Beyond the plans – practical capability
For many organisations, preparedness is still measured by the existence of a plan alone. Business continuity plans are reviewed, crisis management frameworks are approved, and response procedures are stored somewhere accessible to those that need to know. Once this work is complete, leaders may assume that the organisation is ready. Crisis management exercises may take place periodically, but are often treated as validation of those arrangements rather than a means of testing organisational capability.
However, a plan is often no more than a statement of intent. It describes how an organisation expects to respond under relatively controlled conditions borne out of assumptions. It cannot demonstrate whether people will recognise an emerging crisis, escalate it quickly enough, make effective decisions despite incomplete information or coordinate action across organisational boundaries.
Only regular demonstrated performance can really provide that assurance.
This is why exercising and simulation should not be treated as the final, sometimes optional end stage of resilience planning. They are the mechanisms through which organisations test their ability to respond and translate their documented arrangements into practical capability.
The limits of a written plan
Plans and the process of developing them remain essential. They provide structure, clarify roles and responsibilities and reduce the cognitive burden placed on teams during periods of disruption. However, even the most comprehensive plan will be built on a series of assumptions or a scenario the organisation has anticipated. However crises rarely respect these assumptions.
Information is often either scarce and incomplete, or contradictory and continuously changing. Senior leaders may be unavailable or operating remotely. Several teams required to respond may do so using language and terminology that is not clearly understood by all. Teams and individuals may have competing priorities and parallel reporting structures. Additinally, operational decisions can rapidly create unexpected or unplanned legal, regulatory, financial or reputational consequences elsewhere for the organisation.
Under these conditions, the existence of a plan provides limited assurance and value, if the people expected to implement it have never practised doing so. An exercise exposes the difference between the organisations assumed ability to respond and its genuine capacity to respond effectively.
What assumptions should crisis management exercises test?
Exercises provide an opportunity to deliberately challenge the assumptions on which response arrangements depend before those assumptions are tested by a real disruption. That could include whether:
- key decision-makers are available when required
- alternative leadership arrangements work when they are not
- communications systems remain available and secure
- critical information reaches the right people quickly enough
- suppliers and other third parties respond as expected
- teams understand one another’s responsibilities and terminology
- the organisation can adapt when an incident develops differently from the scenarios anticipated in its plans
The purpose is not to prove that every assumption is wrong. It is to understand which assumptions are critical to the response and what happens when they no longer hold.Why crisis management exercises matters more now
Why crisis management matters more now
The global economy and wider society are moving faster, is more interconnected and far less forgiving, than in the past.
Cyber incidents can disrupt multiple business functions almost simultaneously. Supply-chain failures may spread across organisations, sectors and even legal jurisdictions. Social media can turn an operational issue into a reputational crisis before the crisis management team has even received their first situation report. Artificial intelligence is increasing both the speed at which information is produced and the complexity verifying what is reliable.
At the same time, regulators, customers and boards and investors increasingly expect organisations to demonstrate that their resilience arrangements work. It is no longer good enough to show that plans exist. Organisations must be able to evidence that these plans and importantly the individuals responsible for implementing them, have been tested, any lessons identified and necessary improvements have been implemented.
Exercising international good practice
International good practice reflects this shift. ISO 22398 provides guidance for planning, conducting and improving exercise programmes, while ISO 22361 places exercising within the development and continual improvement of strategic crisis management capability.
Both reinforce a wider point, exercising should not be viewed simply as an isolated validation activity at the end of the planning process. It forms part of the ongoing development of organisational capability
The question for leaders is therefore changing from, “Do we have a plan?” to, “Can our people use our plans effectively when the situation is uncertain, escalating and significantly consequential?”
Common Questions
What is a crisis management exercise? A crisis management exercise is a controlled activity used to develop or test how individuals, teams and organisations respond to disruption. Depending on its objectives, it can examine plans, roles, escalation, decision-making, communication, coordination and other response capabilities.
Can reviewing a crisis management plan demonstrate readiness? Not on its own. A review can establish whether a plan is current, complete and understood, but it cannot show how people will use it when information is incomplete, circumstances change or assumptions fail. Exercising provides an opportunity to observe how those arrangements work in practice.
What assumptions can crisis management exercises expose? Exercises can challenge assumptions about the availability of people, technology, information, suppliers and other dependencies. They can also reveal assumptions about authority, escalation and how different teams will coordinate when an incident develops differently from what was anticipated.
Should a crisis management exercise test the plan or the people? Both, but neither in isolation. The purpose is to understand how effectively people can use the organisation’s plans, structures and resources to respond. An exercise may reveal weaknesses in the plan, but it may equally expose issues with decision-making, coordination, authority or information flow.
Should crisis management exercises focus on the organisation’s most likely risks? Exercises should use credible scenarios relevant to the organisation and its risk environment. However, not every exercise needs to rehearse the most likely event. Varying causes, impacts and levels of uncertainty can help determine whether teams can apply their crisis management capabilities when disruption develops in unexpected ways.