The Alternate Site That Fails the Commute Test
Halcyon Insurance has 620 staff across three floors of a downtown tower. Its continuity plan designates a recovery workspace 55 km away with 180 seats, available under a contract that guarantees access within 24 hours of declaration. A regional flood closes the downtown area for four days. On declaration, the workspace provider reports that only 140 seats are ready because the remainder are committed to another subscriber under a shared-capacity clause. Of the 180 available seats, 60 are occupied on day one. Staff report that the commute is 90 minutes each way, several cannot arrange childcare, and managers cannot reach many employees because the workforce contact data was last updated 14 months ago. Claims processing, which has a four-hour recovery objective, was routed to the workspace but the claims system requires a VPN token that most staff left in the office.
1. Identify the failures in this continuity strategy, distinguishing design flaws from execution failures.
Read the worked answer
Separating design from execution matters because they require different fixes.
Design flaws: The 180-seat contract was never sufficient for 620 staff, so the plan implicitly assumed most people would work from home - but that assumption was never stated, resourced, or tested. The shared-capacity clause meant the guaranteed number was contingent, and the plan treated a contractual maximum as a firm entitlement. The 55 km distance and 90-minute commute were never validated against the actual workforce; a recovery site that people cannot practically reach is not a recovery site. The four-hour claims objective was assigned to a location whose access guarantee was 24 hours, which is an internal contradiction in the plan itself.
Execution failures: Contact data 14 months stale meant the organization could not even convene its people, which is the first step of any recovery. VPN tokens left in the office is a classic single-factor dependency that a walkthrough would have caught - the plan assumed staff would have their credentials, but nobody had verified how. Occupancy of only 60 of 180 seats on day one is a symptom of the contact and commute problems rather than a separate failure.
The most damaging item is the mismatch between the four-hour claims objective and the 24-hour site access guarantee. That is not bad luck; it is a plan that could never have worked, and it survived because it was never tested against the contract terms.
2. What should Halcyon do in the 30 days after the event, and what should it change over the following year?
Read the worked answer
The 30-day window is for stabilizing and capturing evidence while memories are fresh.
Immediately, run a structured debrief with each affected function, recording actual timelines: when the declaration was made, when the provider confirmed seats, when staff were reached, when claims resumed. Reconcile those against the plan's stated objectives so the gap is documented in numbers rather than impressions. Refresh workforce contact data now, and verify it by having employees confirm their own details. Issue and register VPN tokens or, better, remove the dependency by enabling the claims system for authenticated access without a physical token. Reopen the provider contract to understand the shared-capacity clause precisely and determine what guarantee is actually purchasable.
Over the following year, fix the strategy rather than the document. Decide explicitly what work is location-independent and equip staff for remote operation, since 620 staff cannot be seated anywhere affordable. For the roles that genuinely need a physical site, size the requirement to the real number and validate commute times with a staff survey. Renegotiate or replace the contract so the guaranteed seat count and access time match the recovery objectives, and align the claims recovery time objective with whatever access can actually be guaranteed - either by shortening access time or by relocating that function's recovery approach.
Finally, test the new design with a exercise that requires staff to actually log in from home and process a sample of claims within the target time. Until that has been demonstrated, the objective remains an aspiration.