A holding statement is a short, fact-checked first response that a company issues before it knows everything about an incident. It says what happened in confirmed terms, what the company is doing, what affected people should do, and when the next update arrives. The five templates below cover recalls, outages, data breaches, backlash and regulator letters, and each is tied to a real crisis.
Last updated November 5, 2026.
Key takeaways
- A holding statement uses four parts: what happened, what the company is doing, what people should do, and when the next update comes.
- Every line must be confirmed. Leave out cause, blame and numbers until the facts are verified.
- A different template fits each crisis type, and the fill-in blanks should be agreed before an incident.
- A named person and a set update time matter as much as the wording.
What is a holding statement and when should you issue one?
A holding statement is the first public response to an incident, issued once the basic facts are confirmed and before the full picture is known. Issue it when silence would let others define the story, which usually means within hours of a recall decision, an outage, a breach finding, a viral post or a published regulator letter.
It is a bridge, not an investigation report. It acknowledges the problem, protects people from harm and buys time for a fuller statement without guessing at cause or fault. The guidance in 5W's crisis PR guide and crisis communications plan guide explains where the statement sits in the response sequence, and the holding statement glossary entry gives the short definition.
What are the four parts of every holding statement?
Every holding statement has four parts, written in this order: what happened, what the company is doing, what affected people should do, and when the next update arrives. The table shows what each part must contain and what to avoid.
| Part | What it must contain | What to avoid |
|---|---|---|
| 1. What happened | The confirmed event, named system or product, and date | Cause, blame, the word "isolated" and unconfirmed counts |
| 2. What we are doing | Actions already underway, such as stopping sales or investigating with the regulator | Promises that depend on facts not yet known |
| 3. What you should do | One clear instruction and a contact | Vague advice such as "stay tuned" |
| 4. Next update | A specific date and time | "As soon as we know more" |
1. Product recall template
A recall statement tells customers which product to stop using and how to get a remedy. Name the product, lot and date range in the first sentence, and keep the language plain.
[Company] is recalling [product name], lot [number], produced [date range], because [confirmed reason in one plain sentence]. If you have this product, stop using it and contact us at [phone and email] for a [refund or replacement]. We have notified [regulator] and retail partners. We will update this page at [time] on [date].
Real example: Johnson & Johnson baby powder, 2019. On October 18, 2019, Johnson & Johnson recalled about 33,000 bottles of one lot after the FDA found trace asbestos in a bottle bought online, according to the Associated Press. The company named the lot, called the recall voluntary and said it was acting "out of an abundance of caution", while it said it could not confirm whether the sample was authentic. Customers were told to stop using lot 22318RB and could request refunds.
What to adapt: if the company disputes the test result, say so in a separate sentence and keep it apart from the instruction to stop using the product. 5W's product recall communication guide and the beauty crisis communications guide cover the full recall sequence.
2. Outage or defect template
An outage statement names the cause category, the affected systems and a recovery path. The first question customers ask is whether it was an attack, so answer it if you can confirm it.
Since [time and time zone] on [date], [product or service] has been [affected in plain terms]. We have identified the cause as [defect or other confirmed category], and this [is or is not] a security incident. Affected customers should [one instruction]. Our engineers are [current action]. Our next update is at [time].
Real example: CrowdStrike, July 2024. CrowdStrike's faulty update went out at 04:09 UTC on July 19, 2024, and the faulty file was removed at 05:27 UTC. CEO George Kurtz said the same day that the cause was a defect in a content update and not a cyberattack, which answered the first question customers had. Microsoft estimated 8.5 million Windows devices were affected. The full timeline is in 5W's CrowdStrike outage case study.
What to adapt: give exact times and a recovery metric, and keep any legal position out of the public statement. The case study shows how a later public dispute with a customer overshadowed an otherwise strong first response.
3. Data breach template
A breach statement confirms what was accessed, what was not, and what people should do to protect themselves. It must be coordinated with counsel, because notification deadlines may already be running.
On [date], we confirmed that an unauthorized party accessed [named system]. The information involved includes [confirmed data types]. It does not include [confirmed exclusions]. We have [containment action] and notified [regulators and law enforcement]. We recommend that affected customers [specific protective step]. We will post an update at [time] at [page address].
Real example: Equifax, 2017. Equifax found its breach on July 29, 2017 and disclosed it on September 7, which is 40 days later, according to 5W's guide to business crisis types. The breach exposed data on about 147 million consumers. That gap is the lesson: the statement should go out as soon as the facts are confirmed and the deadlines are known.
What to adapt: public companies now face the Securities and Exchange Commission rule that requires a Form 8-K within four business days of determining that an incident is material. Decide in advance who makes that call. The data breach communications plan lists the other deadlines, including GDPR and California.
4. Public backlash template
A backlash statement names the specific harm, takes the content down if it is clearly wrong, and says what will change in the approval process. It does not apologize for people's reaction.
We published [content or action] on [date]. It [named specific problem, in plain words]. We have removed it. We are sorry for [the harm to a named group]. We are [specific process change], and we will report on it by [date].
Real example: Dove, 2017. In early October 2017, a Dove Facebook clip drew criticism for how it depicted women of color. Dove removed it and said on October 7 that it had "missed the mark in thoughtfully representing women of color", according to Fortune. Some commentators said the statement did not name what was wrong with the ad itself.
What to adapt: name the harm, not only the reaction. The guide to apologizing publicly sets out the five parts of an effective apology.
5. Regulator or legislator inquiry template
A regulator statement acknowledges the letter, confirms that the company will respond by the stated date, and answers the most visible question directly. A warm acknowledgment alone leaves the questions open for the next news cycle.
We received [name]'s letter dated [date] about [subject]. We will respond by [deadline]. On the question of [most visible concern], our position is [plain answer]. We are reviewing [other items] and will share updates at [time and place].
Real example: Beast Industries, 2026. On March 23, 2026, Senator Elizabeth Warren, the ranking member of the Senate Banking Committee, sent Beast Industries a 12-page letter with 11 questions about its Step acquisition and a response date of April 3. The company told reporters its motivation was to "improve the financial future of the next generation", according to The Block. That statement did not answer the questions about crypto access for minors, which stayed open. See the Beast Industries case study.
What to adapt: pick the one question reporters will quote and answer it in the statement. Send the detailed reply to the regulator's office.
What should a holding statement leave out?
A holding statement should leave out anything that is not confirmed, because a number or cause that changes later becomes the headline. Four items cause the most trouble:
- Cause or fault. Do not name a vendor, employee or attacker until the facts are verified.
- Counts and scope. A record count or customer number that grows later damages credibility more than a smaller confirmed figure.
- Reassurance without evidence. "No evidence of misuse" is a claim that must be supportable.
- Legal arguments. Contract caps and liability positions belong with counsel, not in a public statement.
Who should approve a holding statement?
A holding statement needs three approvals in a fixed order: the person who owns the facts, counsel, and the executive who speaks for the company. Agree the names and backups before an incident, and set a time limit so approvals do not take longer than drafting.
- The incident owner confirms every factual line against the incident log.
- Counsel reviews for notification duties and legal exposure.
- The executive lead approves the final wording and the spokesperson.
- Customer support and social staff receive the statement before it goes public.
Where should a holding statement be published and updated?
Publish the statement on a dated page on the company's own website, then link it from social channels and the customer support script. Add a time stamp to every update and keep the same wording across channels.
The page also becomes the source that search engines and AI assistants find first, so keep it factual and current. 5W's second crisis analysis explains why the record can be rewritten by others if the company stops updating, and AI crisis monitoring covers how to watch what is said afterward.
Spokesperson preparation matters as much as the page. See the executive media training protocol. Companies that want templates built and tested before an incident can work with 5W's crisis PR practice, and the crisis PR cost guide explains how that work is priced.
Frequently asked questions
What is a holding statement in PR?
A holding statement is a short first response issued before all details of an incident are confirmed. It acknowledges the situation, states what the company is doing and promises a specific next update, without speculating about cause or fault.
How long should a holding statement be?
A holding statement should be short enough to read in under a minute, usually four to eight sentences. Each sentence should hold one confirmed fact or instruction.
How soon should a company issue a holding statement?
A company should issue it as soon as the basic facts are confirmed and approved, usually within hours. Waiting for the full investigation leaves the story to others, as the 40-day gap in the Equifax case shows.
Can a company prepare a holding statement before a crisis?
Yes. Prepare the structure and the blanks in advance, but do not pre-write conclusions about severity, cause or responsibility. Those depend on the incident.
What is the difference between a holding statement and a press release?
A holding statement is a brief, early acknowledgment with an update time, while a press release is a fuller announcement issued after facts are established. Many crises need the first, then the second.
Does a holding statement need legal review?
Yes. Counsel should review every outside statement, because the same words reach regulators, customers, employees and reporters at once.
