The Holding Statement Library: Drafting Tomorrow's Statements Today
The worst time to write your first public statement is during the incident. A small library of pre-drafted holding statements turns a panic task into an editing task.

In the first hour of an incident, someone asks the question that freezes the room: what do we say? Not the full statement - nobody has the facts for that - but the holding statement, the three sentences that tell employees, customers, and maybe reporters that you know, you are working, and you will be back with more.
Written under pressure, that statement comes out defensive, vague, or late - usually all three. Written in calm, it comes out human. The difference is not talent; it is timing. The companies that communicate well in a crisis wrote their first drafts long before the crisis.
A holding statement library is a folder of ten or twelve pre-drafted statements for the incidents you can predict, each with blanks for the facts. Here is how to build one in an afternoon.
Key takeaways
Holding statements buy the time that facts require; draft them in calm, not crisis.
Predict your ten scenarios from your own business: outage, breach, error, weather, personnel.
Each statement is three sentences: we know, we are working, you will hear from us by when.
Pre-agree who approves and who sends, so the statement does not wait on a meeting.
Review the library twice a year; a stale statement is a small lie.
Step 1: List the incidents you can already predict
Most crises are not surprises in kind, only in timing. A systems outage that affects customers. A data incident under investigation. A billing error. A weather closure. A key person suddenly gone. A bad review or news story gaining traction. Every company can list its ten without imagination - they are the things that have already happened once.
Write each as a scenario name on the library's cover sheet. The list doubles as a quiet risk assessment: if a scenario has no plausible statement because it is unthinkable, that is worth noticing too.
Keep the list honest and specific to your business. A manufacturer's ten and a law firm's ten share the weather and little else.
Step 2: Draft three sentences per scenario
The anatomy never changes. Sentence one acknowledges without speculating: we are aware of [the issue] affecting [who]. Sentence two shows motion: our team is working on it, and here is what customers should do right now if anything. Sentence three commits to the next update: we will share more by [specific time], here is where.
This fictional example shows one library entry. It is an illustration, not a prescription.
| Scenario | Draft |
|---|---|
| Customer-facing outage | 'We are aware that [service] is unavailable for some customers. Our team is actively working on it, and no action is needed on your side. We will post an update at [status page] by [time].' |
The blanks are the design. In a real hour, the writer fills brackets instead of inventing sentences, and the statement goes out in minutes instead of drafts.
Step 3: Pre-agree the approval path
The statement that waits on a meeting is not a holding statement. Decide in calm who can send what: which statements the CEO or owner can approve alone, which need one more pair of eyes, and who speaks if the usual people are unreachable.
Write the approval path on the library's cover sheet, with names and phone numbers. The communication matrix discipline applies here in miniature: audiences, senders, order - decided before the day they are needed.
The goal is not speed for its own sake. It is that the first public words come from the company's best judgment rather than its most available judgment.
Step 4: Keep the library alive
Statements age. The status page moves, the spokesperson changes, the scenario list shifts as the business does. A twice-yearly thirty-minute review - read each statement aloud, update the blanks, add the scenario the last year taught you - keeps the library honest.
The review has a side benefit: reading your own crisis statements in a calm conference room is a quiet rehearsal. The people in the room learn what the company would say, which is most of what they need to know in the real moment.
The library also feeds the real statement when the time comes; the thinking in calling customers before the breach is confirmed starts exactly here.
The related discussion of communication matrix discipline is worth your time alongside this one. The related discussion of calling customers before the breach is confirmed is worth your time alongside this one.
Frequently asked questions
Won't a pre-drafted statement sound generic?
A generic statement sent in twenty minutes beats a crafted one sent tomorrow. The blanks carry the specifics - who is affected, what to do, when the next update lands - and those are the parts readers actually judge.
Who should hold the library?
Two or three named people with phones, not a shared drive nobody can reach mid-crisis. Print the cover sheet. The library must be reachable in the scenarios it exists for.
Do small companies really need this?
Small companies need it more. They have no communications department to improvise under pressure, and their customers expect a personal voice - which is easier to produce from a draft than from panic.
A Defensible Next Step
Block two hours this month: ten scenarios, three sentences each, one approval path. The folder you create is the cheapest crisis insurance you will ever buy. Book a Decision-Clarity Call if you want the library drafted with you.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


