Small Business Reputation Crisis: A Plan for Owners
Small business reputation crisis plan for owners with no PR team: first-day triage, one spokesperson, one dated statement, calm review replies.
A small business reputation crisis is handled on the first day by working out what is true, deciding who must hear it from you, naming one person to speak, and publishing one dated, factual statement on pages you control. After that you answer reviews briefly and without argument, stop posting when you have nothing new to say, and rebuild trust over a few weeks with evidence of what you changed.
A large company has a press office and a lawyer on call. You are the owner, the person who answers the phone, and often the person who did the work being criticized. The advantage of a small business is speed: you can decide in an hour what a corporation decides in a week, if you decide in the right order.
This guide reads the rules that Google, the US Federal Trade Commission and the UK Information Commissioner's Office publish, and says whose page each rule comes from. It is general information, not legal advice. Where a rule depends on your country or sector, we say so, and your own counsel decides what you may say.
- On day one, sort the facts into confirmed, not yet confirmed and not for public. Only the first group goes into any statement.
- Tell staff and directly affected customers before the public. Check your insurance policy and any regulator duty the same day: some deadlines are short.
- One person speaks. Post one dated statement on your own website, then as a Business Profile post. Update it only when there is a new confirmed fact.
- Answer reviews once, briefly, with the same facts. Never write, buy or request fake reviews, never threaten a reviewer, and never delete an accurate complaint you have the power to hide.
A small business reputation crisis starts with triage, not a post
The aim of the first day is to avoid adding a second problem to the first: no argument in the comments, no deleted posts, no statement written in anger, no promise you cannot keep. This guide covers what changes when the owner is the whole department. The day has six moves, in this order.
- Stop replyingDo not answer the post, the review or the journalist from the phone in the first hour. A reply written while angry is the one that gets screenshotted.
- Write the fact sheetOne page, three columns: confirmed, not yet confirmed, not for public. Use records, not memory: invoices, messages, dates, photos.
- Find the ruleAsk which rule applies: a platform content policy, a legal duty to report, or none. The answer decides whether you flag, notify or simply respond.
- List who must hear it firstStaff, directly affected customers, your insurer, and any authority that has a deadline. The public comes after them.
- Name one spokespersonOne person speaks for the business. Everyone else has one sentence to say and a contact to pass the question to.
- Publish one dated statementShort, factual, with the time, the next update time and a way to reach you. Then stop and read the replies, do not write.
What is true: the one-page fact sheet that comes before any wording
Sort every claim made against you into one of four kinds, because each kind has a different move. Tone and truth are different questions.
Related readCrisis Communication to Employees: Who to Tell First| Kind of claim | What it looks like | Best move | Main risk |
|---|---|---|---|
| Accurate | It happened, and the post describes it fairly | Acknowledge it, say what you are doing, give a date | Defending it makes the complaint the story |
| Partly accurate | The core event is real, one detail or the motive is wrong | Confirm the true part first, then correct the one detail with a record | Leading with the correction sounds like denial |
| False in fact | Wrong business, invented event, edited screenshot | Gather proof, flag to the platform, state the fact once | Attacking the poster draws more readers |
| Opinion or tone | Harsh but about a real experience | Reply briefly or leave it | Treating a rude review as a policy breach |
A platform acts on its own rules, not on your sense of fairness. Google's content policy for Maps contributions bans unsubstantiated allegations of unethical behavior or criminal wrongdoing, fake engagement, conflicts of interest and harassment, and it still allows respectful accounts of a negative experience. So a harsh but real complaint stays, while a claim of a crime with nothing behind it is a candidate for a report.
Keep the fact sheet open all week and check every sentence against the first column. For anything in the second, the honest wording is "we are still establishing" and a time.
Who must be told first, and where the duty comes from
Tell people in the order of how much they lose by hearing it late: staff, affected customers, anyone with a legal or contractual deadline, then the public. Staff go first because they will be asked in the shop or on site, and a team that learns the story from a screenshot repeats it badly. The table separates a duty from a good habit; whether a duty applies to you is a question for counsel or your regulator.
| Who | Why before the public | What the official page says | Limit |
|---|---|---|---|
| Staff | They are the first people asked | No official page needed: this is practice | Give facts and one sentence, not rumors |
| Affected customers | They should not learn it from a feed | The UK ICO says that where a personal data breach is likely to cause a high risk, you must inform those concerned directly and without undue delay | Applies to personal data breaches, not every complaint |
| Regulator | Some deadlines are short | The ICO says to notify it within 72 hours of becoming aware of a breach likely to pose a risk to people's rights and freedoms, and to record every breach | UK and GDPR context. Elsewhere, other rules apply |
| Police or other parties | Fraud and theft involve third parties | The US FTC guide for businesses says to call your local police department immediately and, if stolen account numbers belong to accounts you do not maintain, to notify the institution that does | US guidance, not a statute |
| Insurer | Late notice can matter | No official page read for this guide states when an insurer must be told | Read your policy wording and call your broker today |
The ICO page says the 72 hours run from when you become aware and that a late report needs an explanation. It says the message to people should describe the breach in plain language, give a contact point, explain likely consequences and set out what you have done. That is a good outline for any statement, breach or not.
If your crisis is a data incident, read those duties first. If it is a service failure or a viral post, the regulator rows may not apply, and your insurer and counsel are the people to ask.
Related readProduct Recall Reputation: What Regulators PublishOne spokesperson, and a script for everyone else
One person speaks for the business, and in a small firm that is usually the owner. If you are too close, name a calm second person and brief them from the fact sheet. The FTC's breach guide gives the same advice for incidents: designate a point person for releasing information.
The rule for staff is simple. They say: "I can't speak for the business on that. Here is who can, and here is how to reach them." They do not speculate, defend, or reply from a personal account.
Working rules for the spokesperson:
- Never speak off the record to a journalist. Ask what they need and by when, and call back.
- Answer only from column one. "I don't know yet, we will update at 4 pm" is a complete answer.
- Keep a log of every inquiry with time, name and what you said.
Where to post: your own page first, then a Business Profile post
Post one statement on an owned page first, then repeat the same text as a Business Profile post. Your website is the only place where nobody else sets the rules and the date stays visible. Put the date and time at the top, then the facts, what you are doing, the time of the next update and one contact route.
Then publish the same text as an Update on your Google Business Profile. Google's help page for posts says an Update can carry text, a photo, a video and an optional action button, and that a post with the status Live is public on Search and Maps. The same page says posts are archived after six months unless a date range is set, that a post can show as Pending or Not approved, and that a phone number in the description might get a post rejected if it cannot be verified as connected to the business. Use the button to point to your owned page, so the statement lives and is edited in one place.
Related readReputation Crisis First Hour: A Checklist in OrderA holding statement has a few slots: a confirmed fact, what you are doing, when the next update comes and where to reach you. Leave out any slot you cannot fill with something true. If the fault is yours, one plain sentence of apology belongs in the statement. A full public apology is its own craft and needs counsel, so it should not be improvised in a first-day post.
How to answer reviews during a crisis without arguing
During a crisis, a review reply is written for the next customer who reads the page, not for the reviewer. It repeats the facts from your statement, adds no new claim, names no private detail and moves the conversation offline. One short reply per genuine review is enough.
The mechanics matter. Google's help page says you must verify your business before you can reply, that each reply is checked against content policies, that review usually takes up to 10 minutes but can sometimes take up to 30 days, and that approved replies appear as coming from the business, not from you personally. It also says the reviewer is notified and can change the review afterwards, and that you can edit or delete your own reply. A calm reply can earn a revised review.
| Review in the wave | Reply | Do not |
|---|---|---|
| Real customer, accurate complaint | Thank them, confirm the fact, say what happens next, give a contact | Explain why it was not your fault |
| Real customer, one detail wrong | Confirm the true part, correct one detail neutrally, offer to talk | Quote their order or personal details in public |
| No record of an order | Say you cannot find the order under that name and ask them to get in touch | Call them a liar or a fake |
| Suspected ex-employee or competitor | Flag it as a conflict of interest if you can evidence it, then answer calmly or leave it | Retaliate or post on their listing |
| Many near-identical posts | Reply once to the pattern if the platform allows, point to your statement | Reply to each and feed the thread |
The US FTC says in its consumer review rule questions and answers that you can respond publicly to a review, and that you should watch what you say. The rule bars a false accusation about a reviewer if you know it to be false, bars physical threats or intimidation to get a review removed or changed, and bars unfounded or groundless legal threats for that purpose. That is a US page, but the lesson travels: accusing a reviewer of lying without proof creates exposure you did not have.
Related readArrested: What to Do for Your Reputation in Week OneWhat you must not do: fake reviews, deleted complaints and threats
Three shortcuts feel natural to an owner under pressure. Each makes things worse, and each breaks rules written by platforms and regulators.
A rush of five-star reviews from friends and staff is easy to spot and becomes the second story. Ask real customers for honest feedback later, with no reward.
Do not delete accurate complaints you control. A customer's Google review is not yours to delete: the routes are to flag a policy breach or reply. On a review area you run, such as your own site, the FTC says that organizing reviews so that it is difficult for people to find negative ones could be unfair or deceptive, and that paying people to remove truthful negative reviews may violate the FTC Act.
Do not threaten. A legal letter with no basis, a message offering money for a deletion, or a public hint that you know where the reviewer lives each hand the other side a better story than the one they started with. If you believe a post is defamatory, take it to counsel: defamation rules vary by country.
When to stop posting: the rule for day two onward
After the statement, post again only when there is a new confirmed fact, a promised update is due, or a factual error is spreading that your statement can answer. Silence between those moments is not denial. It is how a story ends.
Every comment feels like an accusation that needs an answer. Ask three questions. Is this a new confirmed fact? Did I promise this update? Is a false statement spreading that one record can correct? If all three answers are no, do not post. Read, log and wait.
Related readContent Creator Crisis Response: A Plan That Protects IncomeMonitoring should be as small as your capacity. Check search results, reviews and your inbox at two fixed times a day, write down what you see, and do not refresh between. A small business needs only the habit of fixed times and one log. Set a date on day three or four on which active updates stop unless something new happens, and tell your staff.
A worked scenario: an invented renovation firm, day one to week six
This is an invented scenario with generic parties, built to show the order of work. None of it comes from a real business.
A five-person home renovation firm takes a deposit for a kitchen. The tile supplier fails, the job slips, and the owner stops answering the customer for nine days. The customer posts that the firm "took the deposit and disappeared". The post is shared locally and three similar reviews follow. The fact sheet shows: deposit received, true; work delayed by supplier, true; nine days of silence, true; "disappeared", false; the customer has not been refunded, because none was asked for.
| When | Action | What it produces |
|---|---|---|
| Day 0, hours 1 to 3 | No reply. Fact sheet written. Staff told in one message | A shared set of facts and one speaker |
| Day 0, hour 4 | Owner phones the customer and offers a start date or a refund choice | A direct conversation before the public statement |
| Day 0, evening | Statement on the firm's site and Business Profile: deposit received, delay caused by a supplier, nine days without contact was the firm's failure, next update at 5 pm tomorrow | One dated source that confirms the true parts |
| Day 1 | Calm replies to the review wave, update posted only at the promised time | Replies a prospective customer can read |
| Days 2 to 4 | Customer's choice carried out. One factual line added to the statement | A dated resolution |
| Week 2 | Written rule: a named person calls every client with a delay within two working days | A change that can be described |
| Weeks 3 to 6 | Honest feedback requested from finished jobs, no reward, no wording | New genuine reviews dated after the incident |
The owner never argues in public that "disappeared" was unfair, because nine days of silence is true. The statement replaces "took the deposit and disappeared" with a date, a reason and a resolution, which is what a prospective customer can check.
Recovery in weeks: what usually happens and what to keep doing
Recovery for a small business is usually measured in weeks, not months, when the facts are simple and the response is steady. It takes longer if local press or a data issue is involved. These are experience ranges, not promises.
In week one the aim is containment: one statement, one speaker, calm replies. In weeks two to four it is a visible change: a new rule or process, with one dated line saying what changed. In weeks four to eight it is evidence: new customers and new honest reviews.
Related readExecutive Crisis Communication Plan for a Personal CrisisKeep the crisis statement visible and accurate, because deleting it later looks like hiding it. Search results change slowly, so publish a steady stream of accurate, dated pages, not a burst.
If the issue goes beyond what an owner can handle, such as false statements spread widely, Reputation Partners can take over monitoring and removal requests, and will say plainly when a route will not work.
Your next step today
Write the fact sheet, tell your team, and read your insurance policy wording and any regulator duty before you post.
Write the fact sheet before any wording, name one speaker and publish one dated statement. If you want a second pair of eyes on the facts and the first statement, our crisis desk works with owners and small teams.
Questions people ask
Can I ask customers for good reviews to recover after a crisis?
Ask for honest feedback, not good reviews. Google's content policy prohibits fake engagement and bars offering incentives such as payment, discounts or free goods in exchange for a review, and its Maps policy also bars incentives for revising or removing a negative one. Do not reward reviewers or suggest wording, and wait until the matter is calm. Google's own page on asking for reviews was not read for this guide, so check it first.
Should I reply to the person who started it?
Reply once, in public, with the facts from your statement, and take the rest offline by phone. If they are a real customer, call them before you post anything. Do not argue the details in the thread. Google tells the reviewer when you reply, and they can edit their review afterwards.
Do I need a lawyer before I post a statement?
Not always, but ask counsel first when the matter involves a legal claim, an injury, a data breach, a regulator or an insurer. A statement is a record that others can use. For a service failure or a viral complaint, a short factual statement drawn from your own records carries little risk. This is general information, not legal advice.
How long until the story stops appearing in search?
Nobody can promise a date. In our experience a simple complaint with a clear resolution often fades from view within weeks, while a story that local press has covered can remain much longer. What helps is a steady flow of accurate, dated pages and honest reviews from you.
