The hidden weakness in your business continuity response is untested assumptions

Business disruption rarely unfolds exactly as expected. Identifying and stress-testing the critical assumptions behind response plans can expose hidden dependencies and weaknesses before a real event does.

Imagine a wildfire moving towards a critical site. The building itself has not been damaged. But smoke is affecting the surrounding area. Roads are closing. Some employees have evacuated their homes. Public authorities are considering access restrictions, and the reliability of power and water supplies is uncertain.

At what point do you activate your emergency response and business continuity plans?

Should an approaching wildfire trigger a response when it’s five, three or one mile away? There may be no universal correct answer. What matters is understanding the decisions you may need to make, the information you will rely on and the assumptions behind your response.

A risk-mature organisation is likely to have emergency response plans to protect people and assets, alongside business continuity arrangements designed to keep critical operations running.

However, having plans is not the same as being resilient. The real test of resilience is whether the assumptions underpinning those plans still hold when conditions change.

Disruption doesn’t respect organisational boundaries

Organisations understandably focus risk management efforts on things they can control. But many of the dependencies determining how successfully an organisation responds to disruption sit outside its direct control.

Wildfire illustrates this clearly. Public authorities, access roads, surrounding vegetation, neighbouring businesses, utilities and changes in land use can all affect an organisation's exposure and its ability to respond.

The same principle applies much more widely. A flood could leave a facility undamaged but inaccessible. A regional power outage could affect both a site and its alternative locations. A transport disruption could affect several apparently independent suppliers. A cyber incident affecting a critical technology provider could interrupt multiple parts of an organisation or its supply chain simultaneously.

Effective resilience planning needs to look beyond the boundaries of an individual site or organisation.

Improving resilience does not always require major capital investment. The challenge is also knowing which resilience measures justify that investment. Risk models and hazard data can inform that decision, but they should not determine it in isolation.

Testing assumptions against site conditions, operational knowledge and credible disruption scenarios can help organisations prioritise the interventions that will make the greatest difference.

Relocating external storage or improving vegetation management may reduce physical exposure. But resilience could equally be strengthened by validating alternative access arrangements, establishing backup communications, confirming alternative supplier capacity or creating clearer decision triggers.

An undamaged site does not mean an uninterrupted business

Significant disruption can happen without direct physical damage. A site might be inaccessible because roads have closed. Public authorities may restrict access. Employees may be unable to travel safely. Power, water or telecommunications may be disrupted. A critical supplier could be affected by the same event.

For Risk and Insurance Managers there are two important questions:

1. How do we continue to operate?
2. How will our insurance policy respond?

The existence of a robust continuity plan does not determine whether a particular loss will be insured. Equally, insurance does not remove the need for operational resilience.

Insurance coverage will depend on the circumstances of a loss and the wording of the individual policy. That makes it valuable to explore potential gaps before an event rather than discovering them during one.

A credible loss-scenario exercise bringing together risk, business continuity, insurance, risk advisers and insurers can test both the operational response and understanding of how the insurance programme could respond, particularly where interruption occurs without direct physical damage.

Stress-test the assumptions, not just the plan

Consider a continuity plan that identifies three alternative suppliers for a critical component. On paper, that appears to provide resilience. But what if all three depend on the same transport corridor, utility provider, technology platform or upstream supplier? Three alternatives on paper can be one underlying point of failure.

The same challenge can occur elsewhere in a response plan. It might assume employees can reach a site, key decision-makers will be contactable, emergency services will be available, mains water and power will continue operating, or an alternative location can accommodate displaced activity at short notice.

Each of these assumptions can be stress-tested. The most revealing exercises can stress-test several assumptions at the same time. What if the backup site is available but employees cannot reach it? What if an alternative supplier has capacity but relies on the same disrupted transport route? What if the site is undamaged but both access and mains power are lost?

An effective stress-test should answer three questions:

1. What assumptions does our plan rely on, and what evidence do we have to support them?
2. Which assumptions are most critical to its success?
3. When were they last validated?

Five questions for your next stress test

An effective response plan will make its critical assumptions explicit. Whatever scenario is being considered, five questions can help expose assumptions that might otherwise remain hidden:

1. What decisions would we need to make, and what triggers them?

   Identify who has authority to activate emergency response and continuity arrangements, close a site or order an evacuation. Establish what information they would need and where it would come from.

2. Which assumptions must remain true for our plan to succeed?

   Challenge assumptions about access, utilities, workforce availability, technology, emergency services, alternative sites, suppliers and recovery timelines.

3. What dependencies outside our control could change the outcome?

   Consider neighbouring sites, infrastructure, transport routes, utilities, public authorities, technology providers and environmental conditions.

4. Where could apparently independent alternatives share the same point of failure?

   Different suppliers may share the same upstream manufacturer, logistics hub, utility or technology platform. The objective is not to map everything. It is to identify dependencies that could create a single point of failure.

5. Do we understand the insurance response?

   Include scenarios in which operations are interrupted despite the absence of direct physical damage. Consider the implications with your risk advisers and insurers before an event occurs.

From having a response plan to knowing it works

Wildfire is only one illustration of a much wider resilience challenge. Flood, power failure, transport disruption, cyber incidents and supply-chain events can look different.

They can also expose the same underlying weakness: the gap between what a plan says should happen and the assumptions that must remain true for it to work.

Stress testing provides an opportunity to find that gap before a real event does. The question for your organisation is probably not “do we have a plan for this?” but “what assumptions are we making in our plan, and when did we last prove that they are true?”