Incident & Crisis Management
What is Incident & Crisis Management?
Every organisation has processes for dealing with incidents. The question is whether those processes reflect genuine leadership capability, or just documented procedure.
Reactive organisations have crisis plans. Adaptive ones have leadership that performs under pressure without the plan telling them what to do. That capability does not emerge in a crisis. It is built deliberately, long before one arrives. And the gap between those two positions is where most organisations sit when something significant lands.
Incident and crisis management, done well, is not a response function. It is a decision-making capability: the ability to understand what is happening quickly, communicate clearly, make sound decisions under pressure, and keep the organisation stable while doing it. DCR helps organisations build that capability, so that when disruption arrives, they are already ahead of it.
The challenges
The pressure on incident and crisis management has grown alongside the complexity of the environments organisations operate in. Incidents are more interconnected, more visible, and faster moving than they were a decade ago. A cyber event, an operational failure, a third-party disruption or a reputational crisis can escalate in hours. The organisations that manage these situations well are not the ones that react fastest. They are the ones that were designed to lead through them.
Most organisations face a recognisable set of gaps:
The plan and the capability are not the same thing: Many organisations have documented crisis management procedures. Far fewer have tested whether their leadership can actually execute them under real pressure. The gap between the two only becomes visible at the worst possible moment.
Decision-making deteriorates under stress: Incidents demand rapid, clear decisions from people operating under pressure, with incomplete information, and often in unfamiliar configurations. Without deliberate preparation, judgment suffers, communication breaks down, and response becomes reactive rather than controlled.
Communication fails at the critical moment: Internal and external communication during an incident is consistently where organisations lose control of the narrative. Stakeholders, regulators, customers and staff need clear, accurate information quickly. Without a rehearsed communication capability, that rarely happens.
Incidents surface structural weaknesses: A significant incident rarely stays contained to the area where it started. It travels across dependencies, exposes governance gaps, and tests the whole organisation. Incident management that is siloed from the wider resilience picture tends to find this out under pressure.
How to solve it
DCR works with organisations to build incident and crisis management as a genuine leadership capability, not a compliance framework. That means designing the right structures, building the right muscle memory, and creating the conditions for sound decision-making when it matters most.
Crisis planning and preparation: We work with senior leadership and boards to develop incident and crisis management frameworks that reflect how the organisation actually operates: clear decision rights, defined communication structures, and escalation pathways that hold under real pressure. Not documentation for its own sake, but design that works in the room.
Testing, training and exercising: We design and run simulations that reflect the real incidents your organisation could face. Our exercises are built to surface the gap between current capability and what an adaptive enterprise needs, with honest debrief rather than reassurance. Adaptive organisations already know how they will perform under pressure because they have been there before.
Leadership capability development: We work with senior teams and boards to develop the command and control capability that incident management demands. Decision rights, communication under pressure, escalation that holds. The rehearsed capability that is the difference between an organisation that responds to disruption and one that leads through it.
Live incident support: When an incident or crisis lands, DCR can provide immediate senior support: helping coordinate the response, managing stakeholder communication, and bringing external perspective at the moment it is most useful. Experienced support alongside your leadership team, not a team arriving to take over.
Post-incident recovery and learning: After an incident or crisis, we support the recovery process, evaluate the response honestly, identify what the organisation needs to build, and update frameworks accordingly. The goal is not to return to the previous state. It is to come out better designed for the next disruption.
Minimum Viable Company: When a major incident hits, the question most frameworks fail to answer is the one that matters most: what does this organisation need to keep doing, at what level, to remain viable through the next 24, 48, 72 hours? DCR builds Minimum Viable Company (MVC) definitions into the heart of incident and crisis management. We work with leadership to identify the core activities, decisions and dependencies that must hold under severe disruption, and the trigger points and authority to scale down to that level fast. It gives leadership a pre-agreed answer to "what do we protect first" before they're in the room having to work it out under pressure.
The benefits of our services
The DCR team has worked with boards, leadership teams and crisis committees across financial services, retail and other sectors, at every stage of incident and crisis management maturity. We have been in the room when things were going well and when they were not, and we understand the difference between an organisation that is prepared and one that believes it is.
What we bring:
Leadership credibility at the right level: Our team brings senior advisory experience combined with deep practical knowledge of how incidents actually develop. We work at board and executive level, speak the language of the people in the room, and carry the authority to give honest assessments rather than comfortable ones.
Capability built before it is needed: The organisations that perform well under pressure are not the ones that improvise well. They are the ones that prepared deliberately. DCR's approach is built around building real capability in advance: rehearsed, tested, and designed for the conditions your organisation would actually face.
Connected to the wider resilience picture: Incident and crisis management does not sit in isolation. It connects to how the organisation understands risk, manages its third-party dependencies, and maintains operational stability. DCR works across those dimensions, so crisis capability is integrated into the adaptive enterprise rather than sitting alongside it as a separate workstream.
The next time disruption lands, the question is not whether you have a plan. It is whether your organisation is designed to lead through it.
Resources within Resilience, Incident & Crisis Management
Explore services
Business Continuity & Disaster Recovery
Operational Resilience
Cyber Risk Management & Strategy
Get in touch and find out more about how we can help
Our friendly, knowledgeable and approachable staff are available to offer support and advice on your cyber, tech, data, change and operations needs.





