The Readiness Gap: Why Organizations That Test the Plan Still Struggle in Crisis

At 8:40 a.m. on a routine Tuesday, a regional manufacturing facility fell silent. A key supplier had suddenly halted shipments, stopping the automated production line midcycle. Within hours, employees flooded the HR hotline seeking guidance. By midday, major customers were inquiring about delayed deliveries. By evening, the issue had attracted attention from local media, while social media were already circulating conflicting and often inaccurate accounts.

Inside the organization, the real crisis was not operational but decisional.

What exactly happened?

Are our people safe?

What is the immediate business impact?

Who is in charge?

Should we activate the crisis management team?

Do regulatory notifications apply?

Is this a contained supply-chain issue or the start of a broader reputational crisis?

The company had a documented crisis plan, assigned roles, and conducted training the previous year. Yet escalation dragged, coordination broke down, and teams quickly discovered that knowing the plan is not the same as executing it under pressure.

As Dwight D. Eisenhower observed, “Plans are useless, but planning is indispensable.”

The gap rarely stems from a lack of effort. It usually results from insufficient progression in how preparedness is built, especially when organizations rely on isolated exercises that are not part of a deliberate developmental sequence.

Many security and risk professionals are familiar with the widely recommended crawl-walk-run approach to crisis exercising. While that foundation remains valuable, the persistent readiness gap reveals a deeper issue: Even organizations that conduct exercises sometimes treat them as compliance checkboxes rather than opportunities to build progressive capability.

This gap leaves leadership teams unprepared for the real decisional challenges that define crisis outcomes.

The Illusion of Having “Tested the Plan”

Testing can mean anything from a document review to a tabletop discussion or an evacuation drill. According to the Business Continuity Institute’s Crisis Management Report 2024, 75.1 percent of organizations activated their crisis teams in the prior year, yet only 22.4 percent rated their overall capabilities as “excellent.” The disconnect is clear: Exercises are happening, but they frequently fail to translate into reliable performance when disruption strikes.

This problem usually traces to one root cause—exercises lack a structured progression that moves teams from basic awareness to confident execution. Crisis competence is not built through isolated simulations alone; it develops layer by layer.

Build Awareness First

Every strong program begins with shared foundational understanding. New team members must internalize governance structures and decision frameworks. Senior leaders need clear escalation thresholds. Functional departments require defined responsibility boundaries.

Awareness sessions and plan reviews answer a critical question: Does everyone truly understand what is expected when disruption hits?

At this stage, misconceptions often surface—especially among executives who assume a written plan equals capability, that assigned roles equal accountability, or that seasoned leaders will instinctively rise to the occasion.

In practice, crisis decisions occurring under incomplete information and extreme time pressure rarely feel intuitive. Security professionals who facilitate these early sessions frequently encounter resistance rooted in overconfidence.

Validate Procedures in Practice

Once awareness is in place, the next layer is making procedures operationally viable. Paper plans often hide flaws that emerge only when teams walk through them step by step:

Who notifies whom, via which channel?

How long does real-world escalation take across distributed or hybrid teams?

Who tracks employee accountability during a disruption?

This validation phase uncovers duplicated efforts, conflicting workflows, unrealistic timelines, and overlooked dependencies. Addressing these issues early prevents later exercises from wasting time on basic design flaws. It also builds the procedural confidence necessary before testing higher-level judgment.

Test Leadership Judgment Under Pressure

With workable procedures established, tabletop exercises shift the focus to decision-making. Leadership teams confront realistic scenarios involving genuinely competing priorities: balancing employee safety against operational continuity, legal requirements against reputational risks.

These exercises expose whether escalation logic holds under uncertainty, how cross-functional coordination performs, and whether decisions happen quickly enough to influence outcomes. They also highlight assumptions about information flow that routine management experience rarely prepares leaders for.

Progressive organizations view these exercises not as role play, but as essential rehearsal for the high-stakes conference-room decisions that often determine crisis success or failure.

Execute Under Realistic Conditions

Full-scale live drills represent the final validation layer. Command structures activate, alternate processes run in real time, and teams confront measurable realities: communication delays, staffing gaps, equipment limitations, and interdepartmental friction.

It is in this phase that organizational culture truly reveals itself—not in documented policies, but in performance when pressure is applied. Readiness finally moves from theoretical discussion to demonstrated competence.

Why Progression Outweighs Realism

Jumping prematurely into highly complex or realistic simulations without foundational layers often produces frustration and limited insight. Each stage—awareness, procedural validation, judgment simulation, and live execution—serves a unique developmental purpose. When sequenced deliberately, these activities convert conceptual plans into operational resilience.

Aligning with ISO 22301:2019

This layered approach aligns closely with ISO 22301:2019, the international standard for business continuity management systems. Clause 8.5 mandates a documented exercise program that validates strategies and solutions over time. ISO 22301 calls for exercises that reflect organizational objectives; test realistic scenarios; and strengthen teamwork, competence, and decision‑making over time.

Crucially, in Clause 10, the standard emphasizes that exercises must fully validate capabilities, produce formal reports with actionable improvements, and support continual enhancement. Recent guidance and updates increasingly emphasize considering climate-related disruptions in risk assessments and planning, underscoring the need for adaptable, progressive programs.

Security and risk managers who structure exercises this way not only meet certification expectations but create resilience that extends beyond certification requirements.

A Progressive Exercise Pathway

Building on established crawl-walk-run principles and aligned with ISO 22301 Clause 8.5, the following pathway provides a deliberate, four-stage sequence that moves teams from shared awareness to demonstrated capability.

• Awareness (Talk): Build shared understanding of roles and thresholds.
• Success metric: All participants can clearly articulate escalation criteria
  
  
• Validation (Walk): Test procedures step by step.
• Success metric: Resolved workflow conflicts and documented realistic timelines
  
  
• Simulation (Pressure): Challenge leadership judgment in scenarios.
• Success metric: Consistent decision logic and improved speed under uncertainty
  
  
• Live Drill (Run): Activate full structures and processes.
• Success metric: Quantifiable results (e.g., stakeholder notification times, recovery task completion rates)
  
  

Crisis readiness is not proven by discussing what the organization would do in theory. It is proven by progressively verifying what it can do in practice.

As American football coach and executive Vince Lombardi famously noted, “Practice does not make perfect. Only perfect practice makes perfect.” Failures in crisis management rarely stem from a lack of intelligence or good intent. They arise from hesitation, uncertainty, and unfamiliarity when real pressure arrives.

Organizations that invest in deliberate progression will still encounter disruption. But they greatly reduce the danger of discovering operational weaknesses for the first time during an actual event, when the most consequential decisions are made in conference rooms with incomplete information and limited time.

That is not when organizations should be improvising for the first time. Security and risk leaders who champion a progressive exercise program give their organizations a genuine competitive edge in resilience.

Flecher Feng, CPP, PSP, CFE, MSI, is a senior corporate security manager based in Shanghai, China, with more than 20 years of experience across construction, supply chain and logistics, aviation security, and the pharmaceutical industry. He is the author of The Complete Guide to Security Professional Certifications.