A customer posts a short video of a faulty product late at night. By morning it sits in three Telegram channels and a forum thread. By lunch a reporter emails for comment, and your team is reading about it for the first time.
Most PR crises do not arrive as a headline. They start as a handful of posts that nobody was watching. The gap between the first post and the first reporter call is where you win or lose control of the story.
This is a playbook to run, not an essay to read. Set it up on a quiet week, then follow it hour by hour when an alert fires. Every threshold here is illustrative, so tune it to your brand.
The playbook at a glance
Crisis work moves through four stages. The faster you get through the first two, the more options you keep in the last two.
Here is what that looks like on the clock, from the moment an alert fires.
- Hour 0 An alert fires. The rota owner opens the posts behind it, reads what people are actually saying and picks a triage level within minutes.
- Hour 1 At respond or escalate, the owner starts a shared tracking doc, wakes the people on the escalation list and publishes a holding statement if the story is spreading.
- Hours 2–6 Review volume, sentiment, top posts and new sources every hour. Watch for the jump from niche channels to news sites. Keep replies on your own accounts consistent.
- Day 1 Publish the full statement once facts are confirmed. Brief spokespeople, answer media queries and correct false claims with one approved wording.
- Week 1 When volume and sentiment are back near baseline, stand the team down and run a post-mortem within a week or two.
Before a crisis: the setup checklist
You cannot build monitoring in the middle of a crisis. Tick these off while things are quiet.
- Risk queries for brand, executives, products and locations, in every language your customers use
- Baselines recorded for volume, negative share and usual sources
- Volume, negativity and keyword alerts set and tested
- Alerts routed to a channel the owner sees out of hours
- Owner rota covering evenings, weekends and holidays, with a backup per slot
- Escalation list with phone numbers: head of comms, legal, statement sign-off
- Two or three holding statements drafted and pre-approved
Build risk queries
Build separate queries, or themes, for each kind of risk. That way an alert tells you what moved, not only that something did.
- Brand plus risk words. Pair your brand with words like "recall", "lawsuit", "poisoning", "fraud", "leak", "boycott", "refund" and "strike", in every language your customers use.
- Executives. Track your CEO and spokespeople by name, including misspellings and transliterations.
- Products. Add product names, model numbers and the nicknames customers actually use.
- Locations. Add your stores, plants, offices and cities, combined with your brand.
Record baselines and set alerts
A spike only means something against a normal level. Before you set any alert, look at a few weeks of history for each query: mentions per hour and per day, the usual negative share, and which sources normally talk about you. Note seasonal peaks such as a holiday weekend or a results day.
Then start with three alerts and tune later:
- Volume alerts when mentions run well above baseline, for example double the usual hourly level.
- Negativity alerts when the negative share climbs noticeably above normal.
- Keyword alerts for any mention that pairs your brand with a high-risk word.
Email works in office hours. A messenger channel works better at night and on weekends.
Pre-approve holding statements
A holding statement buys you time without saying anything you may regret. Write two or three for your likely scenarios, such as a product fault, a data issue or a staff incident, and get them signed off now.
A good one acknowledges the issue, says you are looking into it, tells people what to do now and promises an update by a set time. Use this template:
We are aware of reports about [issue]. We are investigating and will share an update by [time]. If you are affected, please contact [channel].
Signals that should wake you up
A crisis signal is any change suggesting a story about you is growing faster or angrier than normal. One signal proves little. Two or three together deserve a closer look.
Volume spike
Mentions jump well above your usual level for that hour. A launch can do the same, so read what people say, not only how many.
Negativity spike
The negative share rises while volume stays flat. This is often the earlier warning.
One high-reach post
A large account, popular channel or known commentator can do more damage than a hundred small posts.
A journalist query
The story has already reached a newsroom. Check whether it links back to something circulating online.
Niche to mainstream
The same claim appears on a larger or more general outlet than before. The story is climbing.
Images with no text
A photo or video names you only on screen or out loud. Keyword search misses it. See image and video monitoring.
Triage: watch, respond or escalate
When an alert fires, the owner's first job is to decide how serious it is. Use written criteria so two people on the rota would make the same call.
| Level | Typical criteria | What you do | Who is involved |
|---|---|---|---|
| Watch | Above baseline but limited to a few small accounts. No media interest. No safety, legal or data angle. | Check again within a few hours. Note the posts and authors. Ready a holding statement. | Alert owner |
| Respond | Negativity growing, a mid-sized account or channel has picked it up, or customers ask you directly. Still mostly social and niche channels. | Reply on your own accounts. Publish a short statement if needed. Check in at least hourly. | Owner, head of comms, customer service |
| Escalate | A high-reach post, a journalist query, news coverage, or any safety, legal, data or executive conduct angle. | Convene the crisis team. Approve and publish a full statement. Brief spokespeople. | Head of comms, legal, executive sponsor, business owner |
Hours 1–6: track, follow, coordinate
Track six numbers every hour
At respond or escalate, review a short set of numbers every hour in one shared doc, so everyone sees the same picture.
- Volume: mentions this hour against baseline and the previous hour.
- Sentiment: the negative share, and whether it is rising or easing.
- Top posts: the five with the most reach, and who posted them.
- New sources: any outlet or channel picking up the story for the first time.
- Key claims: what people say happened, and which claims are false.
- Your replies: what you published, where, and how people reacted.
Watch where the story jumps
Stories rarely stay where they start. A forum complaint gets screenshotted into a Telegram channel, a big channel gets quoted by a news site, and other sites pick it up. Each jump widens the audience. Watch for three moments:
- Forum or comments to messenger channels. Screenshots spread fast and lose context. Our Telegram monitoring guide shows how to track channels.
- Messenger channels to news sites. This is usually when journalist calls start.
- One market or language to another. A story can resurface in a neighbouring market a day later, in a different language.
If you only monitor news, you see the story at the third step. If you also monitor social networks and messengers, you can often see it at the first.
For more on that difference, read social listening vs media monitoring.
Keep owned accounts on one script
People will comment and message you on every channel you run. If each account replies on its own, you risk mixed messages.
- Put one person in charge of replies across all owned accounts, using approved wording you update as facts change.
- Pause scheduled marketing posts until things are stable.
- Reply to questions, not provocation, and point people to your statement or support channel.
- Flag any message from a journalist, regulator or affected customer to the crisis team.
Week 1: the post-mortem
When volume and sentiment are back near baseline, hold a short review. The aim is to learn, not to blame. Measure the same four things after every incident so you can compare them over time.
Compare incident coverage with your normal share of voice too. It shows how much the story crowded out your usual messages.
Then ask four questions:
- Which signal did we see first, and which should we have seen first?
- Did any query miss posts we later found by hand?
- Were thresholds too high, or too noisy to trust?
- Where did the story jump, and how long did each jump take?
Turn every answer into a change: a new keyword, a new threshold, a new holding statement or a rota fix. That is how the next detection gets faster.
Where Scano fits in the playbook
Scano is an AI media monitoring and social listening platform. It tracks news sites, social networks, messengers, blogs, forums and reviews across 1M+ sources in 20+ languages. Here is how it maps to each stage.
| Playbook step | What Scano gives you |
|---|---|
| Hour 0: detect | Spike signals when volume or negativity jumps, sent to email and Telegram, plus a daily digest of what changed overnight. |
| Hour 0: see where it starts | Telegram channels and VK as well as Instagram, TikTok and YouTube, strongest in Türkiye, Central Asia, the Caucasus and the Gulf. |
| Hour 0: catch visuals | OCR reads text in images and video frames; speech-to-text transcribes videos and stories, including Telegram video notes. See Visual Insights. |
| Hours 2–6: track sentiment | AI sentiment with dedicated models for English, Turkish, Arabic, Russian, Kazakh, Persian, Hebrew and French. |
| Hours 2–6: key claims | AI Analyst: ask "what are people claiming about the recall?" and get an answer linked to the source posts. |
| Hours 2–6: owned accounts | Social Space, a unified inbox for comments and messages on your own accounts. Included in Business, an add-on below. |
| Week 1: post-mortem | 13 analytics reports and theme comparison, exported to Excel, Word or PDF. |
Conclusion
Crisis monitoring is mostly preparation. The queries, baselines, alerts, rota and holding statements you set up on a quiet week decide how fast you act on a bad one.
When something breaks, triage with written criteria, track six numbers every hour and watch for the jump from niche channels to the news. Afterwards, measure detect, respond, recover and reach, and feed the lessons back into your setup.
Book a Scano demo and we will set up a trial workspace on your own brand, with spike signals and alerts to email and Telegram, so you can test this playbook on real data.
FAQs
What is crisis monitoring?
Crisis monitoring is tracking news, social networks and messengers for early signs that a negative story about your brand is growing. It pairs alerts on volume and sentiment with a clear plan for who checks them and how to respond.
How do you detect a PR crisis early?
Build queries for your brand, executives, products and locations combined with risk words. Record normal levels, then alert on volume spikes, negativity spikes and high-risk keywords. Monitor messengers and forums as well as news, because many stories start there.
What should a holding statement include?
It should acknowledge the issue, say you are investigating, tell affected people what to do now and promise an update by a set time. Draft two or three in advance and get them approved before you need them.
When should you escalate a social media issue?
Escalate when a high-reach account picks up the story, a journalist asks for comment, a news site covers it, or there is any safety, legal, data or executive conduct angle. Moving up early is safer than catching up later.
Which metrics should a crisis post-mortem track?
Track time to detect, time to respond, how long sentiment took to return to baseline, and total coverage volume by source type. Compare them across incidents to see whether your setup is improving.