Why crisis preparedness is important

We all know that a crisis can hit any business, no matter how big or small, at any time. Many organisations feel confident because they have crisis plans, major incident documents and business continuity plans tucked away somewhere. But it’s when those plans are actually tested - put under real pressure - that the real learning happens.

Often the plans are filed away for a rainy day, metaphorically gathering dust and slowly going out of date. And when they are needed, business leaders quickly discover they’re not quite as helpful as they hoped. People have left. Emergency contact lists haven’t been updated. Scenarios are years old and full of gaps. Before 2020, hardly any plans included a pandemic - and most wouldn’t have seen the value in adding one.

If your plan hasn’t been updated in the last few years, does it include cyber-attacks? Misinformation? AI-generated deepfakes? These are no longer ‘future’ risks; they’re here now.

Having a plan is a great first step. Keeping it up to date - and testing it - is crucial.

Some of the scenario tests we’ve run in the past highlighted basic but critical flaws, starting with something really simple: accessing the plan. If you’ve got one, make sure people know where it is. Make sure they can get to it even if your servers or email systems are down because of a cyber incident.

Once a crisis is declared, roles need to be allocated quickly. Plans should set out who does what, and what’s expected of them. If you’ve tested your plan, people will already understand the role they’re likely to take. If you haven’t, it can be overwhelming for people to absorb all of this in the middle of a stressful situation.

Another important role -often forgotten - is the notetaker. In the heat of a crisis, note‑taking can feel like a luxury, but afterwards those notes are vital. They record key decisions, who made them, and at what point. They’re important legally, financially, and for strengthening future responses.

Testing the plan is the best way to improve it and to become as crisis‑prepared as possible.

We don’t live in a world where crises politely arrive Monday to Friday, between 9 and 5, or where we are only faced with one challenge at a time. When a crisis hits, people are expected to know how to respond, no matter what else is going on.

I read something recently that said crisis management needs to shift from a reactive function to a continuous discipline - and I couldn’t agree more. While we suggest at least annual testing of plans, in an ideal world crisis preparedness would feature on monthly meeting agendas, with dedicated teams responsible for keeping plans up to date and ensuring testing is regular, robust and builds resilience.