Georgie & Cog: “The recovery plan”

schedule1 Min Read

A recovery plan can be hundreds of pages long, meticulously governed and beautifully cross-referenced. None of which guarantees anyone can recover anything.

The plan exists.

The question is whether it works.

Banks devote considerable effort to recovery and resilience planning, with good reason. Critical services need clear playbooks for liquidity stress, cyber incidents, payment disruption, third-party failure and the many other ways an ordinary Tuesday can become considerably less ordinary.

The documentation can be formidable.

Policies lead to playbooks. Playbooks lead to decision trees. Decision trees point towards escalation procedures, crisis-management plans and supporting annexes. Somewhere in there sits the answer to what people should do when something goes wrong.

Then Georgie asks the question that changes the conversation:

“Has anyone ever used it?”

Operational resilience becomes meaningful when plans survive contact with reality. That means exercising them, finding the dependencies nobody documented, discovering which information cannot be reached during an incident and seeing whether the people expected to make decisions can find what they need quickly enough to make them.

A plan written for completeness can behave rather differently from a plan designed for use at 3am during an actual crisis.

And there is a particularly lovely form of governance recursion lurking in all this.

Cog opens the recovery plan.

Page one says:

“See crisis management plan.”

The crisis management plan?

“See recovery plan.”

At which point the organisation may have achieved something close to perpetual operational resilience.

About the Author