The Plan Nobody Could Find at 3am
A distribution company maintains a 180-page business continuity plan, last fully revised two years ago. It is stored on the corporate intranet, which requires single sign-on. The plan's distribution list names 14 people, of whom 6 have left the company. During a power failure at the main depot, the night shift supervisor - who is not on the distribution list - needed the manual dispatch procedure to keep deliveries moving. The intranet was unreachable because the same power failure took out the site's network. He eventually reached a colleague by mobile who read him an outdated printed copy from a desk drawer. The incident was resolved with a 4-hour delay and no customer impact, and the operations director has described it as 'a near miss we got away with'. The next plan review is scheduled for 11 months' time.
1. Identify the plan's failures as a continuity capability rather than a document, and rank them by severity.
Read the worked answer
The plan is being treated as a record rather than a capability. A continuity plan that cannot be invoked by the people who need it, at the moment they need it, has zero operational value regardless of its content quality.
Ranked by severity:
- Single, network-dependent access path. The plan is only reachable through infrastructure that fails in the exact scenario it exists to handle. This is the most severe because it is unconditional - it defeats the plan in every site-loss scenario, not just some.
- No out-of-band copy in the hands of the people who act. The night shift supervisor is the person most likely to need it and is not on the list. The only copy available was outdated, which is worse than none in some respects because it invites confident wrong action.
- Stale distribution list. Six of 14 recipients have left. The list is a proxy for 'who needs this', and it has not tracked reality.
- Two-year revision cycle with an 11-month wait. The review cadence is disconnected from the rate of organisational change.
The operations director's 'near miss' framing is the underlying problem: the organisation has interpreted a lucky outcome as evidence of adequacy. The 4-hour delay was absorbed by slack, not by control.
2. Recommend the minimum set of changes that would have changed the outcome of this incident, and justify why these come before the 11-month review.
Read the worked answer
The test is: what would have made the night shift supervisor effective at 03:00 with no network?
Minimum set:
- Out-of-band access. A printed quick-reference procedure held at the depot (and each operating site), plus an offline copy on a device or medium not dependent on the corporate network. The full 180-page plan is not needed at the point of use - a 2–4 page action card for the manual dispatch procedure is what was actually required.
- Role-based, not name-based, distribution. Distribute to roles (night shift supervisor, depot manager, on-call) and require each role holder to confirm receipt and hold a current copy. This survives leavers automatically.
- A controlled update mechanism for the offline copies. The failure mode of printed copies is staleness; without a version stamp and a defined reissue trigger, fix 1 creates a new problem.
- A no-notice test of the access path - can a night shift supervisor retrieve the procedure with the network down? - run before the review.
These come before the 11-month review because the review is a content exercise and the failure was an access exercise. Waiting 11 months leaves the identical exposure live. The changes are low-cost and can be implemented in weeks; the review should then incorporate them, not precede them.