What is the crisis communication plan if something negative is posted online about the business? Again, who has to approve this?

From experience, most companies choose to deal with it privately and directly with the user/consumer,  sometimes they try to take a public approach but that could go wrong sometimes because others participate in the conversation without known the facts.

Who has to approve it ? Well, I guess it's either Marketing or Community departments based on the nature of the company and it's structure.