Why Crisis Plans Fail When the Crisis Actually Arrives
Organisations rarely fail in a crisis because they have no plan. They fail because the plan was written for someone reading at leisure, not for an executive deciding with half the information and no time to wait for the rest.
The binder nobody opens
A two-hundred-page manual feels like diligence. It gets signed off, filed, and cited in board papers. Then a ransomware attack lands on a Sunday and nobody opens paragraph 4.2 of appendix C.
The first two hours are the ones that matter, and what arrives in them is usually incomplete, sometimes contradictory, and occasionally just wrong. Teams that have never sat inside that fog in a safe room tend to do one of three things: wait, argue, or say something public they cannot take back.
Who can say yes at 2am
The gap I see most often is between authority on paper and authority in practice. Governance frameworks are good at setting out who approves a budget. They are much quieter on who can cut the connection to a compromised supplier at two in the morning.
Without that boundary settled in advance, a leadership team defaults to consensus. Twenty minutes becomes two hours, and the incident keeps moving while the room waits for permission.
Resilience is not predicting the disruption. It is making the first thirty minutes instinctive, so that when the plan stops matching reality, people still know how to decide.
Practice beats documentation
A plan describes a company that no longer exists by the time the crisis starts. An exercised team is a different asset. They know the room, the escalation route, and the sound of each other under pressure.
That is what a well-run exercise actually buys you. Not a certificate. A group of people who have already had the argument once, in private, before it mattered.
Discuss this scenario with Mitali Thapar
Confidential executive discussions for C-suite leadership and audit committees.