The First Hour: How Executives Should Make Crisis Decisions

At 9:12 a.m. the bridge line has fourteen people on it. The general counsel is driving and on speaker. Someone from IT is explaining, for the third time, which systems are down, and the explanation gets longer each time. The CEO asks whether customers know. Nobody answers. At 9:40 the call ends with "let's regroup when we know more," and no one has said when that is, or who decides anything in the meantime.

Versions of that call happen in hospitals, utilities and retail headquarters, in real incidents and in exercises. The people on it are capable. What they lack is a shared idea of what the first hour is for. It is not for solving the incident. It is for building the machinery that will: a common picture, a clear owner, people accounted for, a first word to the outside, and a time when everyone comes back with more.

Five things the hour must produce

Treat these as the exit criteria for the first executive meeting. If any one is missing at minute 60, the meeting is not over.

1. Facts, separated from assumptions

Early information is a mix of observation, inference and rumor, usually delivered with the same confidence. Split it out loud. Draw two columns on a whiteboard or in the shared document: what has been confirmed, and by whom; and what is being assumed. "The warehouse management system is unavailable at both sites" is a fact if someone has checked both. "It's ransomware" is an assumption until security says otherwise, and every decision resting on it should be marked that way.

The second column matters more than the first. Assumptions are where the next surprise lives, and writing them down gives someone the job of confirming or killing each one.

2. Life safety, confirmed

Before operations, before reputation, the group needs clear answers to three questions. Is anyone hurt? Is anyone unaccounted for? Is anyone still at risk? Accounting for employees after an evacuation is one of the minimum elements of an OSHA emergency action plan, and it is the first thing families and reporters will ask about. "We believe everyone is out" is not an answer. A name-by-name count, with each gap assigned to a person, is.

Life safety also covers the less obvious cases: the night shift that went home before the alarm, the contractor who never badged in, the employee driving toward a closed site at shift change. Our briefing on duty of care covers the obligations behind this.

3. One decision owner

Not a committee, and not "the leadership team." One named person with authority to make operational calls until the next meeting, plus the limits of that authority: what they decide alone, and what comes back to the group or goes up to the CEO or board. Spending above a set amount, closing a site, public attribution of cause and anything touching a ransom payment are typical come-back-to-us items.

In organizations that use the Incident Command System, this is the incident commander's job, and the executive team's role becomes setting priorities and clearing obstacles. If you run an emergency operations center, be explicit about where the line falls between what the executives decide and what the EOC runs.

4. A first statement, or a deliberate decision to wait

Executives do not need to write the statement. If the communications team has a plan, it already has templates and an approval path (building that plan is a separate job, covered in our guide to crisis communications before the cameras arrive). What executives own is the call itself: which audiences hear something in the next hour, starting with employees, and whether anything is said publicly now.

Waiting can be right, for instance when the fire department or police are the lead public voice on a hazard. Waiting by default, because nobody decided, is not.

5. A time for the next meeting

A clock time, not "when we know more." ICS works in operational periods for a reason: a fixed rhythm forces updates, makes late tasks visible, and stops people interrupting the decision owner every ten minutes for news. In the first hours, 60 to 90 minutes between meetings is typical. Agree too on what would trigger an earlier call: an injury, a regulator on the phone, the story going national.

The minimum viable situation report

The bridge call in the opening went wrong partly because every update was a speech. Replace speeches with a situation report short enough to read aloud in two minutes. A minimum version:

Situation report no. __ | Time __ | Prepared by __

1. What happened: confirmed facts only, two or three lines
2. Working assumptions: each one flagged with who is checking it
3. People: injured, unaccounted for, still at risk
4. Impact now: services, sites and customers affected
5. Likely impact in 12 to 24 hours if nothing changes
6. Actions under way, each with an owner
7. Decisions needed from this group
8. Next sitrep due at: __

Three rules make it work. "Unknown" is an acceptable entry, and better than a guess. Every version carries a number and a time, so nobody argues from an old one. One person owns the document; others feed it, but nobody edits it live during the meeting.

Item 7 is the one that changes the room. When the sitrep ends with a list of decisions needed, the conversation turns from narration to choices.

Keep a decision log from minute one

Memory degrades under stress, and the first hour is the part that gets examined hardest later: by insurers, auditors, regulators, sometimes lawyers, and certainly by your own after-action review. A log written as you go is far more credible than a timeline reconstructed on day three.

Keep it plain. Here is an invented example from a cold-storage distribution center where an ammonia alarm forced an evacuation before dawn:

The basis column carries the whiteboard discipline into the record. The revisit column means no decision quietly becomes permanent. Give one scribe the log as their only job; the person chairing the meeting cannot also write it.

Between freezing and flailing

Executives fail the first hour in two opposite directions.

Paralysis looks like prudence. The group asks for more information before deciding anything, routes every call to legal, or waits for a vendor's root-cause analysis that will not exist for days. One question breaks it: what will we know in 30 minutes that we do not know now, and what does waiting those 30 minutes cost? If the answers are "not much" and "a lot," decide now.

Over-reaction looks like leadership. Every system gets shut down because one might be affected. The CEO gives an interview at minute 25. A vendor is blamed on the first call. Each of these is hard to take back.

The distinction that helps most is reversibility. Make reversible decisions fast and revisit them often: holding trucks, sending staff home, activating a recovery team, moving work to another site. Slow down for irreversible ones: public statements about cause or data, permanent closures, payments to criminals, anything that commits the company in front of a regulator.

A rough rule: over-activate resources, under-commit in public. Standing up a team you turn out not to need costs a few hours of overtime. Retracting a public statement costs credibility you will need for the rest of the incident.

Mistakes that show up in almost every first hour

• The CEO starts troubleshooting. Senior people asking technical questions on the bridge slow down the people fixing the problem. Ask for the sitrep instead.
• The call is too big. Fourteen people on a decision call means twelve listeners. Run a small decision group and a separate, larger information call.
• The loudest theory becomes the working fact. Whoever speaks first with confidence sets the frame. The assumptions column exists to stop this.
• Tasks go to departments. "IT will look into it" assigns nothing. Every action needs a person and a time.
• The people side waits. Off-shift employees, families, and staff who saw the event on social media need a message before customers do.
• Nobody owns the clock. Without a fixed next meeting, updates arrive at random and decisions drift.
• The plan stays in the drawer. Executives who have never opened their crisis plan improvise one from scratch. Ten minutes of familiarity beforehand saves the first half hour.

A one-page first-hour agenda

Print it, put it at the front of the crisis plan, and keep a copy where the executive team can reach it without the network. The times are guides, not a script.

An agenda only holds if people have used it before the real thing. Run it in your next tabletop, with injects timed to land in the middle of the decisions block, and note which outputs the group fails to produce. Our guide to designing a tabletop that exposes real gaps covers how to build those injects. Whatever the group misses in the exercise is usually what it would have missed on the day.