The Plan You Hope Never to Use

Business continuity has an unusual property as a discipline: the better it works, the less evidence there is that it did anything. Nothing happened. No claim, no outage, no incident report. The work is invisible precisely when it succeeds, which makes it a difficult thing to fund and an easy thing to let drift.

The drift is rarely in the document. Plans get reviewed on schedule and signed off. It is in everything the document assumes.

Exercises find assumptions, not failures

The common objection to running exercises is that they take senior people away from operational work to rehearse something that probably will not happen. That is a fair description of a badly designed exercise.

A well designed one is not a rehearsal, and its output is not a pass mark. It is a list of assumptions that turned out not to hold. The recovery site needs a badge nobody present could issue. The supplier escalation number reaches a team that was outsourced last year. Two people believe they own the same decision and neither has told the other.

None of those are dramatic. All of them cost time in the one situation where time is the scarce resource, and none would have been found by reading the plan again.

Test the seams, not the centre

Organisations tend to exercise the scenarios they already understand — the ones with the clearest owner and the best documentation. Those are the least useful.

The failures that hurt happen at the seams: between the organisation and a supplier, between two internal teams whose responsibilities nearly meet, between a process that assumes a system is available and a system whose recovery time is longer than the process can tolerate. Seams are where nobody’s plan is wrong on its own but the combination does not work.

Frequency beats scope

An annual full-scale exercise produces a long report and a set of actions that mostly get closed before the next one. A short, narrow exercise every quarter — one dependency, one scenario, ninety minutes — finds more, because it happens often enough to catch drift while it is still small.

It also normalises the activity. When exercises are rare and large they feel like audits, and people prepare for them. When they are routine and small, they find what is actually there.

The point is not to be ready for a specific event. It is to keep the distance between the written plan and the operating reality short enough that the plan is worth opening.