Crisis Management Masterclass Training Course

Duration 10 days 18 modules · 65 contact hours
Level Advanced Certificate on completion
Who attends Business Continuity Managers, Crisis Management Leads and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-BC-022

Before you join: Participants should have practical experience in business continuity, emergency response, HSE, security, operational resilience, risk or incident management.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Major incidents expose more than operational weaknesses. They test whether leaders can establish control, make defensible decisions with incomplete information, protect people, maintain essential services and communicate credibly under scrutiny. Senior crisis practitioners must connect response arrangements to business continuity, regulatory duties, safety management, cyber events, supply disruption and recovery priorities. A plan alone is insufficient when command roles, decision rights, escalation thresholds and stakeholder messages have not been tested.

This masterclass develops the judgement and practical architecture required to lead and improve crisis management arrangements. Participants examine ISO 22361 crisis management guidance, ISO 22320 incident management principles and ISO 22301 business continuity requirements. They build from risk intelligence and business impact analysis through crisis governance, command structures, decision logging, incident action planning, emergency communications, welfare arrangements, recovery management and post-incident learning. Particular attention is given to board-level reporting, media pressure, regulator engagement and difficult trade-offs between life safety, service continuity, reputation and financial exposure.

Instruction combines focused briefings with sector-based cases, facilitated group analysis, timed crisis simulations and structured peer review. Participants apply the methods to a selected organisational scenario or their own operating context from the first week. They leave with a reviewed crisis management pack: governance terms of reference, escalation criteria, command structure, decision log, communications framework, exercise plan and recovery outline ready for adaptation at work.

The course is designed for experienced professionals who own, lead or advise crisis, resilience, safety, security, continuity or emergency management programmes. It is particularly relevant where failure to respond well could affect people, essential public services, regulated operations, critical assets or public trust.

What you will be able to do

  • Design crisis governance arrangements with defined authority, escalation and board oversight
  • Apply ISO 22361 principles to structure crisis preparedness and response
  • Produce a crisis impact assessment using credible scenarios and service priorities
  • Establish an incident command structure with clear roles and decision rights
  • Create decision logs, incident action plans and executive situation reports
  • Develop stakeholder and media communications using holding statements and approval protocols
  • Plan and evaluate crisis simulations using objectives, injects and evidence criteria
  • Present a complete crisis management pack for senior leadership review

Benefits of attending

For you

  • Greater confidence briefing executives during fast-moving, high-consequence incidents
  • A defensible method for recording decisions made under uncertainty
  • Practical language for challenging unclear crisis roles and escalation thresholds
  • Evidence to lead stronger exercises, debriefs and corrective-action reviews
  • A reviewed crisis management pack for immediate workplace adaptation

For your organisation

  • Clearer authority and escalation arrangements during major incidents
  • Faster prioritisation of life safety, essential services and critical assets
  • More consistent executive, regulator, workforce and media communications
  • Better evidence trails for decisions, actions and post-incident assurance
  • A usable improvement plan linked to exercises and recovery requirements

Course modules

18 modules over 10 days

Participants can establish crisis governance with accountable leadership, decision rights and escalation controls.

  • ISO 22361 principles for crisis management governance and leadership
  • Crisis, incident, emergency and business continuity management distinctions
  • Board oversight, executive sponsorship and accountable crisis leadership roles
  • Terms of reference defining authority, delegation and decision boundaries
  • Escalation thresholds based on harm, service loss and stakeholder exposure
  • RACI analysis for strategic, tactical and operational response responsibilities

Participants can develop credible crisis scenarios from internal and external threat information.

  • Scenario planning using threat, vulnerability, consequence and control evidence
  • Horizon scanning sources for geopolitical, climate, cyber and supply threats
  • Bow-tie analysis linking preventive controls, consequences and recovery barriers
  • Plausible worst-case scenarios tested against stated organisational assumptions
  • Trigger events distinguished from slow-burn crises and emerging issues
  • Risk appetite statements translated into crisis escalation decision criteria

Participants can determine crisis priorities using service impacts, tolerances and stakeholder consequences.

  • Business impact analysis outputs used to set response priorities
  • Maximum tolerable period of disruption and recovery time objectives
  • Critical service mapping across people, facilities, technology and suppliers
  • Life safety, legal duty and service obligations ranked explicitly
  • Dependency analysis identifying single points of failure and workarounds
  • Priority matrices balancing harm, urgency, reversibility and resource demand

Participants can design a command structure suited to strategic crisis leadership and operational control.

  • ISO 22320 command principles applied to major incident coordination
  • Strategic, tactical and operational command roles and accountabilities
  • Incident commander appointment, transfer and relief arrangements
  • Functional cells for operations, planning, logistics and finance
  • Multi-agency coordination without duplicating statutory emergency service command
  • Span of control limits during sustained multi-site incidents

Participants can create a reliable common operating picture from fragmented crisis information.

  • Common operating picture built from verified facts and assumptions
  • METHANE reporting adapted for early incident notification and escalation
  • Information requirements defined for people, operations, assets and stakeholders
  • Source reliability ratings applied before executive decisions and communications
  • Situation reports separating confirmed information, gaps, forecasts and actions
  • Operational tempo set through briefing cycles and reporting deadlines

Participants can make and record defensible crisis decisions under uncertainty and time pressure.

  • OODA loop used to structure rapid crisis decision cycles
  • Decision logs capturing rationale, evidence, owner and review point
  • Pre-mortem analysis exposing failure assumptions before committing resources
  • Red-team challenge applied to high-consequence strategic decisions
  • Ethical decision criteria for competing safety, service and financial priorities
  • Cognitive bias controls for anchoring, groupthink and confirmation errors

Participants can establish controlled communications for internal, public and regulatory stakeholders.

  • Stakeholder mapping by information need, influence and likely concern
  • Holding statements drafted before facts, causes and impacts are confirmed
  • Message maps linking key messages, proof points and anticipated questions
  • Approval protocols balancing speed, accuracy, legal review and empathy
  • Spokesperson roles, media briefings and interview preparation requirements
  • Rumour monitoring and correction procedures for social media channels

Participants can integrate workforce safety, welfare and duty-of-care requirements into crisis actions.

  • Life safety objectives established before property, revenue and reputation priorities
  • Accountability systems for employees, contractors, visitors and vulnerable persons
  • Welfare plans covering fatigue, psychosocial support, food and transport
  • Family liaison protocols protecting privacy while providing timely information
  • Occupational health advice incorporated into prolonged response arrangements
  • Shift handover controls maintaining safety and decision continuity

Participants can structure a usable crisis management plan with actionable procedures and records.

  • Plan architecture aligned with ISO 22301 continuity management requirements
  • Activation criteria linked to defined severity levels and authority
  • Action cards designed for crisis director and functional leads
  • Contact directories controlled through ownership, verification and access rules
  • Checklists distinguishing immediate actions from sustained response activities
  • Document control requirements for versions, offline copies and restricted information

Participants can produce time-bound incident action plans with clear objectives and assignments.

  • Incident action plan components: objectives, tactics, resources and safety
  • SMART objectives written for the next operational period
  • Planning P cycle adapted for corporate crisis management teams
  • Resource tracking for specialist staff, facilities, equipment and suppliers
  • Contingency actions assigned against foreseeable plan failure points
  • Action registers monitored through owners, deadlines, status and evidence

Participants can coordinate continuity strategies with crisis response decisions and service priorities.

  • Continuity strategies selected from recovery objectives and resource constraints
  • Workarounds assessed for safety, control effectiveness and customer impact
  • Alternate site activation decisions based on readiness and capacity
  • Supplier continuity evidence tested against contractual service dependencies
  • Manual processing controls protecting records, approvals and transaction integrity
  • Service restoration sequencing agreed with operational and customer leaders

Participants can coordinate executive crisis management during technology and cyber disruption.

  • Cyber incident and business crisis roles separated and connected
  • NIST incident response phases aligned with executive crisis governance
  • Ransomware decisions addressing safety, legal, operational and ethical considerations
  • Technology recovery priorities tied to critical services and data dependencies
  • Out-of-band communications established when corporate systems are unavailable
  • Third-party notification obligations tracked through legal and regulatory requirements

Participants can manage coordinated engagement with regulators, emergency services and external partners.

  • Regulatory notification triggers mapped to incident types and deadlines
  • Liaison officer responsibilities for emergency services and public authorities
  • Joint information arrangements preventing conflicting public statements
  • Evidence preservation requirements following serious safety or environmental events
  • Mutual aid agreements reviewed for authority, mobilisation and reimbursement
  • Community impact concerns incorporated into response objectives and messaging

Participants can design crisis exercises that test leadership decisions, communications and continuity arrangements.

  • Exercise objectives linked to priority risks, plans and capability gaps
  • Tabletop, functional and full-scale exercise formats selected appropriately
  • Inject schedules designed to test decisions, communications and escalation
  • Simulation control cells separating exercise management from participant response
  • Observer guides collecting evidence against predefined performance criteria
  • Safety boundaries and participant welfare controls for realistic simulations

Participants can convert incident and exercise evidence into owned, measurable improvement actions.

  • Hot debriefs capturing observations immediately after response activities
  • After-action reviews distinguishing symptoms, causes and control weaknesses
  • Root cause analysis using five whys and causal factor charts
  • Corrective action plans assigning owners, due dates and assurance evidence
  • Capability maturity assessment for governance, people, plans and exercises
  • Board reports presenting residual risk, progress and unresolved decisions

Participants can govern the transition from crisis response to recovery and restoration.

  • Recovery governance established before emergency response activities conclude
  • Transition criteria separating stabilisation, restoration and longer-term recovery
  • Damage assessment informing prioritised restoration and investment decisions
  • Financial tracking for insurance, emergency expenditure and business interruption
  • Reputation recovery plans linking stakeholder commitments to evidence
  • Return-to-normal decisions tested against safety, quality and control requirements

Participants can assess crisis readiness and defend priority improvements before senior decision-makers.

  • Readiness reviews testing governance, plans, resources and trained personnel
  • Executive challenge questions focused on assumptions, authorities and tolerances
  • Assurance dashboards combining exercises, incidents, actions and capability indicators
  • Gap analysis prioritised by consequence, likelihood and remediation feasibility
  • Investment cases connecting preparedness costs to credible loss exposure
  • Annual review cycles aligned with organisational change and emerging threats

Participants can build, review and present a complete crisis management pack for executive approval.

  • Crisis governance terms of reference with authority and escalation thresholds
  • Scenario-based activation criteria supported by impact and risk evidence
  • Command structure, action cards and functional responsibilities mapped clearly
  • Initial situation report, decision log and incident action plan
  • Stakeholder communications pack including holding statements and approval routes
  • Exercise, assurance and recovery roadmap presented for executive challenge

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Crisis governance terms-of-reference template
  2. Crisis escalation and activation matrix
  3. Incident command structure and action-card set
  4. Decision log and situation-report templates
  5. Crisis communications message-map pack
  6. Exercise evaluation and improvement-plan template

Who should attend

  • Business Continuity Managers — responsible for continuity and crisis arrangements
  • Crisis Management Leads — accountable for command structures and response readiness
  • HSE Directors — coordinating major incident leadership and duty-of-care decisions
  • Security and Resilience Managers — managing threats affecting people, sites and services
  • Operations Directors — protecting critical services during high-consequence disruption
  • Risk and Compliance Leaders — assuring governance, regulatory reporting and corrective action

Skills and tools covered

Crisis governanceIncident commandDecision loggingCrisis communicationsRecovery planningExercise evaluation

Tools and standards

ISO 22361, ISO 22320, ISO 22301, NIST Incident Response Framework

How the course runs

Training methodology

The course uses short technical briefings followed by facilitated case work drawn from industrial incidents, cyber disruption, public-service outages and supply failures. Participants analyse scenario information, establish command arrangements, make timed decisions, draft communications and review each other’s crisis documentation. Simulations introduce uncertainty, conflicting priorities and stakeholder pressure without prescribing a single response. Daily application planning connects methods to participants’ own governance and continuity arrangements. The final capstone requires an executive-standard presentation and peer challenge.

Requirements and prerequisites

Participants should have practical experience in business continuity, emergency response, HSE, security, operational resilience, risk or incident management. They should understand their organisation’s critical services, key stakeholders and existing escalation arrangements, and be comfortable discussing senior leadership decisions. Previous involvement in an incident, exercise, continuity plan review or emergency response programme is useful. This is not an introductory course on risk management or first aid. Formal certification in ISO standards, emergency services command training, media training or specialist security qualifications is not required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should already work with continuity, crisis, HSE, security, operations, risk or incident arrangements. The course assumes familiarity with organisational processes and senior stakeholder expectations, but does not require formal ISO certification.

Bring a current crisis plan, continuity plan, escalation procedure or exercise report if organisational policy permits. These materials help participants adapt the course tools to real arrangements while keeping sensitive details confidential.

It suits senior practitioners who design, own, assure or advise crisis management arrangements. It is also relevant for operational leaders who may join a crisis management team during a major event.

Business continuity training concentrates on maintaining and restoring priority activities, while emergency response training focuses on immediate operational actions. This masterclass concentrates on senior crisis leadership, governance, decisions, communications and coordinated recovery.

Participants leave with templates and a crisis management pack adapted to a selected scenario or workplace need. The pack can support plan revision, leadership briefings, exercise design and assurance reviews.

The first week establishes governance, assessment, command, decisions and communications, then participants begin building their own materials. The second week develops continuity coordination, cyber and external engagement, exercises, recovery and executive presentation through the final capstone.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Business Continuity