Crisis Indecision

Here's a question that stopped a boardroom cold last year:

"If your organisation had to operate without IT for 72 hours starting right now — what would actually break first?"

Not the systems. Not the servers. It’s more likely that decision making will be impacted the most.

After many years of helping organisations develop business continuity plans, improve crisis management and working with Boards, I've noticed something consistent. Organisations invest heavily in recovery plans but chronically underinvest in crisis decision-making capacity.

Plans sit in folders. Exercises happen once a year if you're lucky. And when a real event hits - a cyber incident, a supply chain failure, an extreme weather event - the bottleneck is almost never technical. It's the leadership team not knowing who has the delegated authority, who communicates what and in what order. Often, reporting obligations to regulators are unknown.

The frequency and intensity of disruptions is increasing and many Boards are giving insufficient attention to resilience.

The Boards I've seen handle crises well share three things:

·       They've practised decision-making under pressure, not just plan-reading

·       They have clear escalation protocols the whole organisation understands

·       They treat resilience as a strategic asset, not a compliance checkbox

Governance isn't just about what's on the agenda. It's about whether your organisation can keep functioning - and keep serving its stakeholders when things go wrong.

What's your organisation actually exercising? And how confident are you that your Board could navigate a 72-hour disruption?