A crisis plan is useful when the people responding can find it, understand their authority, and adapt it to verified facts. This worked example is fictional: a subscription service discovers that a software error caused some customers to be charged twice. It illustrates communications coordination, not a legal, security, or payments procedure. Organizations should replace the sample roles and timings with their own tested arrangements and seek specialist advice where required.
Scenario and decision threshold
At 09:00, support notices several reports of duplicate charges. The billing team confirms that multiple accounts may be affected, but the number and cause are not yet known. The incident lead activates the response plan because customers may face a financial impact and routine support replies cannot resolve it alone.
The immediate objectives are to stop further incorrect charges, establish which accounts are affected, help customers, preserve a factual record, and provide timely updates. Communications cannot declare the issue fixed until the billing owner confirms containment. If fraud, privacy, or regulated payment obligations may be involved, the appropriate specialists determine additional action.
Assign roles before the first public update
Incident lead
Owns the response timeline, convenes decision-makers, records approvals, and names a deputy in case the lead is unavailable.
Billing and technical owners
Investigate the charge flow, stop the error, identify affected accounts, and document what has and has not been verified.
Customer-support lead
Prepares an individual-help route, equips agents with the same known facts, and escalates urgent hardship cases.
Communications lead
Publishes approved, consistent updates across the status page, email, and social channels; monitors questions; and corrects mistakes visibly.
Legal, privacy, and finance advisers
Advise on obligations, refunds, records, and wording within their remit. They do not replace the operational owner of the fix.
Example first statement and update log
A suitable first statement, once the possible duplicate billing is confirmed, would say: 'We are investigating reports that some customers were charged twice for a subscription payment. We have paused the affected billing process while we identify the accounts involved. If you see a duplicate charge, contact our support team through [official channel]; please do not post payment details publicly. We will update this page by [time].' The bracketed fields must be filled with real, verified details before publication.
Maintain a time-stamped log: what was reported, what was confirmed, who approved each statement, when customers were contacted, when billing was contained, and which questions remain open. If the next update finds no new facts, say so and give the next check-in time. Publish a correction if an earlier count or timeline was wrong.
Recovery and rehearsal checklist
After containment, notify affected customers directly with the verified impact, steps to receive a refund or support, and a contact route for unresolved cases. Keep the public page current until the organization can substantiate that the operational issue and customer remediation are complete. A statement of regret matters, but it is not the remedy.
In the debrief, test whether the team recognized the signal quickly, reached decision-makers, prevented further harm, kept support and public messaging aligned, and met its update commitments. Revise the plan, contacts, and templates; then rehearse another scenario. PRSA's crisis checklist emphasizes risk identification, assigned roles, channels, monitoring, and post-crisis review.