Interview questions for crisis management: 14 questions about leading the response, from the first hour to the review
On this page
- What does crisis management look like in observable behavior?
- Which behavioral questions reveal crisis management?
- Which situational questions test crisis judgment?
- Which frameworks should you ask about by name?
- What should you avoid asking about past crises?
- What do strong and weak answers sound like?
- How do you score crisis management on a 1–4 scale?
- What mistakes do interviewers make with crisis management?
- Questions people ask
Interview questions for crisis management should reconstruct one real incident the candidate helped lead: what they did in the first hour, who was in charge of what, how often and how they updated people, which decisions they made before the facts were clear, when they declared the crisis over and what changed afterward. Staying calm is part of it, but the skill is organizing a response. The most useful single question is "Tell me about the most serious incident you helped lead the response to. Who did what in the first hour, and who decided that?" Below are fourteen questions, ten behavioral in four phases and four situational, each with what a strong answer contains, red flags and a follow-up probe, plus the frameworks to ask about by name, what not to ask about past crises, sample answers and a 1–4 anchored scale.
Four neighbors cover the edges. Composure under pressure is personal steadiness in the moment, risk management is preventing what can be prevented, decisiveness is committing on time with incomplete information, and resilience is getting back to full effectiveness after a setback. Crisis management is the organizational response once something serious has happened anyway.
What does crisis management look like in observable behavior?
Definition: crisis management is leading an organization's response to a serious, unplanned event that threatens people, operations, customers or reputation, from the first report to recovery. The International Organization for Standardization publishes guidance on building that capability as ISO 22361:2022, Security and resilience, Crisis management, Guidelines, which includes a clause on crisis leadership. Listen for six behaviors:
- Safety and triage first. Protects people, contains the immediate harm and judges how serious it is.
- Structure, fast. Makes clear who is in charge, who does what and where the current facts live.
- Communication on a rhythm. Regular, honest updates to staff, customers, regulators and leadership, each with the time of the next update.
- Recorded decisions under uncertainty. Decides with what is known, writes down what and why, and revisits as facts arrive.
- Stamina and handover. In long incidents, rotates people, enforces rest and hands over in writing.
- Stand-down and review. Declares the crisis over, supports recovery and runs a blameless review whose actions get finished.
Which behavioral questions reveal crisis management?
Ask for one incident and walk through it in order. The phases below keep the story from skipping straight from "it went wrong" to "we fixed it".
Before anything happens
| Question | A strong answer contains | Red flags | Follow-up probe |
|---|---|---|---|
| 1. Tell me about a crisis plan or exercise you took part in. What did it change? | A drill or tabletop exercise that found gaps, such as out-of-date contact lists or unclear decision rights, and the fixes that followed. | The plan sat on a shelf, or there was never an exercise. | "What was the most useful gap it found?" |
The first hour
| Question | A strong answer contains | Red flags | Follow-up probe |
|---|---|---|---|
| 2. Tell me about the most serious incident you helped lead the response to. Who did what in the first hour, and who decided that? | Named roles, one lead, one place for the facts, safety first, and the candidate's own part in setting that up. | Everyone "jumped in" and nobody was in charge. | "How did people know who was in charge?" |
| 3. Describe a time you had to decide how serious an incident was before the facts were clear. | Used criteria or thresholds, escalated early and adjusted the severity as facts arrived. | Waited for certainty, or treated everything as top priority. | "What would have made you escalate further?" |
During the response
| Question | A strong answer contains | Red flags | Follow-up probe |
|---|---|---|---|
| 4. Tell me how you kept people informed during an incident that lasted more than a day. | A rhythm of updates by audience, the time of the next update in each message and one source of truth. | Silence until it was fixed, or different people sending conflicting messages. | "Who heard first, and who heard last?" |
| 5. Describe a time two people both thought they were in charge during an incident. | Settled decision rights quickly, without a power struggle, and wrote them down. | Let it run, or won by rank alone. | "How did you settle it?" |
| 6. Tell me about a decision you made during a crisis that you would make differently now. | What they knew then, their reasoning, the record they kept and the lesson, judged without hindsight. | Nothing they would change, or harsh self-blame for facts nobody had at the time. | "What did you know when you decided?" |
| 7. Describe a crisis where you had to speak to customers, regulators, the press or the public. | Accurate, no speculation, owned what was theirs, stayed within their authority and worked with legal or communications. | Overpromised, guessed at causes or blamed someone. | "What did you choose not to say?" |
| 8. Tell me about a long incident. How did you manage your own stamina and your team's? | Shifts and handovers, enforced rest, a deputy and written handover notes. | Everyone awake for thirty hours, told as a badge of honor. | "What did your handover notes include?" |
After it is over
| Question | A strong answer contains | Red flags | Follow-up probe |
|---|---|---|---|
| 9. How did you decide the crisis was over, and what did you do in the week after? | A clear stand-down, a message to everyone involved, follow-up with the people affected and recovery work. | It "just calmed down"; nobody stood the response down. | "Who did you go back to afterward?" |
| 10. Tell me about the review after an incident. What changed because of it? | A blameless review, specific actions with owners and dates, and evidence they were done. | No review, or one that named a culprit and changed nothing. | "Which action took longest to finish?" |
Questions 2, 4 and 10 matter most. They cover structure, communication and learning, which calm alone does not supply.
Which situational questions test crisis judgment?
-
"At 6 a.m. you learn that the system customers use to book appointments has been down since midnight. Your manager is on a flight. What do you do in the first 30 minutes?"
Probes: Who do you call first? What do customers hear, and when? -
"A video of an employee being rude to a customer is spreading online, and a journalist has called. What do you do in the first day?"
Probes: Who do you involve? What do you say publicly, and what not yet? -
"A severe weather warning is issued for this afternoon. Your site lead wants to keep the warehouse open to meet a client deadline, and some staff are worried about getting home. You have the authority to decide. What do you do?"
Probes: What do you decide, and by when? What do you tell the client? -
"Three days into a crisis, things are stable but people are exhausted, and the CEO wants a full report tomorrow. What do you do?"
Probes: What goes in the report? What do you do for the team?
For scenario 13, strong answers put people's safety ahead of the deadline, decide early enough for staff to act on it and tell the client promptly with a new plan. Weak answers wait to see how bad it gets.
Which frameworks should you ask about by name?
In some settings the response follows a published framework, and a candidate should be able to describe how they used it. Ask what they did with it, not for definitions. As of November 2026:
| Setting | Framework | What to ask |
|---|---|---|
| Government agencies and the organizations that respond alongside them | FEMA's National Incident Management System, which guides all levels of government, nongovernmental organizations and the private sector in working together on incidents; FEMA courses include IS-100.C, Introduction to the Incident Command System, and IS-700.B, An Introduction to the National Incident Management System | "Which role did you hold in an incident or exercise, and how did command pass between shifts?" |
| Hospitals and other providers in Medicare and Medicaid | CMS emergency preparedness requirements, whose core elements are risk assessment and emergency planning, policies and procedures, a communication plan, and training and testing | "What was your part in the last drill, and what did the communication plan get wrong?" |
| Workplaces where an OSHA standard requires an emergency action plan | 29 CFR 1910.38, whose minimum elements include procedures for reporting an emergency, for evacuation and for accounting for all employees afterward | "After an evacuation, how did you account for everyone?" |
| Corporate crisis and continuity roles | ISO 22361:2022 for crisis management and ISO 22301:2019 for business continuity management systems | "How did you build or test the capability, and what changed after the test?" |
Knowing the vocabulary is not the competency. A candidate who can list Incident Command System positions but cannot describe a handover they ran scores no higher than one who ran a clean response without the terminology.
What should you avoid asking about past crises?
In the United States, as of November 2026 (general information, not legal advice):
- Health and trauma. The EEOC's guidance on pre-employment disability-related questions (1995) says employers may ask whether applicants can perform the job's functions, but not, before an offer, questions likely to reveal a disability. Do not ask whether an incident affected their mental health or whether they were treated for stress. Ask about the job's real demands instead: "This role leads overnight incident calls on a 24-hour on-call rotation. Can you meet that?" The page on illegal interview questions covers the wider list.
- Military and first-responder experience. Ask about the job-related experience, such as the roles held and what they did, the same way you would for civilian work. USERRA, 38 U.S.C. 4311, bars denying initial employment because of past, present or future service in the uniformed services.
- Confidential incidents. Do not press for confidential details of a previous employer's breach, litigation or investigation. Ask for the structure of the response, and treat a candidate who shares secrets freely as showing weak discretion.
What do strong and weak answers sound like?
Illustrative answers to question 2, written to show the difference in structure. They are not from real candidates, and the times are examples.
Weak: "We had a huge outage once and it was chaos, but I stayed calm and basically worked through the night with the engineers until it was fixed. My manager said I saved the day."
This shows calm and effort but no structure: nobody in charge, nothing about customers, no decision and no change afterward.
Strong: "A storage failure took our order system down at 2 p.m. on a Friday. Within ten minutes I opened an incident call, said I would lead it, asked our senior engineer to own the technical fix and our support manager to own customer messages, and set updates every 30 minutes on one status page. At 3 p.m. I decided to switch to manual order taking rather than wait for an estimate we didn't have, and logged the decision and why. We were back at 8 p.m. I closed the incident the next morning, and the review produced three actions; the biggest was a failover, which we tested three months later."
The strong answer has a lead and named roles, a rhythm of updates, a recorded decision made before the facts were complete, a stand-down and a review whose main action was finished.
How do you score crisis management on a 1–4 scale?
| Score | Anchor |
|---|---|
| 1 — No evidence | Examples are about personal heroics or staying calm. No structure, no rhythm of communication and no review, or the review blamed an individual. |
| 2 — Limited | Contributes well in a response someone else leads. When leading, improvises: updates are irregular and there is no clear stand-down or review. |
| 3 — Solid | Sets up roles and decision rights quickly, puts safety first, communicates on a rhythm with honest updates, records decisions made under uncertainty, manages stamina in long incidents and runs a blameless review whose actions get done. |
| 4 — Strong | Everything at 3, plus has led a response across several teams or organizations, improved preparedness through exercises before anything happened, and handled outside scrutiny from regulators or the press accurately. |
What mistakes do interviewers make with crisis management?
- Rewarding adrenaline stories. Many dramatic rescues can mean nothing was ever prevented or reviewed. Ask what changed afterward.
- Scoring calm in the interview. Interview nerves say little about incident leadership. Score the examples.
- Treating framework vocabulary as competence. Ask what the candidate did in a real or exercised incident.
- Ignoring the after. Questions 9 and 10 often separate candidates who lead responses from those who survive them.
- Writing "great in a crisis" in the notes. Record the behavior: "named roles in ten minutes, updates every 30 minutes, logged the switch to manual orders, review action completed."
Questions people ask
What questions should I ask to assess crisis management skills?
Start with 'Tell me about the most serious incident you helped lead the response to. Who did what in the first hour, and who decided that?' Then ask how they kept people informed during an incident that lasted more than a day, and what changed after the review. Probe for roles, the rhythm of updates, decisions made before the facts were clear and actions that were actually completed.
How is crisis management different from risk management?
Risk management happens before: spotting what could go wrong, sizing it and putting controls in place. Crisis management happens once something serious has gone wrong anyway: organizing the response, communicating, deciding with incomplete information and learning from it. Many roles need both, so score them separately.
Do crisis management candidates need ICS training or an ISO certification?
It depends on the setting. Government agencies and the organizations that respond alongside them often use FEMA's National Incident Management System and its Incident Command System, and FEMA offers courses such as IS-100.C and IS-700.B. ISO 22301 is a standard organizations certify their continuity management systems to. In every case, ask what the candidate did with the framework, not whether they can recite it.
Can I ask a candidate how a past crisis affected them personally?
Avoid it before an offer. Questions likely to reveal a disability, such as whether an incident affected their mental health or led to treatment, are restricted at that stage under the ADA, according to EEOC guidance. Ask instead whether they can meet the role's real demands, such as an overnight on-call rotation. This is general information as of November 2026, not legal advice.