When a business becomes aware of a possible breach, the pressure to reassure people can be immediate.
The issue might involve customer data, confidential documents, financial information, an internal policy, a supplier, employee conduct or a product safety concern. Customers, employees, partners and journalists may start asking questions before the business has established exactly what happened.
At that point, a firm denial can feel like the safest response.
But saying something did not happen is very different from saying there is no evidence of it so far. If new information later emerges, the business is no longer dealing only with the original issue. It must also explain why it gave people an assurance that proved to be premature.
The first information is rarely the full picture
Most investigations develop over time. The business may know that a document was shared without permission but not who received it. It may have identified a problem with one product batch without knowing whether others are affected. A complaint may have been made about an employee, but the facts may still need to be verified. An apparent financial discrepancy may have several possible explanations.
The same applies to cyber incidents.
In July, Oman’s Arabia Falcon Insurance said there had been no data breach, data leakage or operational disruption following an attempted intrusion into its network. A later update said that online claims about the incident appeared credible. In October, the company disclosed that data appeared to have been published, while investigations continued into what information may have been affected.
This is NOT about judging an organisation dealing with a complex incident. It illustrates why the absence of evidence at one point in an investigation should not always be treated as proof that something did not happen.
Certainty can become a liability
Businesses often want to close down speculation quickly. That instinct is understandable. Rumours can spread, customers may become concerned and employees may start sharing incomplete information.
However, an absolute denial creates its own risk.
If the facts change, every later statement may be judged against the original assurance. People may question whether the business misunderstood the problem, failed to investigate properly or deliberately played it down.
Carefully qualified language is not weak or evasive. It is often the most accurate position available.
A business can explain that it is aware of an issue, has started an investigation and is taking appropriate action. It can say that it has not found evidence of a particular outcome at that stage. It can also be clear about what remains unknown and when another update will be provided.
This gives people useful information without presenting an early assessment as a final conclusion.
Ask five questions before responding in public
Before making a public statement, the business should establish what is known for certain, what evidence has been checked, what remains under investigation, who may be affected and when those people will receive another update.
Not every answer needs to be made public. There may be legal, regulatory, privacy or commercial reasons to limit what is disclosed. But the people approving the communication need to understand the difference between a verified fact, a reasonable assessment and an assumption.
Language matters. “We have found no evidence at this stage” leaves room for an investigation to continue. “This did not happen” closes that door.
The statement should also be reviewed when new information becomes available. An initial response should not remain the business’s only public position if the facts have moved on.
The investigation and communication must stay connected
As we discussed in Your Biggest Reputation Risk May Sit Outside the PR Team, many reputation problems begin as operational, legal, financial, HR or technology issues.
That is why communications cannot sit separately from the investigation. The people handling the operational response, legal implications and external communication must work from the same verified information. One team should not be offering reassurance while another is still trying to establish the scale of the problem.
The aim is NOT to say as little as possible. Nor is it to hide behind vague language. It is to communicate what is known, acknowledge what is still being investigated and explain what happens next.
During any developing incident, careful qualification is not avoidance. It is responsible communication and far more likely to protect trust.
