Without fail, nearly every organisation has a crisis at some point. For NGOs and nonprofits, the stakes are different, and often higher. You are not selling a product. You are asking people to trust you with their money, their time, and often their belief that the world can be better. When that trust breaks, it does not just cost revenue. It can cost your mission.
What follows is a practical guide to risk management and crisis communications for civil society organisations: what the research says, what has actually happened to real organisations, and a step-by-step action list for when things go wrong. There is no version of this that is not serious. Do not wait until you need it.
Why NGOs Face Unique Reputational Risk
For-profit businesses can survive a scandal by pointing to their products. A charity or advocacy organisation cannot. Its only real asset is trust — trust from donors, trust from beneficiaries, trust from the public, trust from regulators. And that trust is, by nature, easier to lose than most other things of value.
There is also a moral authority problem. NGOs exist, in part, to hold others to account. When misconduct happens inside the organisation itself — whether that is financial mismanagement, a safeguarding failure, bullying, discrimination, or communications dishonesty — the gap between what is preached and what is practiced becomes its own story. The press instinctively goes after it. So do the public.
Research published in the Corporate Communications journal analysed media coverage of third sector crises across six countries. The finding was stark: news media covered more internal crises in NPOs than external ones. UK-based media gave the most attention to these stories. The conclusion is that when something goes wrong internally — and it becomes public — you will not be covering it alone. Someone else will.
A PR crisis can result in a loss of up to 30% of donations and volunteers, with reputational recovery taking years. According to research compiled by goelastic.com, only 49% of nonprofits have a crisis communications plan in place. That means over half of organisations in the sector are dealing with their worst moments entirely unprepared.
Three Cases That Show What Happens Without a Plan
Oxfam Haiti (2011–2018): The Cover-Up That Became the Story
In 2011, Oxfam discovered that senior staff members working in post-earthquake Haiti had paid for prostitutes and engaged in serious sexual misconduct. The organisation investigated the allegations, fired four people, and accepted the resignations of three others. It issued a brief public statement that did not go into detail about what had actually happened.
That would have been uncomfortable. What happened instead was worse.
Fast forward to February 2018, when The Times of London ran an exposé. Suddenly, Oxfam was not facing a 2011 misconduct case — it was facing accusations of a cover-up, which is an entirely different and much more damaging thing. The Charity Commission launched an investigation. Major donors threatened to cut funding. The UK government made similar noises. And then CEO Mark Goldring, instead of leading with a clear, unconditional apology and a concrete action plan, made remarks that included the observation that it was not “as if Oxfam had murdered babies” — a phrase that circulated widely and became a perfect encapsulation of an organisation that still did not fully understand what it had done wrong.
Deputy CEO Penny Lawrence resigned, stating she was “ashamed.” That was the right instinct, too late. Goldring eventually admitted it was wrong not to tell the public in 2011 why staff had actually left. By then, the story had already run for weeks.
What went wrong? Several things. The initial disclosure in 2011 was deliberately vague to protect the organisation’s reputation. The misconduct was not fully reported to the regulator at the time. And when it became public seven years later, the initial response was defensive rather than accountable. Every crisis communications principle says: the cover-up always becomes the bigger story. Oxfam demonstrated this in front of the entire world.
Sources: PRWeek analysis | PRCG | LSE Politics & Policy
Save the Children (2015–2020): When Process Fails Quietly, Then Loudly
Save the Children’s crisis followed a similar arc, though with a slightly different set of failures. Between 2012 and 2015, three female staff members made complaints of inappropriate behaviour against the organisation’s CEO, Justin Forsyth. The complaints were dealt with internally. Forsyth apologised, and the board accepted this. He resigned in late 2015 — officially, the reason was left vague. He moved on to a senior role at UNICEF. Nothing was disclosed to UNICEF about the complaints. Separately, former chief strategist Brendan Cox faced his own harassment allegations and resigned before a disciplinary panel could hear the case.
When the story broke publicly in February 2018 — partly in the wake of the Oxfam coverage and the broader #MeToo moment in the charity sector — it became clear that a series of problems had compounded. The board’s handling of complaints was inconsistent. The organisation’s culture had allowed these behaviours to persist. Senior leaders had moved on to other powerful roles without the sector knowing why they had actually left. And the women who had raised the original complaints felt they had been sidelined rather than protected.
A subsequent Charity Commission report found “serious failures” in how the charity had dealt with the complaints. The chair, Sir Alan Parker, resigned. Forsyth resigned from UNICEF. The CEO at the time of the public scandal, Kevin Watkins — who had been a trustee during the original events — faced calls to resign as well.
Save the Children’s eventual response was significantly better than Oxfam’s. Watkins issued an unequivocal public apology “to the women affected.” The organisation published the Charity Commission report in full. It commissioned an independent review and committed to publishing its findings. It vowed to strengthen HR processes and organisational culture.
But the gap between “what should have happened” and “what did happen” was still large. The whistleblowers who had raised concerns since 2015 were not involved in shaping the response even in 2018. One of them, Brie O’Keefe, told the BBC: “One of the things that kept many of us from speaking out earlier was a desire to protect the organisation that we loved.” That is a sentence worth sitting with.
Sources: Save the Children Charity Commission response | BBC | New Internationalist
MSF Kunduz (2015): Responding With Clarity Under the Worst Possible Conditions
Not every crisis is an internal failure. On 3 October 2015, a United States Air Force AC-130 gunship struck the Médecins Sans Frontières trauma hospital in Kunduz, Afghanistan. The attack lasted roughly 90 minutes. 42 people were killed, including 14 MSF staff members. Patients burned in their beds.
This was not something MSF did wrong. But it was still a crisis — a sudden, violent, devastating event that required immediate, credible, and sustained communication to staff, donors, beneficiaries, the media, and the international community.
MSF’s response is taught as a case study in crisis communications done correctly under extraordinary pressure. Within hours, MSF had issued a clear factual statement about what had happened and made it explicit that the organisation was demanding an independent international investigation — not the US military’s own inquiry. It published its GPS coordinates and confirmation that all parties to the conflict had been given the hospital’s location in advance. It released an internal review in November 2015, within six weeks of the attack, documenting what it knew about the timeline of events. It maintained consistent, specific, and undefensive messaging throughout.
MSF’s International President, Joanne Liu, stated publicly: “A functioning hospital caring for patients cannot simply lose its protected status and be attacked.” That sentence was not a press release. It was a legal and moral position, stated clearly, on behalf of an organisation that had just lost colleagues and patients, and it defined MSF’s posture for everything that followed.
The US military initially described the strike as having been conducted to defend troops on the ground. It subsequently acknowledged human error, compounded by equipment malfunction. MSF continued to push for international accountability, regardless.
What made the MSF response effective was not that it was polished. It was that it was honest, consistent, and grounded in the organisation’s values. MSF did not hedge. It did not wait to see how the story was playing. It said what it knew when it knew it, acknowledged what it did not yet know, and was very clear about what it was demanding.
Sources: MSF Kunduz hospital attack | MSF factsheet | NPR
What These Cases Have in Common
Look across all three and a pattern emerges.
The organisations that failed in their crisis communications — Oxfam, Save the Children to a significant degree — did so not because bad things happened to them, but because they treated the information as something to manage rather than something to disclose. They prioritised institutional reputation in the short term over institutional trust in the long term. And when it came out — which it always does — the story was no longer about the original problem. It was about the response to the original problem. That is almost always a worse story.
MSF, facing something objectively more devastating, did the opposite. It disclosed what it knew. It named what it did not know. It maintained a consistent public position grounded in its core values. Its reputation, already strong, was reinforced rather than damaged by the way it communicated.
The lesson is uncomfortable but straightforward: transparency is not a communications strategy. It is the only strategy that actually works.
Before the Crisis: What to Build Now
Good crisis communications starts weeks or months before anything goes wrong. If you are reading this because a crisis has already started, skip to the next section and come back here later.
Build a crisis team with defined roles. This is not the whole senior leadership team — that is too many people. It is a small group: an executive lead, a communications person, a legal advisor (in-house or external), and depending on your organisation’s size, a finance and HR representative. Each person needs to know their specific remit in a crisis. The Nonprofit Quarterly recommends this team has documented responsibilities before a crisis hits, not during one.
Do an honest risk assessment. For most NGOs and NPOs, the most common crisis types are: financial mismanagement or fraud allegations, staff safeguarding failures (including sexual misconduct), data breaches, programme-level failures, beneficiary harm, and sudden leadership departures. Sit with your team and ask which of these is most plausible for your organisation. The answer will probably be uncomfortable. That is the point.
Write templates in advance. Not because you will use them verbatim, but because having a holding statement drafted — “We are aware of [situation]. We are taking it seriously and will provide an update within [timeframe]” — means you are not writing from scratch when your hands are shaking. fundsforNGOs has published guidance on this kind of advance preparation, available at us.fundsforngos.org.
Identify your spokesperson. It should not be decided during the crisis. It is usually the Executive Director or CEO, but not always — if the crisis involves the leadership directly, it may need to be the board chair. Whoever it is, they need media training before they need it. The PRSA has published guidance on this at prsancc.org.
Know your regulatory obligations. Many countries require charities and NGOs to report certain incidents to regulators within a defined time window. In the UK, the Charity Commission expects serious incident reports for safeguarding failures, significant financial irregularities, and events that threaten beneficiaries or the organisation’s assets. Not knowing your obligations is not a defence.
The Step-by-Step Crisis Communications Action List
This is the core of it. What to do, in order, when something goes wrong.
BEFORE THE INCIDENT: Infrastructure
Step 1. Maintain a crisis communications plan and review it annually. The plan should name your crisis team, define what constitutes a “crisis” versus a “serious incident” (different responses, different escalation paths), list your stakeholder contacts in one place, and contain holding statement templates for the most plausible scenarios. If your organisation does not have this document, create it this month. Not next month. Resource: Marketing Insider Group’s crisis communications guide for nonprofits.
Step 2. Involve your board before any crisis happens. The board should be briefed annually on the organisation’s key risk areas. They should know the crisis plan exists, who is on the crisis team, and at what threshold they need to be notified. Boards that are surprised by a crisis at the same time as the public are boards that cannot give you what you need in the first 48 hours. Brief them now.
Step 3. Establish your documentation systems. Decide how you will document communications during a crisis before one happens. A dedicated shared folder or drive, with timestamped logs of every internal decision and every external communication, needs to be set up and understood by the crisis team. When regulators come — and in a serious incident, they often do — your documentation record is the difference between “we acted responsibly” and “we cannot show that we acted responsibly.”
HOUR ONE: The Golden Hour
Crisis communications practitioners use the term “golden hour” for the first 60 minutes after a crisis breaks. Social media has made this window shorter in practice, but the concept holds: what you do in the first hour determines whether you are shaping the narrative or responding to someone else’s version of events.
Step 4. Stop all scheduled communications immediately. Pause any scheduled social posts, newsletters, fundraising appeals, or announcements. A cheerful donor email going out two hours after a serious incident is not just tone-deaf — it looks like you did not know, or did not care.
Step 5. Convene the crisis team within 30 minutes. In-person if possible, by video if not. The purpose of this first meeting is not to make decisions — it is to establish what you actually know versus what you think you know. These are different. Write them down in separate columns.
Step 6. Issue a holding statement within the hour. You do not have all the facts yet. That is fine. A holding statement acknowledges the situation exists, commits to taking it seriously, names what you are doing (investigating, supporting those affected, liaising with authorities), and gives a timeframe for your next update. It does not speculate. It does not assign blame. It does not minimise. It just says: we know this is happening and we are on it.
Example: “We are aware of [description of incident]. The safety and wellbeing of [those affected] is our immediate priority. We are gathering information and will provide a full update by [time]. Anyone with concerns can contact [name/email].”
Step 7. Notify your board chair within the first hour. Not by email. By phone. The board chair should not learn about a serious crisis from the media. This is non-negotiable.
FIRST 24 HOURS: Establishing Facts and Contacts
Step 8. Gather facts systematically — and document everything. Assign specific people to find specific things. Who was involved? When did it start? Who already knows about it externally? Have any media enquiries come in? Has anyone posted about it publicly? Every piece of information that comes in should be logged with a timestamp and the name of the person who reported it. This log becomes your working crisis record.
Step 9. Contact your legal advisor. Not because everything becomes a legal matter, but because some things do, and you need to know early which category you are in. Legal counsel will also advise on what can be said publicly and what should not be said while an investigation is ongoing. Do not publish anything substantive before this conversation.
Step 10. Notify relevant regulators if required. Check your obligations. In the Netherlands, large NGOs may need to notify the CBF, the sector’s quality mark organisation. In the UK, the Charity Commission expects serious incident reports. In many countries, data breaches trigger mandatory notification to data protection authorities within 72 hours. Regulatory notification is often both a legal requirement and, when done proactively, a signal that your organisation is operating with integrity.
Step 11. Brief your staff — before the media does it for you. Staff should hear about a crisis from their employer, not from Twitter. Keep the internal briefing honest and proportionate. Tell them what you know. Tell them what you do not know. Tell them who the spokesperson is and ask them not to make public statements independently. If staff are contacted by media, the instruction is simple: refer all enquiries to [name/contact].
Step 12. Reach out personally to directly affected people. Before the public statement goes out. If beneficiaries, staff, or partners have been directly harmed or impacted by whatever has happened, they should hear from someone at your organisation personally — a phone call, not a press release. This is not only the right thing to do. It is also what distinguishes a crisis that deepens from one that begins to stabilise.
DURING THE CRISIS: Transparency in Real Time
Step 13. Communicate regularly, even when there is nothing new to say. Silence is interpreted as guilt, incompetence, or both. If you have committed to updating stakeholders by 5pm and you do not have new information, send a brief message saying that. “We are continuing our investigation. We will update you tomorrow morning.” Keeping to your own stated timelines builds credibility precisely when credibility is under pressure.
Step 14. Acknowledge what went wrong — specifically. This is the step that most organisations get badly wrong. Vague acknowledgements (“we take all concerns seriously”) function as non-apologies and they are read as such. If your organisation made a mistake, name it. “We should have reported this to the regulator in 2011. We did not. That was wrong.” That sentence, from Oxfam’s eventual communications, came far too late — but it was the right sentence. The earlier it is said, the less damage the delay causes.
Step 15. Separate what you know from what you are still investigating. Journalists will ask you questions you cannot answer. The correct response is not to speculate — it is to say, clearly: “We do not know that yet. We are finding out and we will tell you when we do.” This is not evasive. It is accurate. The only thing worse than not having an answer is giving an inaccurate one.
Step 16. Monitor media and social channels continuously. Assign someone on the crisis team whose specific job during the crisis is monitoring what is being said publicly. Not to correct every inaccuracy in real time, but to understand what the public narrative is and whether your communications are actually landing. If a false claim is gaining traction, you need to address it before it becomes established.
Step 17. Keep your backup contacts involved throughout — not just at the start. Your board, your legal advisor, your communications consultant, and any external PR support should be receiving updates at agreed intervals throughout the crisis. Not just at the beginning. This is particularly important if the crisis runs for more than 24 hours. People who are involved at the start and then go dark until the next escalation tend to give worse advice because they have missed the context of the middle period.
AFTER THE CRISIS: Accountability and Recovery
Step 18. Conduct an independent review if the crisis involved systemic failure. An internal review conducted by the people who were involved in the failure is not a meaningful accountability mechanism. It will not be believed — by staff, by donors, or by the public. Commission an external review. Publish its findings. Save the Children’s eventual publication of the Charity Commission’s report, and its commitment to implementing all recommendations, was the beginning of its credible recovery.
Step 19. Communicate what you are changing — specifically. Not “we will strengthen our processes.” That is meaningless. “We have introduced mandatory safeguarding training for all senior staff, reporting directly to the board annually. We have created an anonymous whistleblowing mechanism accessible to all staff. We have engaged [external organisation] to review our HR complaint-handling procedures by [date].” Concrete. Named. Dated.
Step 20. Follow up with affected parties directly. After the public communications, after the press has moved on, after the review is published — go back to the people who were most directly harmed by what happened. Ask what they need. Tell them what has changed. This is not a communications exercise. It is the actual work. But it also matters for the organisation’s long-term credibility that those affected can see that the response was not purely reputational management.
Step 21. Debrief the crisis team and document lessons. Within a month of the crisis being substantially resolved, bring the crisis team together. Document what worked, what did not, what decisions you would make differently. Update your crisis communications plan accordingly. The only thing more damaging than experiencing a crisis is experiencing the same kind of crisis twice, for the same reasons.
Step 22. Brief your board on the full timeline and outcomes. Not a summary. The full picture. Board members who have had a crisis filtered through senior leadership are not in a position to exercise proper governance. They need the complete record of what happened, how it was handled, and what is changing as a result.
The Single Most Important Thing
Crisis communications experts — from PR practitioners to Charity Commission guidance to nonprofit sector researchers — say variations of the same thing. Own it, explain it, promise it. The Nonprofit Quarterly quotes PR expert Molly McPherson’s crisis management framework in exactly those terms.
The organisations that recover well from crises are not the ones where nothing bad happened. They are the ones where, when something bad happened, the leadership did not flinch from saying so clearly, took visible steps to address it, and stayed accountable to the people most affected over the long term.
That is harder than it sounds when you are in the middle of it, when legal counsel is advising caution, when a journalist is calling every 20 minutes, when your biggest donor is worried. But every case study in the sector points to the same conclusion: the organisations that tried to manage the crisis rather than respond to it honestly came out worse. Often much worse.
The test of a crisis communications response is not whether it sounds good in a press release. It is whether the people who were harmed, the staff who watched, and the donors who trusted you would look at what you did and call it honest.
Key Resources
- fundsforNGOs — Crisis Communication Strategy for Nonprofits: us.fundsforngos.org
- Nonprofit Quarterly — How to Navigate a Crisis Like a Pro: nonprofitquarterly.org
- Marketing Insider Group — Crisis Communications 101 for Nonprofits: marketinginsidergroup.com
- PRSA — Crisis Communications Risk Assessment: prsancc.org
- goelastic.com — Crisis Communication for Nonprofits: goelastic.com
- PR News — Planning for the Golden Hour: prnewsonline.com
- Emerald Publishing — Mediated crises in third sector organisations (academic): emerald.com
- MSF Kunduz response (reference case): msf.org
- UK Charity Commission — Serious Incident Reporting: gov.uk/guidance/how-to-report-a-serious-incident-in-your-charity
- National Council of Nonprofits — Ethics and Accountability: councilofnonprofits.org
