Imagine yourself as a top executive in a company hit by a major crisis within the last 72 hours. First, and most importantly, there may have been serious damage to the community in which you operate. Your customers may have suffered, people’s livelihoods destroyed. The environment may be irretrievably damaged. Some of your employees and contractors may be injured, or worse. Your investors will be livid, and the board looking to assign blame. By the end of the first week, chances are your organization will be facing dozens of lawsuits, some set to become class actions over time.

Very likely, at this early stage, you will realize that verifiable facts are few and far between. Opinions and rumors abound. You will have little or no idea of the extent of any physical or financial damage or the extent to which the organization was complicit in the event. You don’t even know which of your top team members you can count on. Some of them may be implicated; others may be operationally inexperienced, unfamiliar with the political realities, or temperamentally unsuited to the new situation—filled with good intentions but uncertain what role to play.

The crisis will be manna from heaven for your organization’s natural antagonists, who will seek to take advantage of your misfortune. Competitors will try to lure customers and poach employees. Activist investors may plot a takeover. Hackers may target target your systems. The media will dig up every past error the company may have made.

Much of the anger, by the way, is directed at you. And it’s personal. Parody Twitter accounts may appear in your name, trashing your reputation. Your family may be targeted online. Reporters may be camping outside your home at odd hours of the day and night.

In the middle of all this chaos, what exactly do you do? Do you hold a press conference? If so, what do you say when you have so few facts? Do you admit wrongdoing, or do you say that what happened is not the fault of the company? Do you point to the cap on your legal liability, or do you promise to make everything right, no matter the cost? What do you tell regulators that are themselves under pressure, and demanding explanations?

The issues just described are not hypothetical. They are all real examples of experiences that organizational leaders we know have faced in multiple crises in recent years. What’s really troubling is that these experiences are now far more frequent, and far more devastating, than they have been in the past.

Every crisis has its own unique character, rooted in specific organizational, regulatory, legal, and business realities. But after helping around 150 companies cope with a range of corporate disasters, we have seen some clear patterns. These can teach companies some simple best practices they can follow to prepare for a better response, in case the worst happens.

The threat is growing

Many incidents inside companies never hit the headlines, but recent evidence suggests that more are turning into full-blown corporate crises (exhibit). The total amount paid out by corporations on account of US regulatory infractions has grown by over five times, to almost $60 billion per year, from 2010 to 2015. Globally, this number is in excess of $100 billion. Between 2010 and 2017, headlines with the word “crisis” and the name of one of the top 100 companies as listed by Forbes appeared 80 percent more often than in the previous decade.¹Most industries have had their casualties. For instance, the US auto industry recalled a total of around 53 million vehicles in 2016, up from about 20 million in 2010, while the US Food and Drug Administration sent out nearly 15,000 warning letters to noncompliant organizations in 2016, up from just north of 1,700 in 2011.