A disruption that becomes public needs a different response from the operational recovery plan. The people and reputation side is what business continuity does not touch.

This sits directly downstream of business continuity management and the broader enterprise risk management framework. That framework identifies which scenarios warrant this level of preparation, so not every company needs a plan for every conceivable event.

Where continuity ends and crisis management begins

Business continuity gets operations running again, for example through an alternate production line, a backup supplier or a secondary site. Crisis management handles communication, leadership decisions under time pressure and stakeholder management happening at the same time. A facility incident in Riyadh needs both: a continuity plan for alternate production, and a crisis response covering regulator notification, informing employees' families, customer communication and possibly media handling. The continuity plan does not address any of those.

What a crisis management capability includes

A designated crisis team with roles assigned in advance, not decided in the moment. Pre-approved communication templates and a defined approval chain, so messaging is not held up waiting for legal sign-off while the situation unfolds. A decision log, so that choices made under pressure can be explained and defended afterward to a board, a regulator or a court.

Common triggers for a crisis response

Likely triggers include industrial incidents at Riyadh facilities, significant regulatory action against the company, and the sudden failure of a critical customer or supplier. Major cybersecurity incidents also qualify and increasingly overlap with cyber and digital risk planning. Many generic plans are built around purely hypothetical scenarios instead.

Why rehearsal matters more than the document

A crisis plan that exists only on paper tends to fall apart in the first hour of a real event. The people named in it are under stress and have not practiced the decisions the plan assumes they will make calmly. A short simulation exercise on a realistic scenario is usually where the gaps between the written plan and how people would behave become obvious.