonprofit remains open.

The board can help by approving priorities in advance. For example, an organization might identify certain client safety functions, emergency referrals, payroll, regulatory reporting, and communication with funders as essential. Other activities may be paused or delivered differently. The exact priorities will vary, but the order should be understood by leadership and communicated to staff.

The plan should also cover board operations. If the organization’s office is closed, where will the board meet? What platform will it use? Who can schedule the meeting and distribute secure materials? How will a quorum be confirmed? Are there circumstances in which the board chair or executive committee can act between meetings, subject to later reporting or approval?

Testing these arrangements is not optional preparation. A board that has never used its backup meeting platform may discover during a crisis that members cannot log in, materials are inaccessible, or the chosen system does not work well for confidential discussion. The technical problem is manageable in advance and exhausting in the middle of an emergency.

The communications plan is only as strong as the organization’s ability to deliver what it says. If the building, systems, or staffing model cannot support the message, the message is not ready.

Cyber incidents deserve particular attention because they combine operational disruption, privacy concerns, and rapid reputational risk. The communications plan should identify who determines whether an incident is reportable, who coordinates with technology and legal professionals, how affected individuals are contacted, and how the organization avoids publishing details that could increase harm. Board members should understand that “we have not confirmed a breach” and “there is no breach” are not interchangeable statements.

Testing and Refining Your Response Strategy

A plan that has never been tested is a document with good intentions.

The most useful exercises are often modest. A tabletop exercise can bring together the executive director, board chair, communications lead, program or facilities staff, technology support, and counsel for an hour of structured discussion. The group receives a scenario in stages and must decide what it would do, what it would say, and what information it needs next.

The scenario should be plausible for the organization, not dramatic for its own sake. Useful exercises might involve:

• an incident at a program site that attracts media attention;
• a cyber event affecting client or donor information;
• a sudden leadership departure announced publicly before staff have been briefed;
• a building closure that interrupts services and displaces employees;
• a serious allegation involving a person connected to the organization; or
• a disruption affecting a public agency or community partner on which services depend.

Each scenario tests something different. A site incident may reveal confusion about client privacy and family communication. A cyber event may expose gaps in account access and legal escalation. A leadership crisis may show that the board has not agreed on who can speak for the organization. A building closure may demonstrate that the continuity plan assumes staff can simply work from home, even though the services themselves cannot be delivered remotely.

The exercise should not be judged by whether everyone gives the “right” answer immediately. Its value lies in exposing unanswered questions while the consequences are still hypothetical.

Turn the debrief into governance work

After an exercise or real event, the organization should produce a short written after-action report. It should record:

• when the response was activated;
• whether the right people were reached;
• what information was confirmed at each stage;
• whether the approved communication channels worked;
• whether staff and affected communities received information in the right order;
• where the spokesperson or approval process slowed down;
• which operational assumptions proved unrealistic; and
• what changes have an owner and a deadline.

The last two items are the most important. A debrief that says “improve internal communication” is not a revision plan. A useful finding says that staff learned about the incident through social media because the emergency contact list was outdated, and assigns a person to update the list and test it by a specific board meeting.

Exercises should also include the people who are most likely to notice a failure first. Front-line staff may know that clients do not regularly check email. Facilities staff may know that the emergency key is stored in a location no one can access after hours. Program managers may know that a proposed alternate site cannot accommodate the people the organization serves. Their knowledge belongs in the plan.

The board’s role after the exercise is to ask whether the organization is actually resourcing the changes. Training, backup technology, translation, legal support, insurance coordination, and alternate facilities all cost money. Preparedness cannot remain a statement of values if the budget quietly assumes that staff will absorb the work without time or support.

From a Plan on Paper to a Board Habit

For a board chair or executive director beginning this work, the first step is not to commission a massive manual. It is to find out what already exists and where the organization is relying on memory.

Start by gathering the current crisis plan, emergency contacts, insurance information, vendor lists, technology recovery procedures, building documents, and any relevant board policies. Mark what is current, what is missing, and what only one person knows. Then bring the board into the conversation early. The plan will fail if it is treated as an administrative document owned solely by the communications or operations team.

A practical sequence for the next several board meetings might look like this:

1. Clarify the board’s role and escalation thresholds. Agree on what requires board notification, a special meeting, or a formal board decision.

2. Name the crisis team and alternates. Include operational, communications, facilities, technology, and governance responsibilities.

3. Choose primary and backup spokespeople. Match the person to the type of crisis and practice the role.

4. Review the first-hour protocol. Confirm who activates the response, where facts are recorded, and how a holding statement is approved.

5. Map essential operations. Identify the services, systems, facilities, and relationships that must be protected first.

6. Test one realistic scenario. Use the exercise to identify gaps rather than to prove that the plan is complete.

7. Assign revisions and fund them. Every significant gap should have an owner, a deadline, and a realistic resource plan.

This work is not about making the organization look invulnerable. Nonprofits do not control every event, and they cannot promise that a crisis will leave no harm behind. What they can control is whether leadership is honest, whether decisions are made by the people authorized to make them, whether affected communities are treated with dignity, and whether the organization learns from what went wrong.

The strongest NYC charity crisis management practices are often unremarkable from the outside. A current contact list. A board that does not compete with staff for control. A spokesperson who knows what can be said and what cannot. A backup place to work. A tested way to reach clients when the usual channel fails. A board meeting where the after-action report leads to a funded change rather than another expression of concern.

That is the real preparation. Not a polished binder, but a set of decisions the organization has already made—and people who know how to carry them out when the city, the mission, and the public are all asking for an answer at once.