Michael Austin/theispot.com
Every leader wants to believe that their company is prepared to handle a crisis, but when one occurs, it often reveals the weaknesses at the heart of an organization.
Consider Southwest Airlines. When a winter storm hit in December 2022, the company suffered a meltdown. Seventeen thousand flights had to be canceled, 2 million passengers were left stranded, and the company lost an estimated $800 million. What lay at the heart of Southwest’s troubles wasn’t bad weather but an aging, neglected IT infrastructure that led to the collapse of its scheduling systems. Communication broke down, and front-line teams found themselves improvising in isolation.
Contrast this with Microsoft. A major outage in March 2021 left millions of Teams, Outlook, and Microsoft 365 users without access to the cloud-based systems. Almost immediately, however, a fully integrated crisis response kicked in. The outage was contained, and services were restored that same day. Importantly, Microsoft followed up with a detailed root-cause analysis and, in the months that followed, accelerated its investments in system redundancy and incident transparency. In other words, Microsoft not only survived the crisis but also used it to become an even more resilient organization afterward.
Such incidents lead to an obvious question: Why do some organizations freeze in the face of a crisis while others spring into action and skillfully minimize the damage?
We posed this question to leaders who have faced high-stakes disruption firsthand. Our interviews included individuals who have served in high-ranking political, military, and government roles, as well as senior executives at major global companies. (See “The Research.”)
Based on their insights, we identified seven capabilities that any organization must develop to withstand a crisis. Because most organizations have these capabilities, if only in a partial or uneven form, we also define what each capability looks like in terms of its level of maturity. The result is what we’ve termed the 7C’s Model. (See “The 7C’s of Effective Crisis Management.”) Here, we’ll introduce the model and illustrate how it can be used as an analytical lens to review and assess an organization’s strengths and weaknesses in crisis management.
The Seven Core Capabilities of Crisis Management
Our interviewees saw the ability to execute the following organizational practices as vital in any crisis.
1. Contingency. Preparing for what might happen and defining roles upfront so that people know what to do when the crisis hits is critical to surviving a crisis. For example, the CEO of a leading electronics and health tech company told us that the organization was able to build muscle memory by running repeated supply chain stress tests. As a result, when the COVID-19 pandemic hit, employees knew exactly what to do, how to do it, and how to organize their response.
2. Clarity. Transparent and clear communication is essential in a crisis. This does not mean spinning disaster into a polished press release; it means communicating early and honestly. The CEO of a major professional services organization advised leaders to communicate only what they know to be true, warning, “You can’t take back what you’ve already said.” As a former prime minister of a Western European country put it, “People can handle bad news; what they can’t handle is confusion.”
3. Coordination. Effective leaders connect silos before a crisis. They build trust and a rhythm of collaboration so that when things go wrong, everyone can act as one and as needed. Capital One’s response to a data breach in 2019 is a good example of putting this principle into action: When a cybercriminal stole personal data on about 106 million North American customers, the company’s predefined cross-functional teams jumped into action to contain the damage and coordinated with law enforcement to enable the prompt arrest of the perpetrator.
4. Compassion. Showing genuine empathy for all who may be affected by the crisis, both inside and outside the organization, builds credibility and confidence and, critically, buys time to deal with the situation. “Showing you care for your people and their safety builds unshakable trust,” a national chief of defense told us. “Leadership is not about being in charge. It is about taking care of those in your charge.”
5. Confrontation. Leaders must face the hard truths early. Johnson & Johnson’s 1982 Tylenol crisis is a classic case in point: Instead of denying that capsules of its pain medication had been contaminated with cyanide or delaying making a statement, the company immediately confronted the threat, recalled 31 million bottles of medicine, and began to rebuild public trust through its decisive transparency.
6. Control. Good leaders maintain order in a crisis. That doesn’t mean centralizing every decision; it means defining decision rights in advance, clarifying who decides what, and empowering those closest to a situation to act when needed. As the former president of a European country’s central bank put it, “Control is not about micromanaging; it’s about keeping the system stable so others can act with confidence.” For example, during Hurricane Harvey in 2017, Walmart empowered local managers to direct trucks and reopen Houston-area stores as they saw fit, speeding recovery and earning customers’ trust that they could count on the retailer.
7. Continuity. The best crisis managers don’t just move on once a crisis has faded. They run postmortems, capturing lessons that can help them build resilience and make the organization better prepared for the next crisis. Shell uses systematic debriefs after every incident to help ensure that every disruption strengthens the oil and gas company’s reflexes to make it even more resilient.
It’s important not to view this simple framework as a checklist. All of the capabilities must be in place to some degree because they reinforce one another and together make a system more resilient. Contingency without clarity breeds confusion; compassion without confrontation leads to inaction; control without coordination creates bottlenecks. Each element constrains or amplifies the others. Organizations that survive crises, our interviewees told us, have these seven capabilities in place, supported by strong organizational routines and culture.
Maturity Matters, but Progress Can Be Uneven
All organizations, to a degree, have the 7C’s. As the chair of a leading technology company told us, however, some capabilities will have been battle-tested while others are still developing.
In other words, crisis capabilities can be understood as maturing across five stages that we characterize as reactive, aware, defined, integrated, and strategic. In the reactive stage, organizations rely on improvisation. There are no formal plans or roles, and responses depend on individual initiative — what one CEO called “firefighting with no water.” In the aware stage, the organization recognizes the need for structure. Playbooks may already exist, but they are rarely used or tested, and planning remains largely symbolic. The defined stage marks the first step toward institutional discipline: Standardized processes, rehearsals, and scenario testing transform plans from paper exercises into operational routines. At the integrated stage, capabilities become embedded across functions; cross-departmental simulations are routine, decision rights are clear, and early warning systems link detection to coordinated action. Finally, in the strategic stage, preparedness becomes anticipatory rather than reactive. The organization develops proactive sensing mechanisms, embeds agility into its governance system, and treats resilience as a source of strategic advantage to be nurtured and protected.
The real power of our framework is in using it to diagnose imbalances and immaturity across a system. We’ve broken down each capability by maturity stage (see “The 7C’s of Effective Crisis Management”) so that it can be used as both an assessment and a map to guide capability-building. The goal of the exercise, however, is not to create symmetry but to build coherence. Not all organizations need to be equally mature in all of the 7C’s, but to avoid buckling under the pressure of a crisis, they need sufficient maturity across the practices. As a leader in professional services put it, “A company can survive weakness in one area, but only if the rest of the system holds together.”
As they review the framework, then, leaders should begin to assess which capabilities are underdeveloped and most likely to be a source of vulnerability in a crisis. They should also look for where capabilities are out of balance. For example, are they overcentralizing control at the cost of coordination? The following case shows the need to balance the 7C’s at different maturity levels so that the system holds under pressure.
How JPMorgan Chase Rode Out the Turmoil of 2023
In March 2023, when the collapses of Silicon Valley Bank, Signature Bank, and, later, First Republic triggered the most significant banking turmoil since 2008, the industry faced over $500 billion in outflows within weeks and a 20% drop in the KBW Nasdaq Regional Bank Index. Amid the panic, JPMorgan Chase — which held over $3.7 trillion in assets and $1.9 trillion in deposits — acted as a systemic stabilizer. Within hours, it activated its crisis-response architecture: a 24-hour “war room” that brought together treasury, risk, communications, and legal teams; live scenario modeling of liquidity positions; and hourly updates shared with the U.S. Treasury, Federal Reserve, and Federal Deposit Insurance Corp.
Seen through a 7C’s lens, the company’s crisis management maturity was evident. Coordination across divisions and regulators was immediate and disciplined, supported by preset escalation protocols and shared data dashboards. Control was strong yet flexible; regional and product teams were empowered to make lending and liquidity decisions within clear limits. Clarity came from transparent, consistent messaging. CEO Jamie Dimon publicly framed the situation as “containable but serious,” signaling confidence without denial, while daily internal briefings aligned 290,000 employees worldwide. JPMorgan Chase took action that could be seen as compassionate as it extended temporary credit facilities to smaller regional banks and prioritized retail deposit access to stabilize confidence. The crisis was confronted explicitly: Dimon and CFO Jeremy Barnum publicly acknowledged the fragility of midtier balance sheets and the need for tighter liquidity oversight. Most importantly, continuity and contingency were fully institutionalized, thanks to weekly liquidity stress tests and twice-annual simulations with the board that it had been conducting since the 2008 global financial crisis. As a result, when regulators orchestrated the sale of First Republic to JPMorgan Chase, the latter absorbed $173 billion in loans and $92 billion in deposits over a single weekend without market disruption.
At JPMorgan Chase, continuity was a weak spot, though it was identified and addressed early. Earlier repeated stress tests and simulations had exposed vulnerabilities in digital resilience and liquidity concentration, prompting preemptive strengthening. The main tension — between control and coordination — was managed intentionally: Global teams operated autonomously by following clear escalation ladders, avoiding both chaos and command paralysis. The result was a system that flexed under pressure and took a hit but did not break.
Under the 7C’s Model, maturity gives leaders the structure and confidence needed to make good decisions under pressure. Our interviewees also emphasized one overarching lesson: Practice matters. This requires an additional reinforcing factor: culture — that is, the daily reality of “how we do things around here.” Cultivating a culture that supports the 7C’s is critical. And Microsoft’s response to its 2021 outage is again a case in point. Its postmortem avoided blame, focused on learning, and used the crisis as a stepping stone to improvement. That’s important because without that type of open, learning culture, organizations are doomed to make the same mistakes the next time around. As a former CEO of a global energy company told us, “You can’t control the storm, but you can control how your people behave in it. That comes down to culture.”
The capabilities framework that emerged from our interviews with leaders about crisis management provides managers with a common language to assess their readiness, explore weaknesses, and prioritize the development of their capabilities. The model also highlights that crisis management is a systemic competence, not a single skill set held by a gifted leader. It reminds us that resilience depends on a balance of complementary factors, and it offers a road map to maturity, helping managers move from awareness to mastery.
These takeaways from our research underscore the importance of recognizing that resilience grows from rehearsal, reflection, experience, and the routines that stabilize a system when pressure mounts. As a seasoned board member at various international companies reminded us, “Resilience isn’t what you do in the crisis; it’s what you’ve built before it.”