5 min read
Resilience is built before the crisis
On a Monday at 6:40 a.m., the operations manager of a 180-person logistics company finds that the warehouse software has stopped responding. Three trucks are waiting at the dock, the mail system has gone down along with everything else, and nobody yet knows whether it is a failure or an attack. This case is fictional, but many executive teams will recognize it, and it raises the question of this article: what decides what happens next is less the tools the organization has bought than the decisions it has already made, and rehearsed, before that Monday.
What a continuity plan does not say
This company has a continuity plan. A consultant wrote it two years ago, management approved it, and it was filed on a network share, which happens to be one of the systems that went down this morning. Even printed, it would be of little use at 6:40 a.m., and the reason has nothing to do with negligence: a plan describes the organization as it was on the day it was written. Since then, two managers have changed jobs, the warehouse has moved to software hosted by a supplier, and the IT director’s on-call number belongs to a phone the company has since replaced. Each of those changes made a line of the plan wrong without anyone noticing, because nothing in the ordinary life of the company ever comes along to check those lines.
That is the whole difference between a document and a capability. A document can be verified at a glance: it exists, it was signed, it was up to date on a given day. A capability can only be verified in use: it means carrying on delivering the essential services during a shock, then returning to normal without losing what matters. It depends on what people know how to do together when conditions are bad, and neither insurance, nor backups, nor the plan takes its place. Those are necessary ingredients, but one Monday morning is not enough to put them together.
Decisions that should not be made in the heat of the moment
Back to 6:40 a.m. In the room where four or five managers gather, the scarcest resource is not technical, it is attention. Every decision made on the spot uses some of it, and uses more when information is missing, when time is short and when the consequences reach customers. As long as the group debates the nature of the failure, it is not dealing with what is already costing money: three trucks waiting and the day’s deliveries that will not leave.
Yet many of these decisions could have been made in advance, calmly. Which services are essential, and in what order do we want them restored? Who can decide to cut a connection, or stop a line, without waiting for approval from someone who cannot be reached? Who speaks to employees, customers and the authorities? What degraded operation is acceptable, and for how long? For this company, a single one of these answers would have changed the morning: knowing that the operations manager is allowed to authorize paper picking slips, and that those slips are printed somewhere. Without it, the dock waits for a decision nobody feels authorized to make, even though it would cost almost nothing. When the answer to all these questions is “we’ll see”, the crisis starts costing money before anyone knows what it is about.
What only a test reveals
You cannot tell whether a plan works by rereading it. Rereading checks the consistency of the text, not the capability of the team, and that is why a test has a value of its own: it takes place with limited time, partial information and people who are not all the ones the plan names, because one is on leave and another is ill that day. Under those conditions the gaps appear: the outdated phone list, the password to a critical account that only one person can open, the decision everyone expected someone else to make. None of them is spectacular, and all of them are expensive to discover on a Monday at 6:40 a.m.
Every gap found during an exercise is therefore a gap you do not meet during the real crisis, and in that precise sense the exercise protects. It also does something else, which is harder to measure: a team that has already played a crisis situation reacts differently the next time. It knows the vocabulary, knows who does what, and has already felt the pressure, which paralyzes it less. A large part of an incident is decided by the quality of the coordination, far more than by the choice of a tool.
Where to start
Three steps are enough to begin, and none requires a budget. The first is to list five to ten services whose interruption would hurt most, and to write down, for each one, how long the company can do without it. The second is to note, for each service, who decides and who stands in for that person when they are absent. The third is to have the team play the loss of one of those services, with the people who would really be in the room, and to note, without comment, what did not work.
The most important part remains: fix it, then go again with another scenario. For the logistics company, that could mean a first exercise on the dock and paper, a second on the loss of the mail system, a third on a supplier who has become unreachable. Resilience is never finished, it is maintained, through small sessions rather than one large project, and an organization that has understood this does not wait for a Monday at 6:40 a.m. to find out what its decisions are worth.