A holding statement has one job: to occupy the space where speculation would otherwise live, without committing the organization to facts it does not yet hold. Most fail in one of two directions and both failures are avoidable at the drafting table, long before the incident.
The narrow corridor
In the first hours of public scrutiny an organization walks a corridor with two walls. Say too little, or nothing and the vacuum fills immediately: journalists find other sources, employees speculate on social platforms, and the absence itself becomes the story (“the company declined to comment” is an accusation wearing a neutral coat). Say too much, a cause, a number, a promise and every subsequent fact becomes a test the statement can fail. Organizations rarely lose credibility for what happened. They lose it for what they said about what happened, too early, too confidently.
The holding statement is the corridor's walking technique. It demonstrates awareness, care and control of process while explicitly not adjudicating facts still in motion.
Anatomy of a statement that holds
- Acknowledgement. Confirm the organization is aware of the incident, in plain words. Naming the event (without characterizing its cause or scale) kills the “they don't even know” narrative.
- Care. If people are or may be affected, say that their safety and welfare come first and mean it operationally, because this line will be checked against behaviour.
- Ownership of process. State what the organization is doing right now: responding, establishing facts, working with the relevant authorities. Process is the one thing that can be claimed honestly while facts are unstable.
- The update covenant. Commit to when and where the next information will come. This is the clause that buys working room, and it only works if the commitment is kept even when the update is “we are still establishing the facts.”
What never goes in
Four categories reliably turn holding statements into liabilities: cause (“early indications suggest…”), blame in any direction, absolutes (“no data was accessed”, “all staff are accounted for”...), and “no comment”, which audiences universally translate as guilt. A fifth deserves mention: borrowed empathy. Language that sounds like it was written by counsel to simulate feeling is detected instantly and remembered long.
A holding statement is a promissory note. Its value is the organization's intention to honour it visibly, on schedule.
Draft in peacetime, by scenario family
The reason so many first statements fail is that they were written by frightened people at speed. The alternative is unglamorous: pre-drafted holding language for each family of foreseeable incident, operational disruption, harm to people, data and systems, conduct and integrity, third-party and supply chain. Each draft carries the fixed anatomy above, with bracketed variables for the specifics, and each is pre-cleared through legal in advance, so that clearance at 02:00 is a fill-in, not a negotiation.
Pre-drafting has a second, quieter benefit: it forces the argument between legal caution and communicative necessity to happen calmly, once, rather than being considered again during every incident.
When the holding statement dies
Holding language has a shelf life measured in hours, not days. Its function is to hold space until the organization can say something substantive; reissuing it past that point converts it from reassurance into evasion. The discipline, therefore, is paired: a statement that holds, and an update process behind it that makes the next statement possible. One without the other is either silence in costume or a promise the organisation is about to break.