Use this template
How an organization communicates during a risk or incident often matters more than the incident itself. With Trupeer, you can save hours on risk communication planning by starting with a free situational or risk management communication plan template, customizing it with your brand guidelines, and turning the plan into video walkthroughs that prepare leaders before incidents occur.
What is a free situational or risk management communication plan template?
A free situational or risk management communication plan template is a reusable structure for deciding, in advance, how your organisation communicates about risks: both the ones that might happen and the one that just did.
It is not a risk management plan, which identifies and mitigates risks. It is the communication half, and it exists because the operational response to a materialised risk is usually competent while the communication around it is usually late.
The template is not the plan. It gives you sections, which is the quick part. What determines whether the plan works is whether it answers one question that most published templates never ask: who is allowed to send a message without asking permission first.
Format follows use. A free situational or risk management communication plan template Word doc suits the plan itself, which is prose plus tables and gets approved. A free situational or risk management communication plan template Excel version suits the contact lists and the audience matrix, which need sorting and filtering. Whichever you choose, the parts needed in an actual incident should be printable and available offline, because incidents have a habit of affecting the systems the plan is stored in.
Risk communication has two halves
Most templates cover one of these and stop.
Standing risk communication. Telling people about risks that have not happened. Reporting to a board on the risk register, warning a customer that a supplier is fragile, telling a team that a system is unsupported. Routine, scheduled, and largely about making sure nobody is surprised later.
Situational communication. What you send when a risk materialises. Unscheduled, time critical, and read by people who are already worried.
They are connected in a way that is easy to miss. The quality of the first determines the difficulty of the second. An organisation that has told its customers a supplier is fragile has a very different conversation when the supplier fails than one that has said nothing. Standing communication buys you the benefit of the doubt, and there is no way to acquire it after the event.
Cover both. A plan that only addresses the crisis is a plan that starts working at the worst possible moment.
How to customize this template in Trupeer
Step 1: Open the Templates Section
Go to the Templates section from the main navigation.
Step 2: Select and Open a Template
Click on any template you want to work with to open it.
Step 3: Expand the Template View
If needed, expand the template view to see the full layout and details clearly.
Step 4: Edit the Template
Click on Edit to start modifying the selected template.
Within the editor, you can:
Add new sections
Define or update formatting rules
Add a logo and adjust its position and related settings
Step 5: Save Your Customized Template
After making all necessary changes, click Save to store the updated template as your own.
Step 6: Preview and Fine-Tune the Template
When you want to see how your customized template looks, open the Preview.
From the preview screen, you can continue to make adjustments directly if needed, ensuring the template appears exactly as you want.
With a risk management communication plan template you can:
Save hours on prep: Skip the blank page with a structure built for incident communications.
Respond faster under pressure: Built-in holding statements and escalation paths cut response time.
Stay on-brand: Apply your logo, fonts and colors using Trupeer's brand kit.
Protect the brand: Pre-planned communications protect reputation when seconds count.
Standardize across scenarios: Use the same template for every type of incident.
Reach global teams: Translate risk comms into 65+ languages with one click.
The only number that matters is time to first message
Everything else in a risk communication plan exists to reduce one figure: the elapsed time between the organisation knowing something and the affected people hearing it from you.
That number is what determines whether you are informing people or catching up with them. Once affected people have found out some other way, the entire communication changes character. You are no longer explaining a situation, you are explaining a silence.
Measure it. Every time a risk materialises, however small, record when the organisation first knew and when the first message went out. That single pair of timestamps tells you more about your plan than any post incident review.
Then look at what actually consumed the gap. In most organisations it is not deciding what to say, and it is not drafting. It is waiting for someone to approve it.
Pre-authorise who can speak
This is the section most published templates omit and it is the one that changes the number above.
The default arrangement in most organisations is that external communication requires senior sign off. This is entirely sensible for ordinary communication and it is why crises are communicated late, because the people who can approve are the people who are least reachable at midnight and most likely to be in the meeting that the crisis has caused.
Nobody sends the message. Not out of confusion, but because a junior person sending an unapproved statement to customers is taking a career risk, and waiting is the safe choice for the individual and the expensive choice for the organisation.
Fix it in advance, with a table.
For each severity level, state who may communicate, to whom, saying what, without seeking approval. Give them pre-approved holding statements so the judgement required is which situation applies rather than what to write. And say explicitly that sending an approved holding statement is never a disciplinary matter, which sounds unnecessary and is the sentence that makes people act.
Two principles keep this safe.
Pre-authorisation covers acknowledgement, not explanation. A duty manager may say that something has happened, that you are dealing with it, and when the next update is coming. They may not speculate about cause, accept liability, or commit to a resolution time.
And authority should sit with whoever is present, not with whoever is senior. A rota position such as duty manager is far more useful than a job title, because the rota is by definition contactable.
What a risk management communication plan template must contain
Nine components. The first three are what most templates lack.
Component | What it does |
|---|---|
Severity levels | How situations are classified, in observable terms, and who classifies them. |
Pre-authorisation table | Who may say what, to whom, at each severity, without approval. |
Time targets | Maximum time to first message at each severity, and to each audience. |
Audience matrix | Every audience, what they need to know, through which channel, in what order. |
Holding statements | Written in advance for the risks on your register, ready to send with a name and a fact inserted. |
Contact routes | How each audience is actually reached, with the list location and when it was last tested. |
Escalation and handover | Who takes over as the situation develops, and how a handover happens mid incident. |
Standing risk communication | The routine half. Who is told about which risks, how often. |
Review and rehearsal | When the plan is tested, and what triggers an unscheduled review. |
The contact routes row deserves emphasis. Plans fail on out of date contact lists more often than on anything else in the document. A list nobody has tested in eighteen months is a list of people who have changed jobs.
Free situational or risk management communication plan template: the structure to copy
Filled with a real example rather than placeholders. The organisation is a coach operator running school and corporate contracts.
Copy from here.
Severity levels. Observable, and classified by the duty manager without consultation.
Severity one: service to customers is stopped or will be within four hours. Severity two: service is degraded or a single contract is affected. Severity three: internal disruption with no customer impact expected.
Pre-authorisation table.
Severity | Who may communicate | To whom | Saying what | Approval needed |
|---|---|---|---|---|
One | Duty manager | Affected customers, directly | Approved holding statement one, plus which services are affected and when the next update comes | None. Inform the operations director in parallel, not first. |
One | Operations director | All customers, staff | Fuller update once facts are established | None |
One | Managing director only | Media, elected officials | Anything | Their own judgement |
Two | Duty manager | Affected customer only | Approved holding statement two | None |
Three | Line manager | Affected staff | Anything factual | None |
Sending an approved holding statement is never a disciplinary matter, including if the situation turns out to be less serious than first assessed.
Time targets.
Severity one: affected customers within thirty minutes of the duty manager being informed. All staff within sixty minutes. Severity two: affected customer within sixty minutes. Severity three: end of the working day.
Audience matrix.
Audience | What they need first | Channel | Order |
|---|---|---|---|
Affected customers | Whether their service is running today, and what to do | Direct call to named contact, then written | First, always |
Parents, via schools | Only what the school passes on | Schools communicate to parents, not us | Immediately after schools |
Drivers and staff | Where to report, what to tell anyone who asks | Group message, then briefing | Within sixty minutes |
Insurer | Notification | Phone, then written | Within four hours |
Media | Only if they ask, or if the situation is public | Managing director only | Reactive unless directed otherwise |
Holding statements. Written now, for the six risks currently rated amber or above on the risk register. Each one leaves only a name, a service and a time to be filled in.
Contact routes. Customer contact list held in the operations system and printed weekly to the duty manager's folder. Staff contact list in the group messaging app with a printed backup. Both tested quarterly by sending a test message and counting failures.
Escalation and handover. The duty manager owns communication until the operations director takes over, which happens by explicit statement rather than by assumption. Handover records what has been sent, to whom, and what was promised next.
Standing risk communication. Risk register reviewed with the board quarterly. Any risk rated red is communicated to affected customers within ten working days of being rated, with what we are doing about it.
Review and rehearsal. Reviewed annually. Rehearsed twice a year with an unannounced scenario. Reviewed immediately after any severity one, and after any incident where time to first message exceeded the target.
Copy to here.
Example: eight hours and forty minutes
Thornaby Transport, a coach operator of about three hundred and forty staff running school and corporate contracts, had flooding at its main depot listed on its risk register for two years, rated amber, with a mitigation plan attached.
The depot flooded on a Sunday night in January. Forty vehicles were affected and twenty two school contracts could not run on Monday morning.
The operational response was good. The duty manager knew at eleven o'clock on Sunday night, began recovering vehicles, and had arranged partial cover from a neighbouring operator by four in the morning.
The first message to schools went out at seven forty on Monday.
By then parents were at bus stops. Schools were fielding calls they could not answer. A local news outlet had the story before Thornaby had contacted its own customers, and it ran for three days.
The delay had nothing to do with not knowing what to say. The standing instruction was that any external communication required sign off from the managing director, who was uncontactable until half past six that morning. The duty manager drafted a message at half past midnight and did not send it, because sending an unapproved statement to twenty two customers was not a risk he was willing to take on his own authority at one in the morning.
Eight hours and forty minutes elapsed between knowing and telling. Almost all of it was waiting for permission.
Three contracts were lost at the next tender round, worth about four hundred and ten thousand pounds a year between them. Two of the three cited communication rather than the disruption itself.
What Thornaby had was a risk register with the risk on it and a mitigation plan covering vehicle recovery and alternative depots. What they did not have anywhere was a statement of who was allowed to tell a school that its bus was not coming.
They wrote the pre-authorisation table afterwards. Holding statements were drafted for the six risks rated amber or above, each leaving only a name, a service and a time to fill in. Contact lists moved to quarterly testing after the first test found nine of twenty two school contacts out of date.
Fourteen months later a fuel supply failure threatened Monday services. The duty manager was informed at four forty six in the morning. The first message to affected schools went at five twelve, twenty six minutes later, without anyone being woken for approval.
No contracts were lost and there was no coverage. The disruption was comparable. The communication was not.
Writing holding statements in advance
A holding statement is what you send before you know very much, and its purpose is to establish that you know and are dealing with it.
Write them now, one per risk on your register rated amber or above. It takes an afternoon and it removes the drafting time from the moment when drafting time is expensive.
Four elements and nothing more. What has happened, in plain terms. What it means for the person reading, which is the part most organisations omit in favour of describing their own activity. What you are doing. When the next update comes, as a specific time rather than shortly.
Three things to leave out. Cause, until it is established, because early attributions are wrong often enough to be dangerous. Any acceptance or denial of liability, which is a matter for your insurer and your lawyers. And apology language beyond regret for the disruption, which in some jurisdictions and some sectors carries legal weight that should be considered in advance rather than at speed.
The next update time is the element that does most work. A reader who knows they will hear again at ten o'clock stops calling, stops speculating, and waits. A reader told they will hear shortly does none of those things.
Note that some incidents carry statutory notification duties with their own deadlines, including data protection breaches, workplace injuries and sector specific regulatory reporting. Those obligations run in parallel with customer communication and are not satisfied by it. Take advice on which apply to you, because nothing in a communication plan overrides them.
How to build the plan in six steps
Take the risks from your existing risk register. The communication plan is downstream of it. If there is no register, that is the first job, and a risk management plan template free download will get you started faster than building one.
Define severity in observable terms. Something a duty manager can classify alone at midnight without ringing anyone.
Write the pre-authorisation table. This is the step that will meet resistance and it is the one that changes the outcome.
Set time targets per severity. A target nobody has agreed will not be met.
Write holding statements for your top risks. One afternoon, one per risk.
Test the contact lists, then rehearse. Unannounced, at an inconvenient hour, because that is when it will happen.
Step three is the whole plan. Steps one, two, four and five are preparation for it, and step six is what tells you whether it works.
Risk communication plan or risk management plan?
These get searched interchangeably and they are different documents, so it is worth being clear which you need.
A risk management plan identifies risks, assesses likelihood and impact, assigns owners, and sets out mitigation and contingency. It is the analytical document and it usually contains a risk register. A risk management plan template Word file or a risk management template Excel file will give you that structure: risk description, likelihood, impact, score, owner, mitigation, status.
A risk communication plan covers who is told what, by whom, when. It is downstream of the risk management plan and takes its list of risks from it.
You need both, and in that order. Building the communication plan first means guessing at which risks to prepare for. Building only the management plan is what produced the Thornaby result, where every operational aspect of the risk had been thought through and the communication had not been considered at all.
If what you are actually looking for is the assessment document rather than the communication one, search for a risk management plan rather than a communication plan, since a sample risk management plan PDF will show you a register and a scoring matrix rather than an audience matrix.
Variants
The structure holds and the audiences and obligations change.
Project risk communication. Audiences are internal: sponsor, steering group, delivery team. Severity is about the project rather than the organisation, and the standing half matters more than the situational one, since project risks are usually visible before they materialise.
Operational and service disruption. The Thornaby case. Customers first, speed dominates, and pre-authorisation is essential because disruption does not observe office hours.
Health, safety and environmental incidents. Statutory notification duties apply, sometimes within short deadlines, and internal communication to affected staff has legal dimensions. This variant should be built with a qualified safety adviser and must align with your incident reporting obligations.
Data and cyber incidents. Notification deadlines are frequently regulated and short. The plan should name who determines whether a notifiable breach has occurred, because that determination is a legal judgement rather than a technical one.
Financial and regulatory. Disclosure rules may govern what can be said and when, particularly for listed entities. Take advice before pre-authorising anyone to communicate externally in this context.
Supply chain risk. Standing communication carries most of the weight. Customers told in advance that a single source dependency exists respond very differently when it fails.
Across all of them, nothing on this page is legal advice, and any plan touching regulated notification duties should be reviewed by a qualified adviser in your jurisdiction.
What a free risk communication plan template cannot fix
No risk register. The communication plan needs a list of risks to prepare for. Without one you are writing holding statements for imagined events.
Leadership unwilling to delegate authority. The pre-authorisation table is the plan, and an organisation that will not grant it has chosen a slower response. That is a legitimate choice and should be made consciously rather than by default.
Untested contact lists. Thornaby's first test found nine of twenty two contacts out of date. No free situational or risk management communication plan template free download will discover that for you.
A plan nobody has rehearsed. Documents read once at approval are not recalled at midnight. The rehearsal is what converts a document into a response.
Show the method rather than describing it
The parts of this plan that fail under pressure are the mechanical ones. Where the current contact list lives. How to send to all affected customers at once. Which system holds the approved statements. How to reach the out of hours group.
Written instructions serve this badly, because a person under time pressure has to reconstruct a sequence of screens from prose, and every second spent doing that is added to the number that matters.
Trupeer AI closes that gap. Somebody performs each of those actions once while recording, and the output is a written walkthrough with screenshots already captured and placed, alongside a short video, in your own branding. The duty manager watches it during their induction and has it beside them when it matters.
Record it. Brand it. Translate it. Trupeer it.
Two points follow specifically for this plan. Keep the walkthroughs available offline as well as in your knowledge base, since an incident affecting your systems is one of the scenarios you are preparing for. And where you operate across regions or languages, the same recording produces the same procedure in each, so response time does not depend on which team is on duty.
The material doubles as training for everyone who joins the duty rota, which is the population most likely to face this and least likely to have done it before. Step level detail belongs in the work instructions underneath. Consistency across your documents is a matter of setting the brand kit once, and setup is covered in the document template setup guide.
Frequently Asked Questions
Is there a free situational or risk management communication plan template Word version?
Word suits the plan, because it is prose plus tables, it gets approved, and it is circulated. Build the free situational or risk management communication plan template Word file with the pre-authorisation table and the time targets on the first two pages.
Then produce a one page extract for the duty rota containing only the severity definitions, the pre-authorisation table and the holding statements. Nobody reads a twenty page plan at midnight, and the extract is what actually gets used.
Is there a free situational or risk management communication plan template Word doc version?
Yes, and a free situational or risk management communication plan template Word doc file is the same as a Word file under an older extension.
What matters more than the format is where the copies live. Keep one printed with the duty rota, because an incident affecting your network or your building is precisely the kind of event this plan exists for, and a plan stored only on an inaccessible system is not a plan.
Is there a free situational or risk management communication plan template Excel version?
Excel suits the tables rather than the plan. A free situational or risk management communication plan template Excel file works well for the audience matrix and for contact lists, which need sorting, filtering and regular testing.
Keep severity definitions, pre-authorisation and holding statements in a document. Those are read under pressure, and prose in spreadsheet cells is read badly at the best of times.
Is there a free situational or risk management communication plan template free download?
Most of what a free situational or risk management communication plan template free download offers is an audience matrix, which is the easy half and probably twenty minutes of work.
Check one thing on any template you consider. Does it have a place to record who may communicate without approval? Almost none do, and that omission is the reason most plans do not reduce the time to first message.
Is a risk management plan template Word file the same thing?
No. A risk management plan template Word file gives you the analytical document: risks identified, scored for likelihood and impact, with owners and mitigations. It answers what could go wrong and what we are doing about it.
A communication plan answers who we tell and when. You need both, and the management plan comes first, because its register supplies the list of risks the communication plan prepares for.
Where can I get a risk management plan template free download?
Widely available, and public sector and standards bodies publish better ones than commercial template sites, because theirs were built to be used rather than downloaded.
A risk management plan template free download will typically give you a register with likelihood and impact scoring and a matrix. What it will not give you is any communication content, so treat the two as separate documents rather than expecting one to cover both.
Is there a risk management template Excel version?
Yes, and Excel is genuinely the right tool for a risk register. A risk management template Excel file lets you score, sort by exposure, filter by owner and track movement over time, all of which a document does badly.
The register is the input to this plan. Once you have it, take every risk rated amber or above and write a holding statement for each, which is the bridge between the two documents.
Where can I find a sample risk management plan PDF?
Government departments, universities and public agencies publish these, and a sample risk management plan PDF from one of them is more instructive than a commercial template because it covers real risks with real owners.
Read them for how risks are described rather than for the scoring matrix. Scoring approaches vary and transfer poorly. A well written risk description, specific enough that somebody could recognise the event occurring, is the part worth learning from and is what makes a holding statement possible to write in advance.
