A crisis can be complicated and demanding, yet it also gives an organization a chance to show its core values and the quality of its controls, governance, response, review and learning. Many crises look one of a kind but share recurring traits, and knowing them strengthens the capability. An incident often sets off a crisis, and Table 1 distinguishes the two on six traits: predictability (the kind of incident is generally foreseeable even if its timing is not; crises are usually unique or rare, some can be anticipated, but their timing and impact cannot always be foreseen); onset (either may arrive with no or little warning, but a crisis can also grow from an incident that was not contained, was mishandled or escalated into reputational damage); urgency and pressure (a crisis always demands immediate attention, its impact can be very high, and its visibility puts the organization under heavy pressure); impact (incidents are usually local, short-lived and seldom threaten survival; crises can disrupt the entire organization across organizational, geographic and sector boundaries, are complex and uncertain by nature, and one handled badly can wreck function, values, trust and reputation on a catastrophic scale, with an organization's size, location and type making it more exposed); scrutiny by the public, media and interested parties (a well-run incident draws little notice; a crisis draws intense scrutiny from the public, users, regulators, shareholders, trade bodies and the press and social media alike, and decisions seen as poor, evasion of responsibility, blaming others, poor treatment of victims or economising on the response make it worse); and manageability through plans and procedures (incidents are often settled by existing plans with ready-made solutions; crises can seldom be settled by predefined plans alone and need leadership that is flexible, creative, strategic and sustained and that may question and change values and behaviour, resting on the crisis management structure and methods, on planning, and on training and exercises). An issue can grow into an incident and then a crisis (Figure 2); the organization should notice the shift and change its response accordingly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.