The Plan is Not The Thing

People, not plans, are the means by which organizations respond and recover to unanticipated events. On that, I think most of us would agree. Why is it so hard to say it that way?

From CIO Magazine: “A business continuity plan gives the organization the best shot at successfully navigating a disaster by providing ready-made directions on who should do what tasks in what order to keep the business viable.”[1]

People - Not Plans - are what give the organization the best shot at successfully navigating disaster. Statements like this – repeated in online magazines and publications ad nauseum – create a perception about organizational preparedness in the minds of the people who read them. These are people unfamiliar with the work we do and with limited experience dealing with unplanned and complex situations. Sadly, these are the folks who we depend on for resources, decisions and even employment. The consequence is that they will turn around and expect us to be focused on the development and delivery of plans as the central goal of our efforts. This means the quantity and quality of plans developed will become the criteria against which our work as preparedness professionals is judged. ?

From ISACA: “A business continuity plan is usually implemented to minimize a disruption's impact on an organization’s critical business functions and to enable the timely resumption of operations.”[2]

I understand the intent here. Conceptually, this is telling us that plans are a means to an end. But, once again, ISACA is a resource for individuals tasked with assessing and evaluating the work we do. The nuance of this statement, or the details within the article it comes from, can easily be lost. Auditors seeking to evaluate the quality of business continuity programs will look almost exclusively at the documents produced. The much more meaningful work of obtaining and staging resources or building competence among teams and empowering individuals will be easily overlooked. This is despite the fact that such work translates into significantly greater outcomes for the organization than any work dedicated to mere plan development and maintenance.

From The BCI: “Business continuity is about having a plan to deal with difficult situations, so your organization can continue to function with as little disruption as possible.”[3]

This one is particularly egregious. Business continuity should be about building and enhancing the capability to deal with difficult situations. The degree to which plans contribute to that capability pales in comparison to the availability of resources, the level of expertise and knowledge across teams and the authority of the team members. And yet, a leading business continuity certification organization sets a specific idea within the minds of new entrants to this field that they should be dedicated to creating plans rather than spending their time on more valuable activities.

In recent weeks, I have started writing and commenting more within LinkedIn. In doing so, I have noticed a definitive dichotomy within the profession. On the one hand are those that agree with my viewpoint that plans are, at best, a reference for the more important work of creating more competent and capable teams. They also agree that the term “plan” should refer to the overall response framework and to the strategy or strategies that may be employed when dealing with disruptions. “Plan” in this sense is not necessarily a detailed document or set of procedures. On the other side sit those that genuinely believe that response teams require something written that they can refer to when needed. From this point of view, the ability to recover effectively is lost or will be greatly hampered without documented plans. Whether these two camps are even aware of the other’s existence or the degree to which they genuinely differ in their approach to preparedness, I cannot say. The problem is that both use the term “plan” even though they apply it to different definitions. When people on either side of this equation speak or correspond to one another, they use the term but assume the individual they are in communication with has the same definition.

The solution, as I see it, is to eliminate the term plan from our collective usage. Let’s, instead, speak of capability. For example, “Response and recovery capability gives the organization the best shot at successfully navigating a disaster.“. When necessary, include it only in the context of a component or capability. For instance, “Business continuity is about having the capability, in the form of resources, competence, strategies and supporting plans, to deal with difficult situations.” Of course, the verb form of the word is perfectly acceptable. As in “We plan to minimize a disruption's impact on an organization’s critical business functions through the improvement of its existing capabilities.”

This probably seems like a minor issue or concern. But remember, our language contributes to the perception of our work by those in a position to assess and support our efforts as well as those that are new to the field. Wouldn’t we all be much better served if, through small changes in our language, we were able to change that perspective to more accurately reflect the work we do?

[1] CIO, December 2023: https://www.cio.com/article/288554/best-practices-how-to-create-an-effective-business-continuity-plan.html

[2] ISACA, June, 2023: https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2023/disaster-recovery-and-business-continuity-preparedness-for-cloud-based-start-ups?gad_source=1

[3] What Is Business Continuity? The BCI: https://www.thebci.org/knowledge/introduction-to-business-continuity.html