Crisis Management Lessons SMEs Can Learn From Large Institutions
Large financial institutions have invested heavily in crisis management, often in response to hard lessons learned. Startups, SMEs and private equity-backed firms do not need to replicate enterprise-scale frameworks, but they can adopt the disciplines that consistently distinguish organisations that respond well under pressure.
Effective crisis management is not about producing extensive plans that remain on a shelf. It is about ensuring the right people can make the right decisions, communicate effectively and recover quickly when disruption occurs.
Crisis Preparedness Starts Before the Crisis
Growing businesses often assume that crisis management becomes important only after they reach a certain size. In practice, disruption rarely waits for organisations to be fully prepared.
A cyber attack, technology failure, supplier outage or unexpected absence of a founder can quickly expose weaknesses in governance, decision making and operational resilience. The impact is often felt not because the incident was unavoidable, but because responsibilities, priorities and communication were unclear. For regulated firms, the FCA and PRA increasingly expect businesses to demonstrate that they can continue delivering important business services during disruption. More broadly, investors, customers and lenders expect leadership teams to respond calmly, decisively and transparently.
Start by Identifying What Matters Most
One of the first lessons from larger institutions is that not every activity is equally important during a crisis.
Leadership teams should identify the products and services that are critical to customers and the continued operation of the business. Once these priorities are understood, it becomes much easier to allocate resources, make decisions and communicate effectively under pressure. Trying to recover everything at once often results in recovering nothing particularly well.
Regulatory Insight
Why do regulators focus on important business services?
The FCA and PRA expect firms to understand which services are most important to customers and how disruption could affect them. This enables organisations to prioritise recovery efforts, protect customer outcomes and demonstrate that resilience has been built into day-to-day operations rather than added as an afterthought.
Clear Accountability Improves Decision-Making
Many crises become more difficult because authority is unclear rather than because information is unavailable.
Questions such as who approves customer communications, who contacts regulators or who authorises major expenditure should never be answered during an incident.
Simple governance arrangements, documented decision-making authority and clearly defined crisis roles allow leadership teams to respond quickly without unnecessary escalation. Maintaining a straightforward decision log also creates an audit trail that demonstrates good governance to regulators, investors and insurers.
Practise Before It Matters
The strongest crisis plans are those that have already been tested.
Large financial institutions routinely use scenario exercises to expose weaknesses before a real incident occurs. Smaller organisations can achieve the same outcome without significant cost. A ransomware attack, supplier failure, data breach or regulatory investigation can all provide valuable scenarios for discussion.
The objective is not to prove that the plan works perfectly. It is to identify where governance, communication or operational arrangements require improvement. Testing should always result in actions, owners and completion dates. Without follow-through, exercises become little more than a box-ticking exercise.
Communication Builds Confidence
During a crisis, stakeholders rarely expect perfection. They expect leadership.
Customers want practical guidance. Employees need direction. Investors require confidence that management understands the situation. Regulators expect timely and accurate information where appropriate. Preparing communication templates in advance allows businesses to respond quickly while ensuring messaging remains consistent, factual and proportionate. Strong communication is often remembered long after the incident itself has been resolved.
Learn Before Moving On
The conclusion of an incident should mark the beginning of improvement rather than the end of the process.
Too often organisations restore services and immediately return to business as usual without addressing the governance or control weaknesses that allowed the incident to occur.
Every significant incident or exercise should conclude with a structured lessons learned review covering decision-making, communication, supplier performance, governance, root causes and remediation actions. Progress should then be monitored through to completion. This continuous improvement cycle strengthens resilience and demonstrates effective governance.
Questions Every Board Should Be Asking
- Have we identified the business services that are most critical to customers?
- Would everyone know who leads the response if a major incident occurred tomorrow?
- Have we tested our crisis arrangements within the last twelve months?
- Do we have clear communication plans for customers, employees, investors and regulators?
- Are lessons from incidents tracked through to completion?
- Could we demonstrate effective crisis governance during an FCA supervisory review or investor due diligence?
Oakbridge Insight
Many organisations believe they need a comprehensive crisis management framework. In reality, most need something much simpler: clear priorities, defined accountability and leadership that has practised responding before a real incident occurs. Crisis management is most effective when it becomes part of everyday governance rather than a standalone emergency process.
A Competitive Advantage
Organisations that manage crises well are rarely those with the largest response teams. They are the ones that understand what matters most, make decisions quickly and learn from every disruption.
For startups, SMEs and private equity-backed firms, effective crisis management is more than a resilience capability. It strengthens governance, protects enterprise value and builds confidence with regulators, investors, customers and employees. In an increasingly uncertain environment, that confidence can become a genuine competitive advantage.