The first public statement in a crisis gets drafted under more time pressure than almost any other piece of corporate communication, and it's disproportionately consequential — it sets the frame everything afterward gets read against.
What the first statement is actually for
Not to resolve the crisis. To acknowledge it accurately, establish that it's being taken seriously, and buy the time needed to gather facts without that silence itself becoming the story. A first statement that tries to fully explain or resolve the situation before the facts are confirmed is the single most common mistake — it commits to details that sometimes turn out wrong, and a correction after the fact costs more credibility than the original gap.
The structure that holds up
Acknowledge what's confirmed, plainly. State what's known to be true without embellishment or minimisation.
State what's being done, specifically. "We are investigating" is weaker than "We have engaged [specific action] and expect to share more by [specific time]." Specificity signals competence; vagueness signals scrambling.
Commit to a follow-up, and a real one. A stated timeline for the next update — and actually meeting it — does more for credibility than any single line in the first statement.
Address who's affected, first. Before reputation management, before legal positioning — a statement that reads as primarily concerned with the company's image rather than the people affected damages trust faster than the underlying incident usually does.
What to leave open
Anything not yet confirmed. Cause, blame, financial impact, personnel consequences — these belong in later statements once verified, not guessed at in the first one under time pressure. "We don't yet know X, and we will share it once we do" is a stronger sentence than an unconfirmed guess at X.
A first statement that turns out to be wrong on a factual point does more damage than a first statement that honestly says a fact isn't confirmed yet.
Phrases that make it worse
"We take this extremely seriously" without a specific accompanying action reads as boilerplate. "This does not reflect our values" reads as distancing rather than addressing. Legal-driven language — passive voice, hedged qualifiers, no clear subject taking responsibility for the response — is detectable to any audience with modern media literacy and reads as evasive even when the underlying legal caution is reasonable.
After the first hour
The first statement is one step in a sequence, not the whole response. Our first-48-hours crisis playbook covers the full sequence from the initial statement through the following days, including the specific mistakes that turn a contained incident into a permanent search result.