03 2297 3613[email protected]

Menara BRDB · Bukit Bandaraya · Kuala Lumpur

Commercial building in Kuala Lumpur
Schedule a consultation
HomeGuidance / Malaysia

Practical crisis management resources

Direct checklists for leadership, risk, operations and communications teams preparing for serious incidents.

On this page

Preparation, response and recovery.

01

How to build a crisis management plan

A usable plan defines authority and action, not only policy.

  • Set activation and escalation criteria.
  • Name the team, alternates and decision authorities.
  • Maintain contacts, meeting routines and a decision log.
  • Link operational actions to stakeholder communication.
  • Exercise the plan and assign each improvement.
02

Crisis team roles and escalation

The team should be small enough to decide and broad enough to act.

  • Appoint one accountable crisis leader.
  • Separate strategic decisions from operational workstreams.
  • Include legal, risk, operations, communications, technology and people functions as required.
  • Define who can activate the team and approve external statements.
03

How to run a tabletop exercise

Test the decisions, interfaces and assumptions that matter during a real incident.

  • Agree objectives before writing the scenario.
  • Use staged information rather than a single discussion prompt.
  • Record decisions, delays and unanswered questions.
  • Debrief immediately and turn findings into owned actions.
04

Crisis management and business continuity

Crisis management directs the response; continuity keeps priority activities operating or restores them.

  • Connect activation criteria between the two plans.
  • Use one view of priorities, dependencies and stakeholders.
  • Coordinate technology recovery, operational workarounds and leadership decisions.
  • Exercise both structures together.
05

Crisis communication plan structure

Communication should follow verified facts, stakeholder priority and clear approval authority.

  • Define the fact-verification and approval process.
  • Map employees, customers, regulators, partners, investors, media and communities.
  • Prepare adaptable holding materials rather than incident-specific promises.
  • Track questions, commitments and corrections.
06

The first hour of a crisis

The first objective is disciplined coordination, not a complete answer.

  • Protect people and stabilise urgent operations.
  • Activate technical, legal and management leads.
  • Separate confirmed facts from assumptions.
  • Set the next decision time and assign actions.
  • Acknowledge urgent stakeholders only with approved information.
07

Holding statements

A holding statement acknowledges an issue while facts and obligations are still being assessed.

  • State only what is confirmed.
  • Explain immediate action without speculation.
  • Identify the next source or timing of an update where possible.
  • Obtain legal, regulatory and operational approval before release.
08

Media training checklist

Prepare the spokesperson for the format, issue and legitimate limits of their knowledge.

  • Define the spokesperson’s authority and subject area.
  • Practise direct answers and explanations of uncertainty.
  • Rehearse difficult follow-up questions.
  • Review pace, language, posture and non-verbal signals.
09

Malaysia data breach notification

Notification decisions depend on the applicable law, facts, organisational role and current official guidance.

  • Engage the data protection officer and qualified legal counsel promptly.
  • Preserve the technical fact record and evidence.
  • Assess affected data, people and systems.
  • Use current guidance from the Personal Data Protection Commissioner; do not rely on a generic deadline.
Official source: Personal Data Protection Commissioner guidance
10

What to communicate after a data breach

Affected people need accurate, useful information without technical or legal speculation.

  • Explain what happened to the extent confirmed.
  • Describe which information may be affected.
  • Set out protective steps people can take.
  • Provide a reliable contact and update route.
  • Keep regulator, customer, employee and public materials consistent.
11

Material events and public-company response

Operational, legal, investor and public communications must be coordinated when an event may be material.

  • Escalate early to responsible officers and advisers.
  • Maintain one verified fact and decision record.
  • Assess disclosure obligations using current rules and qualified advice.
  • Coordinate employee, customer, market and media communications.
Official source: Securities Commission Malaysia resources
12

Supply-chain disruption checklist

Map operational dependencies and communication duties before disruption reaches customers.

  • Identify critical suppliers, routes and single points of failure.
  • Set operational triggers and alternative arrangements.
  • Prioritise customer, employee, regulator and partner updates.
  • Track commercial decisions and public commitments.
13

Coordinated online narratives

Respond to harmful or misleading narratives with evidence, governance and proportionate action.

  • Verify the content, reach and coordination indicators.
  • Distinguish criticism from manipulation or impersonation.
  • Align communications, security, legal and platform actions.
  • Avoid amplifying low-reach material through an oversized response.
14

Post-crisis review questions

A review should improve the operating system, not assign blame after the fact.

  • When was the incident recognised and escalated?
  • Which decisions were delayed, and why?
  • Where did teams use conflicting facts or priorities?
  • Which stakeholder commitments remain open?
  • Who owns each improvement and by when?
Apply the guidance

Review your current arrangements.

Schedule a consultation about a plan, exercise, live response or post-incident review.

Schedule a consultation

Schedule a consultation.

Provide your contact details and a short description. The form will open an email addressed to Crisis Management Centre.

03 2297 3613[email protected]

3.02D (East Wing), Level 3, Menara BRDB285 Jalan Maarof, Bukit Bandaraya59000 Kuala Lumpur, Malaysia

This form prepares an email in your own email application. Your enquiry is not submitted to or stored in a website database. If you send the email, we receive the details you provide. See the privacy notice in the footer.