When a crisis hits, the CEO tells the story and the COO runs the machine. That split matters. Your job is not to write the press release or reassure the board with vision. Your job is to keep the business physically working — people safe, orders flowing, systems up, decisions made — while everything is on fire.

Most crisis failures are not failures of courage. They are failures of preparation. The team that recovers fastest is the one that already knew who decides, who does what, and where the backup lives. The team that flails is the one improvising all of that at 2am with a broken phone tree.

This playbook covers the COO's specific role across the three phases every crisis moves through: prepare (before anything happens), respond (the moments that decide the outcome), and recover (getting back to normal and getting stronger). Treat it as the hub — each phase links to a deeper guide when you need to go further.

The three phases and what the COO owns

A crisis is not one event. It is a sequence, and the COO's contribution changes at each stage. If you only build for the loud middle phase, you will be under-prepared before and under-disciplined after.

Read that table as a warning. If your organisation only has a "respond" reflex — a chat group that lights up when something breaks — you are one bad night away from a mess. The prepare and recover columns are where COOs earn their keep, because that is where you do the unglamorous work no one applauds.

Prepare: build the machine before you need it

Preparation is the phase you control completely, and the one most companies skip. Everything you do here buys you speed and clarity later.

What strong looks like: there is a living risk register that names the plausible threats — supplier failure, a data breach, a key-site outage, a safety incident, a funding shock — each with an owner, a likelihood, and a rough impact. There is a named crisis team with a single decision-maker and defined roles. There are written continuity plans for the handful of functions the business cannot run without. And the team has actually rehearsed, so the plan is muscle memory, not a PDF no one has opened. What weak looks like: a binder written three years ago, contact numbers for people who left, and a "plan" that is really just a hope that the right people will figure it out.

Concretely, the COO should own four things before any crisis:

• The risk register. Sit down with function heads once a quarter and ask a blunt question: what would hurt us most, and how likely is it? Rank the answers. A structured risk assessment framework turns that conversation into a repeatable scoring exercise instead of a gut-feel argument.
• The crisis team roster. Name the people, name their backups, and name the one person who makes the call when the room disagrees. Ambiguity about who decides is the single biggest cause of slow response.
• Continuity plans for critical functions. For each function you cannot lose — payroll, fulfilment, customer support, the core product — write down the minimum viable version and how you run it if the primary path is gone. The business continuity guide walks through mapping those functions and building the fallback.
• Rehearsal. Run a tabletop exercise at least twice a year. Put the crisis team in a room, hand them a scenario ("our main warehouse floods overnight"), and make them work the problem in real time. You will find the gaps — the missing phone number, the person who does not know they are the backup — in a low-stakes room instead of a real one.

The tabletop drill is the highest-leverage thing on this list. It is cheap, it takes two hours, and it exposes exactly where your plan is fiction.

Respond: command the operation when it matters

The response phase is loud, fast, and full of incomplete information. This is where the preparation pays off — or where its absence becomes obvious.

The first hour. The opening period sets the tone for everything after. In the first hour the COO has a narrow, non-negotiable checklist: confirm people are safe, get a factual picture of what is actually happening (not the rumour), activate the crisis team, and start a single running log of decisions and timestamps. Do not try to solve the whole crisis in hour one. Try to stabilise it and get organised. Decision-making under pressure. You will never have complete information when you need to decide. Strong COOs make the reversible call fast and reserve deliberation for the irreversible ones. A useful discipline: for each decision, ask "if I am wrong, how bad and how recoverable is it?" Cheap-to-reverse decisions get made in seconds so the operation keeps moving. Expensive, one-way decisions get the extra five minutes and the second opinion. What strong vs weak looks like day to day: a strong response has one clear commander, a rhythm of short status huddles (say, every 30–60 minutes early on), and a written log so nothing gets lost in the noise. A weak response has three people all think they are in charge, decisions made in side conversations no one records, and the same question answered differently by different people an hour apart. Coordination is the real work. During response, the COO is less a hero and more an air-traffic controller. You are keeping the operational teams, the communications function, and leadership pointed the same direction. Two coordination rules earn their place every time:

• Keep a single source of truth. One document, one channel, that everyone treats as the record. Kill the parallel threads.
• Separate the doers from the deciders. The people fixing the problem should not also be the people fielding every stakeholder question. Route external and internal messaging through the communications track so operations can stay focused. A ready crisis communication plan means you are not drafting messaging from scratch while the fire is still burning.

The COO's tell for a well-run response is boring: calm cadence, clear ownership, decisions logged, people knowing what to do next. Drama is usually a symptom of missing preparation.

Recover: restore operations and get stronger

The crisis feels over when the immediate danger passes. It is not. Recovery is a distinct phase with its own discipline, and rushing it is how organisations create a second, avoidable crisis.

Restore in priority order, not all at once. Bring functions back in the sequence that matters most — safety and critical operations first, then revenue-generating functions, then everything else. Trying to switch everything on simultaneously overloads a tired team and hides new problems. The crisis recovery guide covers sequencing the restart and confirming each function is genuinely stable before moving on. Learn, honestly. Within a week or two, run a post-incident review while memories are fresh. The goal is not to assign blame — that guarantees people hide the truth next time. The goal is to answer three questions plainly: what happened, what did we do, and what will we change? Turn the answers into specific updates to the risk register, the continuity plans, and the crisis roster. A review that produces no changes to the playbook was a meeting, not a learning. Fold the lessons into the next preparation cycle. Each crisis is data. The organisations that build real operational resilience are the ones that treat every incident as an input to a stronger system — updating drills, closing the specific gap that hurt them, and making the next response a little faster than the last.

Where the COO's skills show up

Crisis management is not a separate skill set bolted onto the role. It is the ordinary COO competencies — clear decision-making, cross-functional coordination, operational discipline — put under maximum pressure. If you want to strengthen the underlying muscles, the essential COO skills that matter most in a crisis are the ones worth developing before you need them, not during.

Key takeaways

• Crisis management is three phases, not one event. Prepare, respond, recover — and the COO owns a different job in each.
• Preparation is the phase you fully control and most often skip. A living risk register, a named crisis team with a single decision-maker, continuity plans, and rehearsed tabletop drills buy you speed later.
• In the first hour, stabilise and organise — do not try to solve everything. Confirm safety, get the facts, activate the team, log every decision.
• Decide fast on reversible things, deliberately on irreversible ones. Ask "how bad and how recoverable if I am wrong?" before spending time.
• The COO runs the operation; the communications track carries the message. Keep a single source of truth and separate the doers from the deciders.
• Recovery is a real phase. Restore in priority order and run an honest, blameless post-incident review that changes the playbook.

Frequently asked questions

What is the COO's role in a crisis, versus the CEO's? The CEO owns the narrative and the external face of the organisation — the board, investors, the public. The COO owns the machine: keeping people safe, critical operations running, and the response coordinated. In practice the COO is the operational commander during a crisis, translating high-level direction into who-does-what on the ground. What should a COO do in the first hour of a crisis? Four things, in order: confirm people are safe, get a factual picture of what is actually happening, activate the crisis team, and start a single timestamped log of decisions. Resist the urge to solve the entire crisis immediately. The first hour is about stabilising the situation and getting organised, so the harder decisions that follow are made from clarity rather than panic. How do you make decisions when you do not have full information? You never will have full information when the decision is due, so waiting for certainty is itself a decision — usually a bad one. Sort choices by reversibility: make cheap-to-reverse calls fast to keep the operation moving, and reserve slower, more careful deliberation for the expensive, one-way decisions. Log what you decided and why, so the response stays coherent as the situation changes. How often should a crisis plan be tested? Run a tabletop exercise at least twice a year, and review the underlying plans, contact lists, and roster more frequently than that. Also refresh the plan after any real incident or major organisational change — a reorganisation, a new critical supplier, a system migration. A plan that is not rehearsed is a document; a plan that is rehearsed is a capability. What is a post-incident review and why does it matter? It is a structured look back, run soon after the crisis passes, that answers three questions: what happened, what did we do, and what will we change. Kept blameless, it surfaces the real gaps because people are willing to be honest. Its output is not a report that gets filed — it is specific changes to the risk register, continuity plans, and crisis roster that make the next response faster. What is the difference between a business continuity plan and crisis recovery? A business continuity plan is prepared in advance and defines how critical functions keep running — or run in a reduced form — while a disruption is happening. Crisis recovery is what you do after the immediate danger passes to restore full operations and learn from the event. Continuity keeps the lights on during the storm; recovery rebuilds and hardens the house once it clears.