{"id":2794,"date":"2026-09-28T13:21:01","date_gmt":"2026-09-28T13:21:01","guid":{"rendered":"https:\/\/www.epw.com\/blog\/?p=2794"},"modified":"2026-09-28T18:38:18","modified_gmt":"2026-09-28T18:38:18","slug":"build-crisis-governance-structure","status":"publish","type":"post","link":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure","title":{"rendered":"How to Build a Crisis Governance Structure for Business Continuity"},"content":{"rendered":"<p class=\"epw-featured-image-caption\"><em>AI-generated illustration created to represent the article\u2019s subject. It does not depict an actual EPW course, trainer, participant, client, event or venue.<\/em><\/p>\n<p><!-- EPW ARTICLE PRODUCTION RECORD\nCourse code: AUD103\nCourse: Business Continuity Risk and Crisis Governance\nCategory: Auditing, Governance, and Risk Compliance Training Courses\nPrimary article type: How-To\nSelection method: The first random unused selection, Career \/ Certification \/ Training, was rejected because an existing WordPress draft serves that intent. Commercial \/ Course-Focused was also rejected for the same reason. A fresh random draw from the remaining unused types selected How-To.\nWorkflow status: Drafted \u2014 not published\nDraft date: 2026-09-10\nPrimary query: how to build a crisis governance structure\nSearch intent: Practical informational\nFocus keyphrase: build a crisis governance structure\nSEO title: How to Build a Crisis Governance Structure for Business Continuity\nSlug: build-crisis-governance-structure\nMeta description: Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.\nExcerpt: A practical nine-step method for building crisis governance that connects strategic authority, operational response, business continuity, communication, recovery and assurance.\nWordPress category: Auditing, Governance, and Risk Compliance Articles\nTags: None required\nSchema: BlogPosting\nDuplicate-control record: The complete WordPress Posts list was searched across Published and Draft statuses for the exact title, how to build a crisis governance structure, crisis governance structure business continuity, close variants and overlapping intent. Existing articles cover business-continuity risk types, risk-assessment guides, crisis decision-making and broad training choices; none provides this end-to-end governance-structure method.\nReviewer requirement: A qualified business-continuity, crisis-management, legal, safety, security or risk reviewer should adapt the structure to the organisation\u2019s jurisdiction, hazards, regulatory duties and emergency-service interfaces before publication.\n--><\/p>\n<p><strong>To build a crisis governance structure, define the outcomes that must be protected, assign strategic, tactical and operational decision rights, establish activation and escalation thresholds, create a verified information process, connect crisis leadership to business continuity and recovery, and test the whole arrangement through exercises and independent assurance.<\/strong><\/p>\n<p>A crisis structure should make decisions faster without abandoning accountability. It must answer six questions under pressure: who leads, what they can decide, what information they need, how priorities are set, who communicates, and how the organisation moves from response to sustained recovery.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd0808;color:#dd0808\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd0808;color:#dd0808\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Key_takeaways\" >Key takeaways<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#What_is_a_crisis_governance_structure\" >What is a crisis governance structure?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#How_to_build_a_crisis_governance_structure_in_nine_steps\" >How to build a crisis governance structure in nine steps<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#1_Define_protected_outcomes_and_scope\" >1. Define protected outcomes and scope<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#2_Set_governance_principles\" >2. Set governance principles<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#3_Create_three_decision_levels\" >3. Create three decision levels<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#4_Assign_roles_deputies_and_decision_rights\" >4. Assign roles, deputies and decision rights<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#5_Establish_activation_escalation_and_stand-down_criteria\" >5. Establish activation, escalation and stand-down criteria<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#6_Design_the_information_system\" >6. Design the information system<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#7_Connect_continuity_response_and_recovery\" >7. Connect continuity, response and recovery<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#8_Build_stakeholder_and_communication_governance\" >8. Build stakeholder and communication governance<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#9_Resource_exercise_and_assure_the_structure\" >9. Resource, exercise and assure the structure<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Crisis_roles_and_decision_rights\" >Crisis roles and decision rights<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#The_minimum_crisis_information_pack\" >The minimum crisis information pack<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Worked_example_loss_of_a_critical_service_provider\" >Worked example: loss of a critical service provider<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#How_to_test_and_assure_crisis_governance\" >How to test and assure crisis governance<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Crisis_governance_checklist\" >Crisis governance checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Build_business_continuity_and_crisis-governance_capability\" >Build business continuity and crisis-governance capability<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Conclusion\" >Conclusion<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\/#Sources_and_References\" >Sources and References<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Key_takeaways\"><\/span>Key takeaways<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Build the structure around decisions and outcomes, not job titles alone.<\/li>\n<li>Separate strategic direction from tactical co-ordination and operational command.<\/li>\n<li>Activation criteria, delegated authority and escalation triggers should be agreed before an incident.<\/li>\n<li>Business continuity plans supply service priorities and recovery options to the crisis team.<\/li>\n<li>Exercises must test authority, information, handovers, communications and recovery\u2014not merely plan recall.<\/li>\n<\/ul>\n<nav aria-label=\"Table of contents\">\n<p><strong>Contents<\/strong><\/p>\n<ul>\n<li><a href=\"#meaning\">What crisis governance means<\/a><\/li>\n<li><a href=\"#steps\">Nine steps to build the structure<\/a><\/li>\n<li><a href=\"#roles\">Roles and decision rights<\/a><\/li>\n<li><a href=\"#information\">Information and communication design<\/a><\/li>\n<li><a href=\"#example\">Worked example<\/a><\/li>\n<li><a href=\"#testing\">Exercises and assurance<\/a><\/li>\n<li><a href=\"#checklist\">Governance checklist<\/a><\/li>\n<\/ul>\n<\/nav>\n<h2 id=\"meaning\"><span class=\"ez-toc-section\" id=\"What_is_a_crisis_governance_structure\"><\/span>What is a crisis governance structure?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A crisis governance structure is the temporary but pre-authorised system used to direct, co-ordinate and control an organisation\u2019s response to a severe, uncertain and consequential situation. It links the governing body and senior leaders with incident management, business continuity, specialist advice, stakeholder communication and recovery.<\/p>\n<p>Crisis governance is wider than emergency response. Emergency teams may protect life, property or a technical environment. Business-continuity teams maintain priority products and services. The crisis team integrates those efforts, resolves cross-functional trade-offs, protects legitimacy and decides how the organisation will recover.<\/p>\n<p><a href=\"https:\/\/www.iso.org\/standard\/75106.html\">ISO 22301:2019<\/a> describes a business continuity management system as a framework for planning, implementing, operating, monitoring, reviewing, maintaining and continually improving the organisation\u2019s ability to protect against, reduce the likelihood of and recover from disruptive incidents. That management-system logic is important: crisis arrangements require leadership, resources, evidence, evaluation and improvement, not only a response plan.<\/p>\n<h2 id=\"steps\"><span class=\"ez-toc-section\" id=\"How_to_build_a_crisis_governance_structure_in_nine_steps\"><\/span>How to build a crisis governance structure in nine steps<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"1_Define_protected_outcomes_and_scope\"><\/span>1. Define protected outcomes and scope<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Identify what the organisation must protect: people, essential services, legal obligations, customers, data, assets, cash, reputation and public trust. Define which entities, sites, services, outsourced activities and jurisdictions are in scope. A structure designed only around headquarters may fail when authority, operations or stakeholders are distributed.<\/p>\n<p>Translate broad aims into priorities that can guide decisions. \u201cMaintain operations\u201d is too vague. \u201cProtect life, continue the emergency customer channel, meet statutory notification duties and restore priority payments within the approved time objective\u201d is decision-ready.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Set_governance_principles\"><\/span>2. Set governance principles<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Agree the principles that apply when facts are incomplete: protect life; comply with law; use the lowest appropriate decision level; escalate cross-boundary consequences; document material decisions; communicate verified information; and preserve options for recovery. Principles provide consistency when a plan cannot predict the event.<\/p>\n<p>The UK Cabinet Office\u2019s <a href=\"https:\/\/www.gov.uk\/guidance\/emergency-response-and-recovery\">Emergency response and recovery guidance<\/a> identifies anticipation, preparedness, subsidiarity, direction, information, integration, co-operation and continuity as underpinning principles. Although written for UK responders, these concepts provide a useful challenge for organisational design when adapted to the relevant jurisdiction.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Create_three_decision_levels\"><\/span>3. Create three decision levels<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Use distinct but connected levels:<\/p>\n<ul>\n<li><strong>Strategic:<\/strong> sets the aim, approves major trade-offs, allocates exceptional resources, engages the board and owns high-consequence external decisions.<\/li>\n<li><strong>Tactical:<\/strong> co-ordinates functions, converts the strategic aim into objectives, resolves dependencies and manages the common operating picture.<\/li>\n<li><strong>Operational:<\/strong> controls activity at the incident, service, site or technical level within delegated authority.<\/li>\n<\/ul>\n<p>The labels can vary. The important point is to prevent senior leaders from micromanaging tasks while operational teams make strategic commitments without authority.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Assign_roles_deputies_and_decision_rights\"><\/span>4. Assign roles, deputies and decision rights<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Name a crisis director, co-ordinator, information lead, continuity lead, communications lead, legal or compliance adviser, people lead, security or safety lead, technology lead and recovery lead as relevant. Every critical role needs a trained deputy and a handover method.<\/p>\n<p>Use a decision-rights schedule that states who may close a site, suspend a service, notify a regulator, make a public statement, approve emergency expenditure, share sensitive information, invoke a supplier contingency, accept temporary risk and declare transition to recovery. Record consultation requirements without creating approval chains that are too slow for the risk.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Establish_activation_escalation_and_stand-down_criteria\"><\/span>5. Establish activation, escalation and stand-down criteria<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Activation should depend on consequences and co-ordination needs, not on a perfect diagnosis. Possible triggers include risk to life, loss of a priority service beyond tolerance, material data compromise, multi-site impact, regulatory notification, intense stakeholder concern, resource conflict or uncertainty that exceeds normal management capacity.<\/p>\n<p>Define who can activate the team, how members are alerted, the initial meeting deadline and the minimum quorum. Escalation triggers should identify when the board, parent entity, insurer, authority, customer or emergency service must be engaged. Stand-down criteria should confirm ownership of residual issues and continuing monitoring.<\/p>\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132014\/crisis-governance-three-level-structure.webp\" alt=\"Three-level crisis governance structure for strategic tactical and operational decisions\" class=\"wp-image-3693 alignnone size-full\" width=\"1200\" height=\"900\" style=\"max-width:100%;height:auto\" srcset=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132014\/crisis-governance-three-level-structure.webp 1200w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132014\/crisis-governance-three-level-structure-300x225.webp 300w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132014\/crisis-governance-three-level-structure-1024x768.webp 1024w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132014\/crisis-governance-three-level-structure-768x576.webp 768w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><figcaption>Distinct decision levels reduce duplication while preserving escalation and delegated authority.<\/figcaption><\/figure>\n<h3><span class=\"ez-toc-section\" id=\"6_Design_the_information_system\"><\/span>6. Design the information system<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Create one common operating picture with time-stamped facts, assumptions, unknowns, impacts, actions, decisions and forecasts. Assign sources and confidence levels. Separate the situation report from the decision log: one describes the current picture; the other records options, rationale, authority and follow-up.<\/p>\n<p>Define update frequency, access control, alternative communication channels and records retention. Leaders should receive concise information that supports decisions, while operational teams need detailed task and dependency data. The information lead should challenge unverified claims and reconcile conflicting sources.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"7_Connect_continuity_response_and_recovery\"><\/span>7. Connect continuity, response and recovery<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The crisis team needs outputs from business impact analysis: priority activities, maximum tolerable disruption, recovery time objectives, minimum resources, dependencies and workarounds. It should also know the limitations of each continuity option.<\/p>\n<p>Define transition points between immediate response, continuity operation and recovery. Recovery should begin while response is active, because temporary workarounds can create financial, safety, conduct and control risks. The <a href=\"https:\/\/www.gov.uk\/government\/publications\/the-uk-government-resilience-framework\">UK Government Resilience Framework<\/a> emphasises strengthening the systems and capabilities that support collective resilience; the organisational equivalent is to connect risk understanding, preparedness, response capability and learning rather than maintain isolated plans.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"8_Build_stakeholder_and_communication_governance\"><\/span>8. Build stakeholder and communication governance<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Map employees, customers, regulators, emergency services, suppliers, insurers, communities, media and governing bodies. For each, define accountable owner, information need, channel, approval route and timing. Pre-approved holding statements can accelerate initial communication, but they must never substitute for verified, incident-specific facts.<\/p>\n<p>One spokesperson does not mean one communication team. Legal, operations, people and customer functions should feed a common message process. Track what was said, to whom, by whom and when. Correct material errors openly and quickly.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"9_Resource_exercise_and_assure_the_structure\"><\/span>9. Resource, exercise and assure the structure<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Provide secure meeting facilities, collaboration tools, contact data, alternates, emergency spending, specialist advisers and resilient communications. Training should cover role decisions and information discipline rather than plan memorisation.<\/p>\n<p>Use a progressive exercise programme: notification tests, role walkthroughs, decision exercises, technical simulations and multi-party scenarios. Capture actions with owners and deadlines. The <a href=\"https:\/\/www.ncsc.gov.uk\/collection\/incident-management\">UK National Cyber Security Centre\u2019s incident-management guidance<\/a> is a useful specialist reference for preparing response capability to cyber incidents, but cyber playbooks should connect to the organisation-wide crisis structure when consequences extend beyond technology.<\/p>\n<h2 id=\"roles\"><span class=\"ez-toc-section\" id=\"Crisis_roles_and_decision_rights\"><\/span>Crisis roles and decision rights<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table>\n<thead>\n<tr>\n<th>Role<\/th>\n<th>Primary accountability<\/th>\n<th>Typical decisions<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Board or governing body<\/td>\n<td>Oversight of resilience and management response<\/td>\n<td>Challenge material risk, approve extraordinary strategic changes, oversee recovery<\/td>\n<\/tr>\n<tr>\n<td>Crisis director<\/td>\n<td>Strategic aim and integrated decisions<\/td>\n<td>Priorities, resource trade-offs, major stakeholder commitments, risk acceptance<\/td>\n<\/tr>\n<tr>\n<td>Crisis co-ordinator<\/td>\n<td>Team rhythm and decision process<\/td>\n<td>Agenda, action tracking, escalation, handovers and meeting cadence<\/td>\n<\/tr>\n<tr>\n<td>Information lead<\/td>\n<td>Common operating picture<\/td>\n<td>Evidence standards, situation reports, uncertainty and information gaps<\/td>\n<\/tr>\n<tr>\n<td>Continuity lead<\/td>\n<td>Priority service continuity<\/td>\n<td>Workarounds, recovery sequence, resource dependencies and service restoration<\/td>\n<\/tr>\n<tr>\n<td>Communications lead<\/td>\n<td>Coherent stakeholder information<\/td>\n<td>Message timing, channels, spokesperson support and correction of errors<\/td>\n<\/tr>\n<tr>\n<td>Legal or compliance adviser<\/td>\n<td>Obligations and defensibility<\/td>\n<td>Notification duties, privilege where applicable, record preservation and constraints<\/td>\n<\/tr>\n<tr>\n<td>Recovery lead<\/td>\n<td>Transition and sustainable restoration<\/td>\n<td>Recovery structure, exit from workarounds, remediation and lessons<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Specialists advise; accountable leaders decide. Where a specialist has statutory or professional authority, document that boundary explicitly. Internal audit should normally remain independent rather than take operational command.<\/p>\n<h2 id=\"information\"><span class=\"ez-toc-section\" id=\"The_minimum_crisis_information_pack\"><\/span>The minimum crisis information pack<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>strategic aim and current objectives;<\/li>\n<li>verified incident summary and timeline;<\/li>\n<li>people, service, legal, financial and stakeholder impacts;<\/li>\n<li>priority activities and recovery tolerances;<\/li>\n<li>assumptions, unknowns and confidence levels;<\/li>\n<li>options with consequences and constraints;<\/li>\n<li>decision log and unresolved escalations;<\/li>\n<li>action owners, deadlines and dependencies;<\/li>\n<li>communications issued and planned;<\/li>\n<li>forecast for the next operational period.<\/li>\n<\/ul>\n<p>Avoid dashboards that look precise but conceal uncertainty. Time-stamp every material figure, state the source and show where information is provisional.<\/p>\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132018\/crisis-common-operating-picture-template.webp\" alt=\"Crisis common operating picture with facts impacts decisions actions and unknowns\" class=\"wp-image-3694 alignnone size-full\" width=\"1200\" height=\"900\" style=\"max-width:100%;height:auto\" srcset=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132018\/crisis-common-operating-picture-template.webp 1200w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132018\/crisis-common-operating-picture-template-300x225.webp 300w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132018\/crisis-common-operating-picture-template-1024x768.webp 1024w, https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28132018\/crisis-common-operating-picture-template-768x576.webp 768w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><figcaption>A concise, time-stamped operating picture keeps decisions connected to verified evidence and uncertainty.<\/figcaption><\/figure>\n<h2 id=\"example\"><span class=\"ez-toc-section\" id=\"Worked_example_loss_of_a_critical_service_provider\"><\/span>Worked example: loss of a critical service provider<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A cloud provider suffers a regional outage that stops a customer service platform. Operational technology teams begin failover. The tactical team co-ordinates customer operations, data, suppliers, staffing and regulatory assessment. The crisis director sets three priorities: protect affected customers, restore the minimum viable service within tolerance and communicate verified facts.<\/p>\n<p>The information lead records that the cause is unknown, the failover estimate has medium confidence and one customer channel remains available. The continuity lead compares manual and alternative-platform options. Legal and compliance advisers identify notification thresholds. Communications prepares messages for employees, customers and key clients using the same verified timeline.<\/p>\n<p>When recovery exceeds tolerance, the crisis director approves emergency capacity and invokes the contractual escalation route. A recovery lead is appointed before service restoration to govern backlog, data reconciliation, temporary access and control exceptions. Stand-down occurs only when priority services are stable, residual actions have owners and the board has received the initial review.<\/p>\n<h2 id=\"testing\"><span class=\"ez-toc-section\" id=\"How_to_test_and_assure_crisis_governance\"><\/span>How to test and assure crisis governance<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Exercises should test observable performance:<\/p>\n<ul>\n<li>Was the team activated within the target time?<\/li>\n<li>Did members understand their authority and escalation duties?<\/li>\n<li>Were facts distinguished from assumptions?<\/li>\n<li>Did the strategic aim guide conflicting priorities?<\/li>\n<li>Were continuity options based on current dependency and tolerance data?<\/li>\n<li>Were stakeholders informed accurately and at the right time?<\/li>\n<li>Did shift handovers preserve decisions, uncertainty and actions?<\/li>\n<li>Was recovery governance established early enough?<\/li>\n<\/ul>\n<p>Management owns remediation. Internal audit may evaluate design, exercise evidence and improvement tracking while preserving independence. The <a href=\"https:\/\/www.theiia.org\/en\/standards\/2024-standards\/global-internal-audit-standards\/\">Global Internal Audit Standards<\/a> support systematic planning, evidence-based conclusions, communication and monitoring of action plans.<\/p>\n<h2 id=\"checklist\"><span class=\"ez-toc-section\" id=\"Crisis_governance_checklist\"><\/span>Crisis governance checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Protected outcomes and priority services are explicit.<\/li>\n<li>Strategic, tactical and operational decisions are separated.<\/li>\n<li>Every critical role has a deputy and handover process.<\/li>\n<li>Activation, escalation, regulatory notification and stand-down criteria are documented.<\/li>\n<li>Delegated authority covers emergency spending, service suspension and risk acceptance.<\/li>\n<li>A common operating picture and decision log have named owners.<\/li>\n<li>Continuity strategies, supplier dependencies and recovery tolerances are current.<\/li>\n<li>Stakeholder communication uses verified facts and recorded approvals.<\/li>\n<li>Exercises test decisions, information flow and recovery transition.<\/li>\n<li>Lessons become funded actions with deadlines and independent follow-up.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Build_business_continuity_and_crisis-governance_capability\"><\/span>Build business continuity and crisis-governance capability<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Explore EPW\u2019s <a href=\"https:\/\/www.epw.com\/courses\/auditing-governance-and-risk-compliance\">Auditing, Governance, and Risk Compliance Training Courses<\/a>. Related programmes include <a href=\"https:\/\/www.epw.com\/training\/enterprise-risk-management-frameworks-and-strategies\">Enterprise Risk Management Frameworks and Strategies<\/a> and <a href=\"https:\/\/www.epw.com\/training\/third-party-risk-management-and-due-diligence\">Third Party Risk Management and Due Diligence<\/a>.<\/p>\n<p>To practise crisis structures, continuity priorities, scenario analysis, decision rights, communication and recovery governance, review EPW\u2019s <a href=\"https:\/\/www.epw.com\/training\/business-continuity-risk-and-crisis-governance\"><strong>Business Continuity Risk and Crisis Governance course<\/strong><\/a>. View current dates and locations or request a tailored in-house programme.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A sound crisis structure converts urgency into disciplined action. Define the outcomes, separate decision levels, delegate authority, establish activation triggers, build a verified information process and connect response with continuity and recovery. Then test the structure until people can use it under pressure without relying on improvisation or a single individual.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Sources_and_References\"><\/span>Sources and References<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ol>\n<li>International Organization for Standardization. <em>ISO 22301:2019 Security and resilience \u2014 Business continuity management systems \u2014 Requirements<\/em>. Published October 2019; Amendment 1 published 2024. Accessed 10 September 2026. <a href=\"https:\/\/www.iso.org\/standard\/75106.html\">https:\/\/www.iso.org\/standard\/75106.html<\/a><\/li>\n<li>UK Cabinet Office. <em>Emergency response and recovery<\/em>. Published 20 February 2013. Accessed 10 September 2026. <a href=\"https:\/\/www.gov.uk\/guidance\/emergency-response-and-recovery\">https:\/\/www.gov.uk\/guidance\/emergency-response-and-recovery<\/a><\/li>\n<li>UK Cabinet Office. <em>The UK Government Resilience Framework<\/em>. Published 19 December 2022; updated 4 December 2023. Accessed 10 September 2026. <a href=\"https:\/\/www.gov.uk\/government\/publications\/the-uk-government-resilience-framework\">https:\/\/www.gov.uk\/government\/publications\/the-uk-government-resilience-framework<\/a><\/li>\n<li>UK National Cyber Security Centre. <em>Incident management guidance<\/em>. Accessed 10 September 2026. <a href=\"https:\/\/www.ncsc.gov.uk\/collection\/incident-management\">https:\/\/www.ncsc.gov.uk\/collection\/incident-management<\/a><\/li>\n<li>The Institute of Internal Auditors. <em>Global Internal Audit Standards<\/em>, 2024 edition, effective 9 January 2025. Accessed 10 September 2026. <a href=\"https:\/\/www.theiia.org\/en\/standards\/2024-standards\/global-internal-audit-standards\/\">https:\/\/www.theiia.org\/en\/standards\/2024-standards\/global-internal-audit-standards\/<\/a><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>A practical nine-step method for building crisis governance that connects strategic authority, operational response, business continuity, communication, recovery and assurance.<\/p>\n","protected":false},"author":1,"featured_media":3696,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-2794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-auditing-governance-and-risk-compliance-articles"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Build a Crisis Governance Structure for Business Continuity<\/title>\n<meta name=\"description\" content=\"Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Build a Crisis Governance Structure for Business Continuity\" \/>\n<meta property=\"og:description\" content=\"Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\" \/>\n<meta property=\"og:site_name\" content=\"Blog Categories - EPW Training\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-28T13:21:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-28T18:38:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"576\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"EPW Training Blog\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"EPW Training Blog\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\"},\"author\":{\"@type\":\"Organization\",\"name\":\"EPW Training Blog\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"headline\":\"How to Build a Crisis Governance Structure for Business Continuity\",\"datePublished\":\"2026-09-28T13:21:01+00:00\",\"dateModified\":\"2026-09-28T18:38:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\"},\"wordCount\":2020,\"publisher\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp\",\"articleSection\":[\"Auditing, Governance, and Risk Compliance Articles\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\",\"url\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\",\"name\":\"How to Build a Crisis Governance Structure for Business Continuity\",\"isPartOf\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp\",\"datePublished\":\"2026-09-28T13:21:01+00:00\",\"dateModified\":\"2026-09-28T18:38:18+00:00\",\"description\":\"Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage\",\"url\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp\",\"contentUrl\":\"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp\",\"width\":1024,\"height\":576,\"caption\":\"Professionals coordinating a crisis response in a business continuity operations room\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.epw.com\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Build a Crisis Governance Structure for Business Continuity\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.epw.com\/blog\/#website\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"name\":\"Blog Categories - EPW Training\",\"description\":\"Expert Insights and Updates in Professional Training\",\"publisher\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.epw.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.epw.com\/blog\/#organization\",\"name\":\"Blog Categories - EPW Training\",\"url\":\"https:\/\/www.epw.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png\",\"contentUrl\":\"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png\",\"width\":746,\"height\":256,\"caption\":\"Blog Categories - EPW Training\"},\"image\":{\"@id\":\"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.epw.com\/blog\/#person\",\"name\":\"EPW Training Blog\",\"sameAs\":[\"https:\/\/www.epw.com\/blog\/\"],\"url\":\"https:\/\/www.epw.com\/blog\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Build a Crisis Governance Structure for Business Continuity","description":"Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure","og_locale":"en_US","og_type":"article","og_title":"How to Build a Crisis Governance Structure for Business Continuity","og_description":"Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.","og_url":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure","og_site_name":"Blog Categories - EPW Training","article_published_time":"2026-09-28T13:21:01+00:00","article_modified_time":"2026-09-28T18:38:18+00:00","og_image":[{"width":1024,"height":576,"url":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp","type":"image\/webp"}],"author":"EPW Training Blog","twitter_card":"summary_large_image","twitter_misc":{"Written by":"EPW Training Blog","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#article","isPartOf":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure"},"author":{"@type":"Organization","name":"EPW Training Blog","url":"https:\/\/www.epw.com\/blog\/","@id":"https:\/\/www.epw.com\/blog\/#organization"},"headline":"How to Build a Crisis Governance Structure for Business Continuity","datePublished":"2026-09-28T13:21:01+00:00","dateModified":"2026-09-28T18:38:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure"},"wordCount":2020,"publisher":{"@id":"https:\/\/www.epw.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage"},"thumbnailUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp","articleSection":["Auditing, Governance, and Risk Compliance Articles"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure","url":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure","name":"How to Build a Crisis Governance Structure for Business Continuity","isPartOf":{"@id":"https:\/\/www.epw.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage"},"image":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage"},"thumbnailUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp","datePublished":"2026-09-28T13:21:01+00:00","dateModified":"2026-09-28T18:38:18+00:00","description":"Build a crisis governance structure with clear authority, escalation, decision rights, information flows, continuity priorities, exercises and assurance.","breadcrumb":{"@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#primaryimage","url":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp","contentUrl":"https:\/\/assets.epw.com\/blog\/wp-content\/uploads\/2026\/09\/28183425\/build-crisis-governance-structure-featured.webp","width":1024,"height":576,"caption":"Professionals coordinating a crisis response in a business continuity operations room"},{"@type":"BreadcrumbList","@id":"https:\/\/www.epw.com\/blog\/auditing-governance-and-risk-compliance-articles\/build-crisis-governance-structure#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.epw.com\/blog"},{"@type":"ListItem","position":2,"name":"How to Build a Crisis Governance Structure for Business Continuity"}]},{"@type":"WebSite","@id":"https:\/\/www.epw.com\/blog\/#website","url":"https:\/\/www.epw.com\/blog\/","name":"Blog Categories - EPW Training","description":"Expert Insights and Updates in Professional Training","publisher":{"@id":"https:\/\/www.epw.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.epw.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.epw.com\/blog\/#organization","name":"Blog Categories - EPW Training","url":"https:\/\/www.epw.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png","contentUrl":"https:\/\/www.epw.com\/blog\/wp-content\/uploads\/2025\/08\/epw-training-blog-logo.png","width":746,"height":256,"caption":"Blog Categories - EPW Training"},"image":{"@id":"https:\/\/www.epw.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.epw.com\/blog\/#person","name":"EPW Training Blog","sameAs":["https:\/\/www.epw.com\/blog\/"],"url":"https:\/\/www.epw.com\/blog\/"}]}},"_links":{"self":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/2794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/comments?post=2794"}],"version-history":[{"count":3,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/2794\/revisions"}],"predecessor-version":[{"id":3698,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/posts\/2794\/revisions\/3698"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/media\/3696"}],"wp:attachment":[{"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/media?parent=2794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/categories?post=2794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.epw.com\/blog\/wp-json\/wp\/v2\/tags?post=2794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}