Continuity Is Not a Document

Continuity is treated here as a standing operational capability, not a document. That distinction sounds like positioning until you look at what a plan actually is, which is a set of predictions about conditions, written by people who were not under pressure at the time.

Peter Drucker's formulation is the useful one: the greatest danger in times of turbulence is not the turbulence, it is to act with yesterday's logic. A binder is yesterday's logic, bound.

Four assumptions that fail in contact

A continuity plan fails in specific and repeating ways, and each is an assumption that was reasonable when written.

It assumes the people named are reachable. Plans are populated with roles and the individuals holding them, and the failure is rarely that someone is unwilling. It is that the event affects the same people the plan depends on — the same building, the same city, the same network, the same weekend. A plan that names individuals without naming the condition under which authority moves to someone else has not been written for the case it exists to cover.

It assumes the systems it depends on are the ones still running. Every plan has dependencies, and the dependencies are usually documented one layer deep. The contact list is in a system. The system authenticates against a directory. The directory is hosted somewhere. Each layer is fine until the layer beneath it is the thing that failed, and the layers beneath are exactly what nobody mapped.

It was written by a function that does not hold the authority to execute it. This is the most common structural defect and the least discussed. Continuity planning is typically owned by risk, compliance or operations, while the decisions the plan calls for — suspending a business line, moving money, speaking publicly, standing people down — sit with executives who did not write it and in some cases have not read it. The document therefore describes actions its author cannot take, addressed to people who have not agreed to take them.

It has never been tested against a scenario nobody anticipated. Testing against the anticipated scenario confirms the plan matches itself. The value is in the scenario that was not on the list, because that is the only test that reveals whether the organisation has a capability or a description of one.

What the regulator concluded

It is worth noting that a supervisor confronted with the same problem reached the same answer, and did so in a form that can be checked.

The Financial Conduct Authority's operational resilience rules came into force on 31 March 2022. They do not require firms to have a plan. They require firms to identify their important business services, set impact tolerances expressing the maximum tolerable disruption to each, map the resources those services depend on, and test. By the end of the transitional period on 31 March 2025, in-scope firms had to have performed mapping and testing sufficient to provide assurance that they could remain within those tolerances in severe but plausible scenarios.

Two features of that design are instructive. The first is that the unit of measurement is a tolerance rather than a document — a statement of how much disruption is survivable, against which any arrangement can be assessed. The second is that remediation is closed out by repeated scenario testing that verifies the vulnerability is actually resolved, rather than by a revised procedure. And the obligation does not end at the deadline: services, tolerances and mapping are reviewed at least annually and on material change.

None of that is a documentation exercise. It is a posture, maintained.

Why plans get written anyway

It is worth being fair to the binder, because it is not produced by stupidity. It is produced by incentives that are entirely legible.

A document is auditable, and an auditor can confirm it exists. It can be approved at a meeting, which converts an open-ended obligation into a completed action with a date. It can be shown to an insurer, a counterparty or a board committee. And it is cheap relative to the alternative, because a capability has to be staffed and exercised continuously while a plan has to be written once and reviewed annually.

So the binder is a rational response to being asked to demonstrate preparedness, which is a different requirement from being prepared. The two diverge quietly and only at the moment nobody wants to discover the difference. Recognising that they are different requirements — and that most organisations have been asked for the first while believing they were procuring the second — is most of what this subject requires.

What a posture consists of

The components are unglamorous and they are the whole thing.

Identifying single points of failure, and doing it at the layer below the one that is obvious. Establishing protocols that hold when conditions do not, which means protocols expressed as decision rights and thresholds rather than as sequences. A situation room that is mobile rather than physical — the capacity to notify and coordinate a crisis management team regardless of location or time zone, because the premise that people will convene somewhere is itself a dependency.

Then the parts that operate after the moment: decision documentation and audit trails, kept contemporaneously, because a decision taken under pressure is reconstructed afterwards by parties with an interest in the reconstruction. Scenario modelling and contingency testing, including against events chosen by someone whose job is to choose awkwardly. And post-crisis debriefing, conducted while recall is fresh and before the account has been smoothed into something presentable.

The tell is simple enough to apply from outside. Ask when the plan was last executed under pressure — not reviewed, not updated, not signed off, executed — and by whom, and what changed as a result. An organisation that cannot answer has a document. The answer takes about a minute to give and it is the only part of the whole subject that cannot be produced retrospectively.