In nearly every post-incident review I've sat in on, the same uncomfortable pattern shows up. The plan existed. The folder was on the shelf. And when the moment actually came, very little of it worked the way it was supposed to.

 

I've lost count of the conversations I've had with customers and partners that end at this exact realisation. It isn't that organisations lack a plan. It's that their plan is based on assumptions that don't reflect reality when things go wrong. It assumes everyone is available. It assumes the comms channels hold. It assumes each incident arrives neatly labelled and one at a time. Real incidents don't extend that courtesy.

 

When I ask people what actually keeps them up at night, the answers are rarely a once-in-a-career catastrophe that makes the world news. They're the semi-regular things: a fire, a chemical spill or asbestos release, intruders on campus, a lone working employee that collapses with nobody noticing, a sudden drone alert, a large-scale power outage, or every system going dark at once.

 

Whatever the sector, the same underlying worry appears: when this happens, will we actually be able to pull together quickly, or will it expose how fragmented we really are?

 

In my experience, the organisations that respond well make one fundamental shift in thinking: they treat emergency response as an operating capability as opposed to a compliance exercise. Crisis planning and emergency response becomes a part of their day-to-day operations.

 

Typically, they’ve managed to solve all six of the following common crisis management and emergency preparedness challenges.

 

 

Picture a major incident in its first thirty minutes. The site team is handling the immediate response, operations is assessing impact, HR is checking on affected people, legal is weighing exposure, and comms is drafting a holding statement. That’s five work streams running in parallel, without anyone holding the full picture.

 

That's fragmented communication in practice. Everyone is working hard, but each on their own piece with only the information in their own channel. The incident commander ends up stitching reality together from fragments. And the moment you have more than one system or way of sharing information, you no longer have one common operating picture to operate out of. Instead, you have multiple incomplete ones.

 

Often, the immediate suggestion that comes to mind is to simply communicate more. But that’s not the fix.

 

The fix is structured communication: one source of truth everyone can access and everyone can trust, creating a deliberate real-time operating picture. Real-time situation awareness.

 

 

The tempo has changed. Climate events, cyber threats, supply chain shocks, regulatory shifts, geopolitical instability… whatever your sector, the frequency and variety of things that go wrong has gone up. What we’ve started seeing more and more is compounding incidents. You don't finish one before the next begins.

 

Most crisis plans I see are single-thread: one incident, one team, one timeline. But you might be managing a site safety event, a supply chain disruption, and a reputational issue on social media at once. In this example, you have three responses drawing on the same leadership bandwidth and the same small pool of experienced people.

 

If you aren't systematically capturing what worked and what didn't after each one, you're simply repeating the same mistakes under pressure.

 

 

This is where response shifts into readiness. The question can’t be whether a plan exists or not, that is no longer enough. A better question to ask is whether the team has executed the crisis plan under conditions that remotely resemble a live incident. If they have, how long ago was it (and how much of the team has changed since then)?

 

The organisations that handle crises well aren't the ones with the thickest manuals. They're the ones that have built operational muscle memory through real practice, with training and exercises tracked, so they know precisely who is response-ready and who isn't.

 

Recovery, too, is part of readiness. Not just operational recovery, but confidence, reputation, and the wellbeing of the people involved.

 

 

Response breaks down most often at the handoff, and more specifically, during handoffs between teams, not within. The site team hands to corporate, operations hands to comms, initial responders hand to the next shift. Every transition is where context gets stripped out and assumptions creep in.

 

The shift change is the classic example. A team manages an incident for eight hours, then hands to a fresh team in a five-minute verbal briefing. The new team doesn't know what was tried, what failed, or that the regulator said something specific three hours earlier.

 

In several organisations, this handoff is ad hoc at best. One organisation we work with takes proper handoffs so seriously that they immediately send members of their team to rest, the moment a crisis alert goes out. This way, they ensure that a rested team can take over cleanly twelve hours later. That's the level of emergency planning I think everyone should be aiming for.

 

Something to think about: in your organisation, are roles and ownership genuinely clear, visible, and actionable? Or only documented somewhere?

 

 

In an active incident, the most dangerous thing is an assumption. Someone assumes the site has been evacuated. Someone assumes the contractor was notified. Someone assumes leadership already knows. When those assumptions prove wrong, the consequences can be severe to catastrophic.

 

Real-time visibility keeps response(s) on track. I mean genuinely real-time, not a status report compiled half an hour later.

 

Here's the tell: if anyone in your organisation has to ask "what's the latest?", you've already lost visibility. Because if they have to ask, that means they're now pulling information, which is too slow. It needs to be pushed, continuously, into a shared view everyone is working from.

 

Accounting for people is where this gets very real, very fast. After an evacuation, can you see at a glance who's been mustered, who's unaccounted for, and where people have moved to — with several responders updating those statuses as information comes in, rather than one person trying to hold it all?

 

It matters acutely in the moment, and it matters again afterwards, when you need to demonstrate you did everything possible. Visibility is also what gives leadership the confidence to commit to a decision, because delay in a crisis is often about confidence in the information (and less so about capability).

 

 

Everything I’ve written above gets tested after the incident. The test is your documentation.

 

The uncomfortable and unavoidable truth is that you'll be judged not on what you did or intended, but on what you recorded.

 

Regulators, insurers, legal teams, even coroners, all work from the record. If it's patchy or contradictory, it won't matter how good your response was in the moment.

 

The trap is treating documentation as a burden, a thing that slows you down mid-response. But the alternative (reconstructing a timeline afterwards from memory, texts, and sent mail) is where a good response quietly turns into a liability.

 

The goal is compliance by design, where the act of responding automatically include the act of documenting, capturing information as a natural byproduct rather than retrospective note-taking.

 

 

If there's a single question I'd hand back to any leadership team, it's this: is your emergency and crisis response baked into how you actually work every day?

 

Because if the first time your team runs the plan for real is when it actually matters, that's the very definition of being prepared on paper and exposed in practice.

 

The deeper reframe underneath all six challenges is this: stop treating safety and crisis readiness as a compliance box to tick and start treating them as a source of operational visibility and predictability.

 

Done well, the same discipline that protects people in a crisis tells you more about how your organisation runs on an ordinary day. That's exactly the gap our emergency and crisis management solution is built to close: turning what's documented into something usable, accessible, and actionable the moment an incident begins. But the tool is only ever the expression of the deeper shift: from a plan you own to a capability you can execute, together, under pressure.