Who is actually in charge when everything changes?

Who is actually in charge when everything changes?

A crisis creates competing clocks: safety, operations, customers, regulators, finance and reputation all demand decisions. If authority remains distributed exactly as in normal business, teams will optimise their own problem while the organisation loses control of the whole.

Define command before the event. One incident leader should own priorities, trade-offs and the operating rhythm, supported by accountable leads for operations, technology, people, communications, legal and finance. Specify activation levels, delegated spending and shutdown authority, succession and the decisions reserved for executives or the board.

Create one common operating picture: confirmed facts, assumptions, impact, actions, owners, deadlines and decisions required. Time-stamp every update and maintain a decision log with rationale. A regular cadence of briefings and written situation reports is more valuable than continuous meetings where different teams hear different versions of reality.

Preserve challenge without multiplying command. Technical and risk specialists should surface uncertainty and dissent; the incident leader integrates it and decides. Separate response from independent oversight where necessary, but make escalation paths fast. CISA�s 2025 crisis-management guidance links plans, communication protocols, clear roles and exercises because authority that exists only on paper is unreliable.

Test the structure through scenarios with absent leaders, incomplete data and cross-functional conflict. Measure decision latency, reversed decisions, duplicate work and unresolved actions. Crisis governance works when people know who can decide, what evidence that person needs and how the organisation will execute�even as the facts continue to move.