The unknown unknowns

The many years of consulting has taught me one uncomfortable truth about organisational resilience: most Crisis Management Teams don't know what they don't know about their own vulnerabilities.

Not because they're careless. Because resilience is one of those capabilities that only becomes visible when it fails — and by then, the window for good governance has closed.

Business continuity isn't a plan in a drawer. It's a culture. It's the way decisions get made when the pressure is real, the systems are down, and the team is looking to leadership for clarity that the situation doesn't naturally provide.

I've sat with crisis management teams walking through cyber incident scenarios. The conversation changes the moment someone asks: "If this happened on a Tuesday morning, who would actually be making decisions — and on what authority?" The silence that follows that question is instructive.

There are often decisions that exceed the delegated authority of the Crisis Management Team and need the specific approval of the Board. Often, these approvals have not been discussed beforehand.

Is your organisation one of those?

Before the crisis hits your organisation, it is important that these issues are discussed between your Board and the Crisis Management Team and are documented before the next crisis hits.