an organization should have tested short-term and long-term recovery mechanisms in place. Again,let me stress "tested" and "in place";in the heat of a crisis,it is very difficult to invent these things on the spot.if you are not anticipatory,then you are forced into patching things up after the fact.
the last phase is continued learning and reassessment to improve what you've done in the past.
By the way,no one in the field of crisis management ever said that all crises can be averted.indeed,complete or perfect prevention is not the point.crises management is analogous to protecting your house from a burglar.even though we can't keep all burglars out,we can and should make a successful burglary as difficult as possible.