Fourteen Plans, Five Severity Scales, One Audit Committee Deadline

The failure here is not a shortage of plans; it is a shortage of accountability and a surplus of documents. Any model that produces a fifteenth central plan will fail for the same reason the first fourteen did.

Centralise the frame, decentralise the content.

Central (your team, roughly four artefacts):

• One crisis definition with a materiality threshold and one five-level severity taxonomy mapped to the group risk appetite.
• One response framework: tiers, activation authority, role cards, decision log standard, and the escalation clock.
• One assurance cycle: exercise standard, observation criteria, corrective action register, maturity reporting.
• One group-level scenario library and the group CMT itself.

Business units keep their sector-specific annexes: contact trees, regulatory notification duties, local recovery playbooks. They convert, they do not rewrite from scratch. This is the concession that buys cooperation and it is also correct, because life insurance and brokerage have genuinely different regulatory clocks.

Accountability, stated in one line each:

• Group COO chairs the group CMT and is the only person who can declare a group-level crisis.
• You own the framework and the assurance evidence, and report to the audit committee, not to group risk.
• Each BU head names a BU crisis lead who owns their annex and their exercise schedule, and who appears in their own performance objectives. Without that last clause, the role is honorary.

Governance rhythm: a quarterly Crisis Governance Forum (you, four BU leads, group risk, communications) with authority to approve framework changes and close corrective actions. Publish a one-page RACI rather than a 40-page document, because the argument will be about who decides, not about process detail.

Adoption depends on the taxonomy answering a question each BU already has, not on it being logically elegant. Five scales existed because each BU calibrated to its own regulator and its own loss history; a central scale that ignores those will be signed and then ignored.

Build it from consequences, not from causes. Define five levels by four consequence dimensions, each with a numeric anchor:

• People: none / first aid / serious injury / fatality / multiple fatality.
• Customers and service: degraded internal service / single customer impact / segment outage / regulatory breach or mass customer harm / licence at risk.
• Financial: a percentage of BU operating profit, not an absolute euro figure, because the BUs differ in size by an order of magnitude.
• Reputation and regulatory: no attention / trade press / national press or regulator enquiry / sustained national coverage or enforcement action / systemic market event.

Severity is the highest single dimension, not an average, with one rule: reputational severity alone cannot exceed level 3 without a real-world consequence, or every complaint becomes a crisis.

Map each BU's existing scale onto the new one and show them the mapping in a one-page table. That does two things: it preserves their local calibration language, and it makes visible where their scale was stricter or looser than the group and why. Expect one BU to be materially looser; that finding is worth the exercise by itself.

Tie each level to a decision - who is notified, who convenes, what the reporting clock is, who can speak publicly. A severity scale that does not change behaviour is a labelling exercise. Pilot with one BU on one live incident before group rollout, and let BU leads red-line the activation triggers.

The committee is asking a simple question: if a severe event happened next week, would we be competent? Documents cannot answer that. Evidence of tested behaviour can.

What I would deliver, in order of evidential weight:

1. Two live exercises with external observation. One group-level scenario (for example, a ransomware event taking out claims processing across two BUs during a regulatory deadline) and one unannounced BU-level exercise. Observations recorded against pre-agreed criteria: time to first decision, time to correct escalation, quality of the decision log, whether notification clocks were identified correctly. Scored by someone with no stake in the result.

2. A corrective action register with dates, owners and closure evidence. The 2022 failure was not the exercise; it was the missing follow-through. The register itself, with 60-70% closure and named owners, is a stronger assurance signal than a perfect plan.

3. A capability map by BU showing the new taxonomy, activation authority and exercise status in one page, including the gaps. Committees trust gaps that are disclosed and owned far more than a green dashboard.

4. A tested escalation path, demonstrated by an out-of-hours call cascade with measured answer times to the first three tiers.

What I would explicitly not offer: a count of plans revised, a policy sign-off, or an e-learning completion rate. State clearly in the paper what the evidence does not cover - for example, that supplier-side resilience is out of scope this cycle - because a bounded claim is credible and an unbounded one is not.