Corporate Issues Map

An issues map is a living document that catalogues the risks to your organisation's reputation, assigns ownership, and defines monitoring triggers. Without one, you are doing crisis comms reactively — which means you are always behind. With one, your team spots problems weeks before they become headlines.

What Goes on the Map

An issues map covers anything that could generate negative media coverage, regulatory attention, employee unrest, or stakeholder concern. For UK organisations, the standard categories are:

Regulatory and Legal

Active investigations: FCA, CMA, ICO, Ofcom, SFO, or sector-specific regulators. If there is even a preliminary enquiry, it goes on the map.
Pending legislation and regulation: The Online Safety Act enforcement timeline, Consumer Duty implementation deadlines, upcoming CMA market studies. Track these with specific dates.
Litigation: Active or threatened legal proceedings, class action risk, judicial review challenges.
Compliance failures: Known gaps between your current practices and regulatory expectations. Include self-identified issues, not just regulator-flagged ones.

Operational

Service disruptions: IT outages, supply chain failures, product recalls. What is the realistic worst-case scenario for each?
Safety incidents: Workplace injuries, customer harm, product safety concerns. Relevant for manufacturing, retail, construction, and healthcare companies.
Data breaches: ICO reporting thresholds (you have 72 hours to report a qualifying breach). Is your process documented and tested?
Environmental incidents: Spills, emissions breaches, planning violations. Increasingly covered by mainstream media, not just trade press.

People and Culture

Executive conduct: Personal behaviour of senior leaders that could become public. The Sunday Times and FT investigate executive misconduct regularly.
Workplace culture: Bullying, harassment, discrimination claims. Employment tribunal cases are public record and routinely reported by trade press.
Redundancies and restructures: Planned headcount changes, office closures, TUPE transfers.
Diversity and inclusion: Pay gap data (mandatory reporting for 250+ employees), board composition, inclusion policies. The Guardian and Times run regular analyses of FTSE company data.

Market and Commercial

Financial performance: Profit warnings, covenant breaches, credit rating changes.
Competitive threats: New entrants, pricing pressure, market disruption. What would a journalist write about your market position?
M&A activity: Rumoured or planned transactions. Journalists at the FT, Sky News, and Sunday Times track deal activity closely through City sources.
Key client or contract risks: Loss of a major client, contract dispute, or dependency on a single revenue source.

External and Societal

Political exposure: Government policy changes that affect your business. Party conference season, Budget announcements, and general elections all create risk and opportunity.
Climate and ESG: Net zero commitments versus actual performance. Greenwashing accusations. ASA rulings on environmental claims (these have increased significantly since 2023).
Supply chain ethics: Modern slavery reporting, supplier labour practices, sourcing controversies.
Geopolitical: Exposure to sanctioned regions, trade disruption, currency risk.

Structuring the Map

Use a simple grid. Each issue gets one row.

| Issue | Category | Likelihood (1-5) | Impact (1-5) | Risk Score | Owner | Monitoring Trigger | Response Status | |---|---|---|---|---|---|---|---| | FCA Consumer Duty compliance gap in legacy products | Regulatory | 4 | 5 | 20 | Head of Compliance | FCA Dear CEO letter, competitor enforcement action | Draft response ready | | CEO personal tax investigation rumour | People | 2 | 5 | 10 | General Counsel | Media enquiry, social media mention | Holding statement drafted | | IT platform outage affecting 50k+ customers | Operational | 3 | 4 | 12 | CTO | Monitoring alert from ops team | Comms playbook exists | | Gender pay gap data release (April) | People | 5 | 3 | 15 | HR Director | Annual reporting deadline | Narrative and data prepared | | Competitor launches competing product at lower price | Market | 3 | 3 | 9 | CMO | Trade press coverage, customer feedback | Key messages drafted |

Risk Score = Likelihood x Impact. Anything scoring 15+ requires a drafted response and a named spokesperson. Anything scoring 10-14 requires a holding statement. Below 10, monitoring is sufficient.

Assigning Ownership

Every issue has one owner. Not a committee, not "the leadership team" — one person who is accountable for:

Keeping the issue entry updated (likelihood, impact, response status)
Alerting the comms team if the issue escalates
Being available to provide information for reactive media responses within 60 minutes
Reviewing and approving any public statements related to the issue

The issue owner is typically the functional lead closest to the issue (Head of Compliance for regulatory issues, CTO for operational issues, HR Director for people issues). The comms team does not own the issues — they own the communication response and the monitoring infrastructure.

Monitoring Triggers

Each issue needs a defined trigger that moves it from "monitor" to "activate."

Media Triggers

Set up alerts in Meltwater, Signal AI, or Cision for:

Your company name + issue keywords (e.g., "Company Name" AND ("FCA" OR "investigation" OR "fine"))
Sector-wide coverage on the same issue (a competitor being fined increases the likelihood that journalists will look at your compliance next)
Named journalist alerts — if a known investigative journalist starts covering your sector, that is a trigger

Use Brandwatch or Pulsar to monitor:

Unusual spike in brand mentions with negative sentiment
Employee posts on Glassdoor or Blind mentioning specific issues
Hashtag emergence connected to your brand or sector

Operational Triggers

Work with each issue owner to define:

Specific thresholds that trigger escalation (e.g., "customer complaints on this topic exceed 50 in one week")
Internal reporting timelines (e.g., "breach must be reported to comms within 2 hours of identification")
Regulatory contact points (e.g., "FCA notification must happen within X hours for this type of event")

Common Mistake: The Undiscovered Known Issue

A UK insurance company knew about a systemic pricing issue affecting renewal customers for six months. It was being remediated internally but was not on the issues map and no monitoring was set up. A journalist at the Times received a tip from a former employee and published an investigation. The company had no prepared response, the CEO had not been briefed, and it took 48 hours to issue a statement — by which point the FCA had launched a formal review and three competitors had issued press releases distancing themselves. The issue was known. The failure was not having it on the map with a drafted response and media monitoring in place.

Review Cadence

Monthly

The comms team reviews the full map with the head of corporate affairs or CCO. Update likelihood scores based on recent developments. Add new issues, archive resolved ones.

Quarterly

Present the top 10 issues (by risk score) to the executive committee. This serves two purposes: it ensures leadership is aware of reputational risks, and it creates accountability for issue owners to keep their entries current.

Event-Driven

After any of these events, conduct an immediate map review:

A competitor faces a public crisis on an issue that also applies to you
A regulator publishes new guidance or enforcement action in your sector
A political or legislative change affects your industry
A senior executive departs or joins
An M&A transaction is announced or rumoured

Making the Map Operational

The issues map is worthless if it sits in a folder and gets reviewed once a quarter. To make it operational:

Link to your crisis playbook: Each high-risk issue (score 15+) should have a corresponding entry in your crisis response plan with pre-drafted statements, spokesperson assignments, and escalation protocols.
Integrate with media monitoring: Your Meltwater or Signal AI dashboard should have saved searches that map directly to the issues on your map. Every issue = one search query.
Brief spokespeople: Every quarter, brief your three most likely spokespeople on the current top 5 issues. They should know the key messages and be able to respond without reading from a script.
Test annually: Run one scenario exercise per year based on your highest-risk issue. A 90-minute tabletop exercise with the exec committee, comms team, and relevant issue owners. Use a realistic scenario: "The FT is running a story at 6pm tonight about [issue]. What do we do?"

A well-maintained issues map means you are never surprised by a journalist's phone call. You may not like the question, but you already have an answer.