Why Plans Fail

Most organizations with robust crisis, emergency, or business continuity plans expect that when the “thing” happens they’ve got it covered.

But anyone who has ever had to operationally manage an incident knows that this isn’t always true. Having that tidy 100-plus page plan and that digital platform with the nifty checklists isn’t going to keep you in operation if your program wasn’t designed with success in mind. 

Top Ten Reasons Plans Fail

It’s a tidy list, but let’s break it down. 

1. No senior management support

Inhouse crisis management and business continuity teams are frequently tasked with building a program that ends up being in a silo. They’re disconnected from senior leadership and when you’re not in the room where organizational decisions are made you can get left out of the process. And sometimes it’s that senior management doesn’t value the art of threat identification and risk management. Some senior leaders have a world-view that acknowledging a threat to resilience is akin to courting failure. It’s hard to overcome lack of senior management support, which is why it’s number 1 on this list.

What we’ve found that helps is to establish a resilience governance council with managers and leaders from departments that have faced an impact to resilience. The governance council can sometimes speak up and get senior management support. Another way is by bringing in outside consultants. I realize this sounds self-serving, but sometimes senior management values the advisement of someone they’re paying over their internal teams. We promise that we’ll say the same things you do and we’re sorry if that results in our being listened to when you’ve been delivering the same message, but our goal is to support anyone trying to get an organization to a place of resilience. 

2. Lack of employee buy-in

This is especially a problem when the plan is employee-facing, like an EAP or evacuation plan. No one likes to have their day interrupted with an evacuation drill or a safety training when 99.9% of the time nothing that threatens safety happens. How do you get people to be prepared without seemly like a crazy prepper?

In our experience, the answer is in establishing a volunteer safety team made up of employees who are trained in emergency actions like basic first aid and evacuation. This can really help establish a culture of safety. We also have found success in making the materials that are employee-facing as bright, well-written, and tightly constructed as possible. Give them something engaging to look at and they might be more interested in how you’re helping them get out of a burning building safely. 

3. Poor or no planning

You can’t have a successful plan if you’ve done no planning. This seems obvious, but I’ve run into my share of organizations that really do think it’s okay to just wing it when it comes to crisis and emergency. And you know what? I’ll say that sometimes things come out okay when the plan is to wing it, but in every instance I know that’s because the person leading the response had excellent instincts, good leadership skills, and a past in either law enforcement or the military. And you just can’t count on that. What if this one magical unicorn of a response manager goes on vacation!

4. Lack of training and practice

I’ve evaluated everything from large corporate headquarters to complex manufacturing facilities to data centers and discovered that no one can even remember the last time they tested their plans. If you don’t practice and you don’t do basic training on how to activate and use your plan, you have no idea if it will actually work or if anyone will even remember what’s in it. Because the reality is that plans are a way to coalesce everyone around a set of standards and principles, but no one is going to pick up and READ the plan during an emergency. Teams tasked with response have to know and have practiced what is in the plan. And that goes for crisis management leadership plans as well. If you’re only doing a tabletop exercise with your executive team once a year or less, your team is likely going to be late off the starting block when it comes to mounting a successful crisis management response. 

5. No designated leader

I always try the gentle approach with teams who swear they don’t need a leader. Usually it’s because the culture is to operate by committee or by consensus. I promise you, this does not work in a crisis and here’s why: almost all people will have an adrenaline response in an actual incident. (former military and law enforcement are sorta excluded from this) And this response will short-circuit their ability to engage in strategic thinking. You know what happens when you are in a muddle and can’t think? You look for the first person who will tell you what to do. Plans need designated leaders and those leaders need to be especially trained to pick up the reins and guide the response. 

6. Failure to keep the plan updated

Changes in operating environment, team structure, re-orgs, and even just the normal course of “things change” require that your plan is kept updated. I’ve seen plenty of instances where a business continuity plan relies on a person to do a thing and that person hasn’t been with the company for YEARS. The other thing I see frequently is that the RTO and RPO in business continuity has not been adjusted for a SaaS approach. And in complex facilities where equipment changes can mean big changes to critical shut down procedures, this is especially critical. One the worst examples I’ve seen is in a data center that formerly had a halon system but had not updated any of their signage or standard operating procedures. This was dangerous not just for the team at the data center, but for first responders who might have equipped themselves for the wrong potentially toxic environment. 

7. No method of communication to activate the team

Believing that a crisis will strike at 1:23 pm just when lunch is over and everyone will magically know to head to the designated conference room or hop on the specified video call is just the highest folly. I helped a client in the immediate aftermath of the Paris Bataclan Theatre attacks and the team leader of the Paris office was at Euro Disney with his very small children. He’d happened to look at his phone, saw the news, and waited for a call that never came. He had to hide out in the bathtub of his hotel room and activate everyone on his crisis management team himself. No matter the size of your organization, you need a method to let the team know they are needed and you must train them on how that happens and then you need to drill it so they are reminded. In the age of asynchronous communications, we’ve even helped clients build Slack bots so the activation is managed on the platform the team is already using. 

8. Failure to consider regulatory requirements as part of the plan

We advise clients that it’s critical that they make fair, timely, and accurate notifications as part of their crisis management cadence. But that’s not the only regulatory matter to address – too many organizations don’t understand how they must comply with applicable laws in how they structure their response. 

9. No procedures to shut down critical equipment

I’ve seen this enough times to note that it’s a constant in plan failure. Every piece of complex machinery and critical systems must have a runbook or SOP that spells out cleanly and clearly how that system is taken off-line or out-of-service. 

10. No set meeting agenda to guide action

Crisis management activations can quickly become uncontrolled talk-shops where each person feels compelled to speak for a matter of minutes on things that are neither strategic nor important. An agenda that controls the conversation, establishes a regular cadence, and is repeatable and trainable goes a long way to keeping the responding team biased towards action. And the best practice is to use the agenda as part of your tabletop exercises so it becomes second nature. 

With care, you can overcome these plan failures. 

We believe the right program and the right guidance can overcome the vast majority of plan failures. It just takes focus and an acknowledgement that when it comes to organizational resilience and survival, failure is not an option.