Crisis Management: Core Work

Why this matters

Crisis management is not the same as risk management. Risk management tries to prevent shocks. Crisis management is what happens when the shock arrives anyway.

For a 10 to 50 person UAE service business, prevention can only do so much. You cannot prevent a major client restructuring. You cannot prevent a senior team member receiving a better offer. You cannot prevent a regulator updating a rule mid-year. Some shocks are inevitable. The work is in being able to respond well when they land.

Founders who think crisis is rare end up unprepared. Founders who think crisis is inevitable end up paranoid. The middle path is the one that holds: name the realistic crises, design the response, monitor the concentration risk, debrief every event. The discipline is small. The savings are large.

This chapter sits in Part 6 because crisis is the moment that tests the structure. Advisory relationships, governance, and decision frameworks all exist precisely so the founder is not alone when it matters most.

A founder you might recognise

Ravi runs a 24-person fitout contracting business in Al Quoz. The business does AED 7M a year. One of his largest clients is a multinational retail group with multiple stores. The relationship is four years old. Annual fitout work for them runs around AED 2.4M, almost a third of the business.

In February 2026, the multinational announced a regional restructure. Two of the planned store builds for the year were cancelled. A third was delayed indefinitely. Ravi went from AED 2.4M of pipeline with this client to roughly AED 600,000. AED 1.8M of expected revenue evaporated in a single week.

Ravi had subcontractors lined up. Materials had been ordered for one of the cancelled projects. Two of his project managers were sized to deliver this work. Three of his site supervisors were on retention bonuses tied to project completions.

In the first 48 hours Ravi made three good decisions and two bad ones. The good ones: he called the multinational client immediately and negotiated kill fees on the cancelled projects, recovering AED 220,000 of cost already incurred. He held a crisis call with his leadership team within 24 hours and named the situation honestly. He started a parallel pipeline review to identify which other clients could absorb redirected capacity.

The bad ones: he laid off one project manager in week two who he later realised he could have redeployed. He cancelled all subcontractor relationships rather than slowing them, which cost him three months of trust to rebuild later.

Ravi's underlying business was healthy. His response was the right one in 80 percent. The 20 percent that was wrong cost him roughly AED 350,000 across the next six months. If he had run a crisis pre-mortem on client concentration in 2025, the response would have been ready and the bad decisions avoidable.

---

Working through the four layers

Layer 1: Pre-mortem

A pre-mortem is the exercise of writing the failure story before it happens. The leadership team sits together for two hours. The question is simple: it is one year from today, and something has gone badly wrong with the business. What happened?

The team names the three or four most likely shocks. For most UAE service businesses of 10 to 50 people, the realistic list is:

• The biggest client leaves or shrinks dramatically
• A key team member resigns or is unable to work
• A regulatory finding (Corporate Tax review, Emiratisation gap, ESR filing miss, PDPL breach) lands
• Cash collection breaks for a quarter due to one or two client crises
• A supplier fails on a critical project
• The founder cannot work for 90 days

For each named shock, write a one page response routine. What is the first call? Who decides what? What information has to be in front of the leadership team within the first 24 hours? What is the communication to clients, to the team, to suppliers, to the bank?

The pre-mortem does not predict the future. It produces three things: a shared mental model, a written response that does not depend on the founder being calm, and a list of structural changes that would reduce the impact if the shock landed.

Layer 2: The 24 hour response

When a crisis lands, the first 24 hours decide whether the business is on the front foot or the back foot. A defined sequence holds even when the founder is shaken.

Four moves, in order:

Orient. What exactly happened? What is known and what is assumed? What is the immediate financial, operational, and reputational exposure? Spend 60 to 90 minutes on this before deciding anything. Decisions made before orientation are usually wrong.

Contain. What is the smallest action that stops the situation getting worse? Sometimes this is a phone call. Sometimes it is a hold on outgoing communication. Sometimes it is preserving evidence or freezing a process. Containment is not solution. It is buying time to think.

Communicate. Who needs to know, and in what order? The leadership team first. The directly affected team next. The clients touched by the crisis after that, with a clear and honest message. The bank, the lawyer, the accountant if the crisis touches their domain. Silence is worse than imperfect communication.

Decide. With the situation oriented, contained, and communicated, the leadership team decides the response. Not the founder alone. The decision is documented, with the reasoning, so the next phase of the response is owned across the team.

The 24 hour response is a routine, not a script. The shape holds across crisis types. The specifics change. Rehearse it once a year with a fictional scenario. The team that has practised the routine moves twice as fast in the real one.

Layer 3: Concentration risk monitoring

Most crises happen because something the business depended on failed. Concentration risk is the early signal.

Six dimensions to monitor monthly:

Client concentration. No single client is more than 25 percent of revenue. Top three clients are not more than 50 percent.

Team concentration. No single function depends on one person. Where it does, that person has a documented backup, even if imperfect.

Supplier concentration. No single supplier is irreplaceable on a critical job. Backup options are pre-qualified.

Founder concentration. No critical decision can only be made by the founder. Authority is delegated for the first 30 days of any founder absence.

Banking concentration. No single bank holds more than the operating funds. A second relationship exists for backup. Cash sits in more than one place.

Regulatory concentration. Compliance status is current across all dimensions. The compliance calendar (see Founder Finance and Compliance and UAE Compliance Essentials) is reviewed quarterly.

The monitoring is a ten minute review per month. The action triggers when one dimension crosses a threshold. The cost of monitoring is far less than the cost of finding the concentration when it has already broken.

Layer 4: The debrief

Every crisis produces a system change. Without the debrief, the next crisis is the same crisis.

Two weeks after the immediate response is complete, the leadership team runs a structured debrief. Three questions:

• What happened, in chronological order?
• What worked in our response and what did not?
• What changes in the system would reduce the chance or the impact of this crisis happening again?

The output is two or three concrete changes with owners and dates. Sometimes it is a contractual change (force majeure clauses, kill fee terms, payment milestones). Sometimes it is an operational change (concentration limits, backup routines, escalation paths). Sometimes it is a personal change (founder authority delegation, advisory relationships, bank diversification).

The debrief takes 90 minutes. The system change takes a quarter. The next crisis arrives without the same shape.

---

Where to focus by team size

• 10 to 19 people. Run the pre-mortem once. Name the three most likely crises. Write one page per crisis. Concentration risk reviewed quarterly.
• 20 to 34 people. Pre-mortem refreshed annually. The 24 hour response routine is rehearsed once a year with a fictional scenario. Crisis fund of 30 days fixed cost held separately from operating reserve.
• 35 to 50 people. A standing crisis response team named (founder, leadership lead, finance lead, operations lead). Concentration risk reviewed monthly. Debrief discipline embedded after every incident, not only major ones.

---

Working prompts

Pre-mortem prompts

• What are the three most likely shocks that could land in the next 12 months?
• Which of those would the business survive without changes? Which would force redesign?
• For each, what would the first 24 hours look like today, with the routines we currently have?

24 hour response prompts

• When a crisis lands, who is the first call?
• Who decides what when the founder is unavailable?
• What is the channel for crisis communication and is it rehearsed?

Concentration risk prompts

• What is the largest client as a percentage of revenue?
• Are there any functions where only one person can act?
• Is there a second banking relationship?
• Where does the business depend on a supplier that is not pre-qualified for replacement?

Debrief prompts

• When was the last crisis or near-crisis the business handled?
• Was a debrief held? What changed in the system afterwards?
• If the same crisis happened again tomorrow, would we handle it differently?

---

Founder exercise

Set aside 90 minutes. Ideally with the leadership team in one room.

Part A: Pre-mortem (30 minutes)

The team imagines it is one year from today and something has gone badly wrong. Each person writes their three most likely shocks privately. The list is then merged. The top three to four shocks are named.

For each, the team writes the first three actions in the first 24 hours. Names. Phone calls. Documents. Be specific.

Part B: Score concentration risk (20 minutes)

Across six dimensions (client, team, supplier, founder, banking, regulatory), score the business red, amber, green. Anything red or amber gets a written action: who is reducing the concentration and by when.

Part C: Write the 24 hour response routine (20 minutes)

One page. Four moves: orient, contain, communicate, decide. For each, the founder writes who owns it and the time committed. Test the routine against the most likely crisis from Part A.

Part D: Plan the rehearsal (10 minutes)

Set a date in the next quarter for a tabletop exercise. The team runs the 24 hour response against a fictional crisis. The debrief from the rehearsal becomes the first system improvement.

Part E: Build the crisis fund (10 minutes)

Calculate 30 to 60 days of fixed cost. Set the target. Open a separate sub-account if it does not exist. Decide the funding rate (a percentage of monthly revenue, a quarterly contribution, or a slow build from founder draw discipline).

---

Common mistakes

1. Treating crisis as bad luck. The shocks that hit service businesses are predictable in shape. Most crises are concentration risks that finally landed. Treating each as bad luck means never reducing the underlying risk.

2. Improvising the response. A founder who handles every crisis personally and on the fly produces inconsistent outcomes and burns out. The routine costs nothing and produces consistent decisions.

3. Skipping the debrief. The crisis ends, the team is exhausted, the temptation is to move on. The system change that prevents the next round only happens if the debrief is run.

4. Confusing reserve with crisis fund. The operating reserve covers normal volatility. The crisis fund covers the abnormal event. They are different pots with different purposes.

5. Communicating too late. Silence in a crisis is read as panic by clients, the team, and the bank. A clear and honest message in the first 48 hours buys credibility that defends the relationship through the recovery.

6. Letting concentration drift after a crisis. The lesson is fresh in the immediate aftermath. Six months later, the original concentration starts rebuilding. Monthly monitoring stops the drift.

When to move on

Move on when the pre-mortem has been run, the 24 hour response routine exists in writing, concentration risk is being scored monthly, and the crisis fund target is set with a funding mechanism.

You do not need a crisis to test the system. You need the system in place so when the test arrives, the response is ready.

---

ARCAS lens

Crisis is the moment Part 6 does its work. The Advisory Spectrum, the Inner Circle, the Decision Frameworks, the Governance work, and the succession thinking are all designed precisely so the founder is not alone in the room when it matters most.

A founder with no inner circle, no advisors, no governance structure, and no crisis routine handles every shock as a solo problem. That is the most expensive way to handle anything.

People build it. Systems stabilise it. AI accelerates it. Judgment is what holds the business through the moments when none of the rest is enough on its own. Crisis management is the discipline that turns judgment from a personal trait into a team capability.

---

Start now: Quick self-assessment

Rate each statement from 1 (never true) to 5 (always true):

Score 24 or above: Crisis is a discipline. Move to the next chapter. Score 15 to 23: The pieces are partial. Do the founder exercise above. Score below 15: This is the chapter that protects everything else in the playbook. The exercise is worth the 90 minutes.