vaayaa Inclusive Education
Marketing risk assessment

Crisis Communications and Reputation Management Risk Assessment: Messaging, Privacy and Channel Controls

A worked example of how a marketing team identifies, scores and controls the risks that arise when a brand must communicate during a crisis, from misleading claims and privacy breaches to fake leads and compromised accounts.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Crisis Communications and Reputation Management course

Executive summary

This assessment shows how a marketing team can find, rate and control the risks that arise when it must communicate during a crisis. Eight risks were chosen because they are plausible in everyday crisis communications, paid media and channel management. Privacy and consent breaches during targeted outreach carry the highest inherent score, followed by misleading claims, account compromise and rights or disclosure failures. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but privacy stays at Medium because its impact remains serious. The first actions are a sourced fact sheet, a block on sensitive audience targeting, multifactor sign in on every shared account and a standby distribution route. The brand is a teaching example, so every score illustrates the method rather than a real organization.

Focus area
Crisis communications, reputation management and marketing operations
Setting
In-house marketing and communications team of a mid-sized consumer brand working with agencies, creators and advertising platforms
Method
Five by five likelihood and impact risk register

Scope

This assessment covers crisis communications and reputation management for a consumer brand, including holding statements, paid and organic campaigns, influencer partnerships, audience targeting, lead capture and shared social channel administration. It considers risks to accuracy, personal data, legal duties, budgets and public trust. It does not provide legal advice or describe any real organization. Jurisdiction, platforms, budgets and team size are assumptions made for teaching.

Context

The team has a communications director, two campaign managers, a paid media specialist, a content editor and a data analyst. Campaigns run on several advertising platforms, a customer relationship tool and shared social accounts. Agencies and freelance creators supply content, and a small group of approved spokespeople speaks for the brand. When a crisis breaks, the team must publish statements, pause or change live advertising and answer audiences within hours. Each risk is scored before controls to show its natural level, then again after existing and added controls.

Objectives, assets and stakeholders

The objective is to communicate accurately and quickly during a crisis, protect personal data, meet advertising and rights duties, keep budgets under control and preserve public trust. The assets in scope are the brand's reputation, customer and audience data, consent records, advertising accounts, shared social channels, creative assets and the campaign budget. Stakeholders include the communications and marketing team, senior leaders, the finance team, the data protection lead, legal counsel, customers, affected individuals, agencies, creators, platform providers and regulators. Every risk has one owner role, and the communications director keeps the register current and reports to senior leaders after each incident.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H05 Likelihood 3, impact 4, score 12, high: H03 H06 Likelihood 3, impact 5, score 15, high: H07
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H05 Likelihood 2, impact 3, score 6, medium: H03 H06 Likelihood 2, impact 4, score 8, medium: H01 H02 H07
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misleading or unverified claims in crisis statements and ads 16 High 8 Medium Head of communications
H02 Privacy, consent and targeting breaches during crisis outreach 20 Critical 8 Medium Data protection lead
H03 Advertising law and intellectual property infringement in urgent creative 12 High 6 Medium Legal counsel
H04 Budget overspend and attribution errors in paid campaigns 12 High 4 Low Marketing finance partner
H05 Fraudulent traffic and fake leads distorting campaign data 9 Medium 4 Low Paid media specialist
H06 Platform, influencer and vendor dependency for crisis response 12 High 6 Medium Supplier relationship manager
H07 Account compromise of shared social and advertising accounts 15 High 8 Medium Digital channels manager
H08 Pre-launch checks skipped under pressure causing campaign failure 8 Medium 3 Low Communications director
H01

Misleading or unverified claims in crisis statements and ads

Reputational Before 16 After 8

Holding statements, ad copy or social posts state facts, timings or outcomes that are not yet verified, or overstate what the brand has done to fix a problem, so audiences and regulators are misled.

Who or what is affected: Customers, the public, spokespeople and the brand

Causes

Pressure to respond fast, incomplete facts early in an incident, and copy drafted by several people without one final check.

Consequences

Corrections, complaints, regulator attention, lost credibility and possible legal claims.

Existing controls

  • Statements are checked by the communications director before release.
  • A fact log lists the source for each claim made in public messages.

Control gaps

Agency copy is approved by email, and no one compares published lines with the fact log afterwards.

Additional controls

  • Prevent: Require a sourced fact sheet and legal review before any claim about cause, safety or remedy is published.
  • Detect: Run a weekly audit of live posts and ads against the fact log and remove unsupported lines.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Head of communications Target: Within 14 days Early warning: A post or ad flagged by customers or staff as inaccurate within 24 hours of publication.
H02

Privacy, consent and targeting breaches during crisis outreach

Technology and data Before 20 After 8

Audience lists, customer records or sensitive affected groups are used for targeted messages without valid consent or a clear purpose, so personal data is exposed or processed unlawfully and trust is damaged.

Who or what is affected: Customers, affected individuals, the data protection lead and the brand

Causes

Urgency to reach affected customers, copied lists from old campaigns and unclear consent records.

Consequences

Regulatory complaints, fines where applicable, individual harm and loss of customer trust.

Existing controls

  • Customer lists are segmented by consent status in the customer relationship tool.
  • Sensitive categories are excluded from custom audience uploads by team policy.

Control gaps

Consent records are not linked to audience uploads made by agencies.

Additional controls

  • Prevent: Block targeting on any group linked to the incident and require a privacy review before new audiences are built.
  • Respond: Stop affected campaigns, notify the data protection lead and follow the agreed breach route.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Data protection lead Target: Within 30 days Early warning: An audience upload that cannot be matched to a recorded consent source.
H03

Advertising law and intellectual property infringement in urgent creative

Legal and compliance Before 12 After 6

Ads, images, music, fonts or influencer content are reused or produced quickly without rights checks or required disclosures, so the brand breaches advertising rules or infringes someone else's rights.

Who or what is affected: Creators, rights holders, consumers and the brand

Causes

Rushed creative during an incident, reused assets from past campaigns and unclear licence terms.

Consequences

Takedown demands, claims, forced withdrawal of campaigns and reputational harm.

Existing controls

  • Stock images are licensed through a central account with a usage log.
  • Influencer briefs require clear disclosure of paid partnerships.

Control gaps

Freelance creators supply assets outside the licence log, so usage rights cannot be confirmed quickly.

Additional controls

  • Prevent: Use a rights checklist covering licences, model releases and disclosures before any creative goes live.
  • Detect: Review influencer posts within a day of publication for missing disclosures or unlicensed material.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Legal counsel Target: Within 30 days Early warning: An asset with no licence reference or a post with no disclosure tag.
H04

Budget overspend and attribution errors in paid campaigns

Financial Before 12 After 4

Paid media spend rises beyond the approved budget during a crisis, or results are credited to the wrong channel, so the team cuts or expands spend on the basis of false evidence.

Who or what is affected: Finance team, campaign managers and senior leaders

Causes

Automatic bidding during a spike in attention, overlapping tracking tags and last click reporting rules.

Consequences

Wasted budget, poor decisions, overstated returns and missed targets.

Existing controls

  • Daily spend caps are set on each advertising account.
  • Monthly reports reconcile platform spend with supplier invoices.

Control gaps

Reconciliation happens monthly, so overspend can run for weeks before anyone notices.

Additional controls

  • Prevent: Set hard spend limits per campaign and require approval for any increase above an agreed amount.
  • Detect: Compare platform conversions with analytics data and flag differences above an agreed tolerance.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Marketing finance partner Target: Within 30 days Early warning: Spend that reaches most of a campaign cap before the planned midpoint.
H05

Fraudulent traffic and fake leads distorting campaign data

Financial Before 9 After 4

Bots, click farms or fake sign ups inflate clicks and lead counts, so budgets are spent on invalid traffic and crisis responses are judged on data that does not reflect real audiences.

Who or what is affected: Campaign managers, sales staff and the finance team

Causes

Open lead forms, incentive offers that attract fake sign ups and low cost click pools.

Consequences

Wasted spend, misleading reports and sales effort lost on fake contacts.

Existing controls

  • The advertising platform's basic invalid traffic filter is enabled.
  • Lead forms include a verification step before records are passed to sales.

Control gaps

Verification is optional on some forms and no one reviews lead source patterns over time.

Additional controls

  • Detect: Review lead sources weekly for repeated email domains, unusual hours and identical sign up patterns.
  • Recover: Remove invalid leads from reports and request credit for paid clicks that were not genuine.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Paid media specialist Target: Within 60 days Early warning: A sudden jump in sign ups from one source that does not match earlier patterns.
H06

Platform, influencer and vendor dependency for crisis response

Supplier Before 12 After 6

The team relies on a single platform, a few creators or one agency for reach and production, so a policy change, account suspension or vendor failure stops communication just when it is most needed.

Who or what is affected: Communications team, audiences and partner agencies

Causes

Heavy reliance on paid reach, long lead times for creators and contracts that lack clear service levels.

Consequences

Silence during a crisis, rumors filling the gap and higher production costs.

Existing controls

  • Two agencies are contracted for overflow production work.
  • Owned channels include an email list and the brand website.

Control gaps

The owned email list is not tested regularly, and agency contracts do not set response times.

Additional controls

  • Prevent: Keep a backup distribution route and a standby agency contract with a tested briefing pack.
  • Respond: Move key messages to owned channels within hours when a platform limits reach or suspends an account.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Supplier relationship manager Target: Within 60 days Early warning: A platform notice that limits reach, or a creator who misses a scheduled publishing slot.
H07

Account compromise of shared social and advertising accounts

Technology and data Before 15 After 8

Shared logins to social and advertising accounts are phished or reused, so attackers post false statements, change live ads or take control of a channel during an incident.

Who or what is affected: Audiences, staff, partners and the brand

Causes

Phishing emails, reused passwords and former staff or agencies who still hold access.

Consequences

False statements, harm to people, legal exposure and a long recovery of public trust.

Existing controls

  • Shared accounts have named administrators on a list.
  • Passwords are stored in a managed password vault.

Control gaps

Access is reviewed only when someone leaves, not on a set schedule.

Additional controls

  • Prevent: Enforce multifactor sign in on every account and replace shared logins with role based access.
  • Detect: Alert the communications team to new log ins, changed recovery details or posts sent outside approval hours.
  • Respond: Lock the account, post a verified notice from owned channels and revoke all active sessions.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Digital channels manager Target: Within 30 days Early warning: A login alert or password reset request that the account owner did not make.
H08

Pre-launch checks skipped under pressure causing campaign failure

Operational Before 8 After 3

Under time pressure, reviews of copy, targeting, tracking and approvals are shortened, so campaigns launch with errors, tone problems or broken links that damage the brand and waste budget.

Who or what is affected: Campaign team, audiences and senior leaders

Causes

Emergency timelines, unclear roles and approvals that rely on one person being available.

Consequences

Public errors, messages that seem tone deaf and wasted spend.

Existing controls

  • A launch checklist exists for planned campaigns.
  • Senior sign off is required for paid campaigns above a set value.

Control gaps

Crisis launches often skip the checklist because it was designed for planned work.

Additional controls

  • Prevent: Use a short crisis launch checklist covering tone, claims, links, tracking and audience exclusions.
  • Detect: Run a post launch review within two hours that checks live links, tags and early comments.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Communications director Target: Within 30 days Early warning: A campaign launched without a completed checklist or with an unapproved change.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a precise measurement. Inherent risk is the score before any controls are applied. Residual risk is the score after existing and added controls. Impact is judged on harm to people, legal exposure, money lost, time to correct and damage to trust. A reputational or privacy risk is never rated down only because it has not yet happened. Anything still Critical or High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Team members who do the work should challenge the ratings, and the register is reviewed whenever an indicator reaches its threshold or after any live incident.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Posts or ads flagged as inaccurate by customers or staff within 24 hours of publication.Escalate to the head of communications at once, pause the item and inform legal counsel within the same day.
Audience uploads that cannot be matched to a recorded consent source.Escalate to the data protection lead immediately, stop the upload and follow the breach route if personal data was sent.
Login alerts or password reset requests the account owner did not make.Escalate to the digital channels manager at once, lock the account and revoke all sessions within the hour.
Campaign spend approaching the cap before the planned midpoint, or conversions far above analytics.Escalate to the marketing finance partner when spend nears the cap, and to the communications director if the gap persists for three days.
Platform notices limiting reach or creators who miss scheduled publishing slots.Escalate to the supplier relationship manager on the same day, and activate the owned channel plan if reach stays limited.

Contingency arrangements

If a serious event occurs, such as a confirmed false statement, a privacy breach or a compromised account, the communications director pauses related campaigns and posts, preserves records and informs senior leaders. The digital channels manager locks affected accounts and publishes a verified notice from owned channels. The data protection lead follows the agreed breach route, and legal counsel reviews any statement before it is released. Paid spend is held at a safe level until the facts are confirmed.

Prioritized action plan

  1. Block sensitive audience targeting and require a privacy review for new audiences, owner data protection lead, within 14 days.
  2. Publish a sourced fact sheet and require legal review of any cause, safety or remedy claim, owner head of communications, within 14 days.
  3. Enforce multifactor sign in and remove shared logins from every advertising and social account, owner digital channels manager, within 30 days.
  4. Set hard spend caps per campaign and reconcile platform conversions with analytics weekly, owner marketing finance partner, within 30 days.
  5. Create a standby distribution route and a tested crisis launch checklist, owner supplier relationship manager, within 60 days.

Conclusion

Trustworthy crisis communication depends on a few steady habits: sourced facts, consent checked before audiences are built, rights confirmed before creative goes live, locked and monitored accounts, and budgets with hard limits. The highest scores sit with privacy, misleading claims and account compromise, and each has actions that bring the residual score down. Treat the register as a living record, review it every six months and after any incident, and seek qualified legal and data protection advice for any real question.

Assumptions and limitations

Assumptions

  • The brand operates in one main jurisdiction, so advertising and privacy duties are described in general terms only.
  • Campaigns run on mainstream advertising platforms with standard reporting and invalid traffic filters.
  • Customer consent records exist in a central tool, although their quality varies.

Limitations

  • The scores are examples for learning and do not describe any real brand, incident or campaign.
  • Advertising, privacy and intellectual property rules differ by country and change over time, so specialist legal review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed legal or data protection advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Three lines model of risk ownership
  • Hierarchy of controls

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Crisis Communications and Reputation Management course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 45,552 Learners