Luck Is Not a Continuity Strategy
“The only thing worse than no plan is something that’s untested and not validated. That’s actually worse than having no plan at all.”
When we polled the room during a recent webinar, 60% of attendees said the same thing: luckily, we've never had to use our BCP. Said out loud, it sounded like relief. It isn't. It's a bet.
Not having activated your plan yet says nothing about whether it would actually work. It just means your luck hasn't run out. And 20% of respondents told us they've never tested their plan at all, which is a separate and arguably bigger problem than not having one.
Here's how most municipalities end up in this spot. A BCP gets built as a one time capital project. Someone runs the business impact analysis, drafts the plan, checks the box. Then it sits on a shelf. No annual funding, no owner, no update cadence. Business operations keep changing underneath a document that hasn't moved in years.
A few signs you might be sitting in the optimism trap right now:
● Nobody can name who owns the plan. The honest answer is usually "IT," which is itself the problem.
● The plan predates your last reorg, your last new service, or your last staffing change.
● No tabletop exercise has run in the past twelve months.
● Recovery time objectives were written once and never revisited against what the business actually needs today.
Sometimes luck runs out in ways nobody planned for. One county government we worked with had a tornado hit its main facility, then keep moving down the road and hit its secondary backup facility too. Both buildings, same storm.
That's an extreme example, but it makes the point. A plan that's never been tested against a real scenario isn't a safety net. It's a guess dressed up as a document.
“We worked with a county government that had a tornado come through town. It hit county hall, then carried on down the road and hit their secondary backup facility too”
The fix isn't complicated, and it doesn't require predicting the next disaster. It requires treating business continuity as a funded, owned, tested program instead of a project that ends when the plan gets filed away. Small, frequent updates. A named owner in every department. A tabletop exercise on the calendar, not just on the wish list.
You don't need to know what's coming. You need to know your plan works before you're relying on it to.
We covered this in more detail during our webinar, Business Continuity Planning That Actually Works — From Plan to Practice. If you want the full conversation, including the county government tornado story, check out the replay
This article was prepared with the assistance of AI.