Health & Safety

Prepared on paper, exposed in practice: Why a plan isn’t enough for crisis readiness

Learn why expectations don't often match reality when it comes to your crisis readiness and a developing crisis or emergency situation.
Image of an emergency exit and red alarm
Back to all
Article

By Mats Liljeström

June 23, 2026

Summary

Most organisations have a crisis plan. But having a plan does not equate to crisis readiness. This post examines the six operational gaps that separate organisations who respond well from those who simply had a plan on a shelf.

The gaps addressed are: fragmented communication, concurrent incidents, team readiness, cross-team coordination, real-time incident visibility, and post-incident documentation.

Introduction

In our recent webinar on crisis preparedness, EcoOnline’s SVP of Product and founder of D4H Robin Blanford discussed why expectations don’t often match reality when it comes to your crisis plan and an ongoing crisis situation.

In nearly every post-incident review I’ve sat in on, the same uncomfortable pattern shows up. The plan existed. The folder was on the shelf. And when the moment actually came, very little of it worked the way it was supposed to.

I’ve lost count of the conversations I’ve had with customers and partners that end at this exact realisation. It isn’t that organisations lack a plan. It’s that their plan is based on assumptions that don’t reflect reality when things go wrong – a common crisis preparedness gap.

It assumes everyone is available. It assumes the comms channels hold. It assumes each incident arrives neatly labelled and one at a time. Real incidents don’t extend that courtesy and that is the crisis readiness gap this post addresses.

Table of contents

Click on a specific section below to navigate to that area:


6 common crisis readiness and emergency preparedness challenges

When I ask people what actually keeps them up at night, the answers are rarely a once-in-a-career catastrophe that makes the world news. They’re the semi-regular things: a fire, a chemical spill or asbestos release, intruders on campus or construction site, a lone working employee that collapses with nobody noticing, a sudden drone alert, a large-scale power outage, or every system going dark at once.

Whatever the sector, the same underlying worry appears: when this happens, will we actually be able to pull together quickly, or will it expose how fragmented we really are?

In my experience, the organisations that respond well make one fundamental shift in thinking: they treat emergency response as an operating capability as opposed to a compliance exercise. Crisis planning and emergency response becomes a part of their day-to-day operations.

Typically, they’ve managed to solve all six of the following common crisis management and emergency preparedness challenges.

#1 Crisis communication breakdown and a missing crisis communication plan

Picture a major incident in its first thirty minutes. The site team is handling the immediate response, operations is assessing impact, HR is checking on affected people, legal is weighing exposure, and comms is drafting a holding statement. That’s five work streams running in parallel, without anyone holding the full picture.

That’s fragmented communication in practice. Everyone is working hard, but each on their own piece with only the information in their own channel. The incident commander ends up stitching reality together from fragments. And the moment you have more than one system or way of sharing information, you no longer have one common operating picture to operate out of. Instead, you have multiple incomplete ones.

Often, the immediate suggestion that comes to mind is to simply communicate more. But that’s not the fix.

The fix is structured communication: one common operating picture everyone can access and trust, creating a deliberate real-time incident visibility and situational awareness across all teams.

#2 The rising frequency and concurrency of incidents

The tempo has changed. Climate events, cyber threats, supply chain shocks, regulatory shifts, geopolitical instability… whatever your sector, the frequency and variety of things that go wrong has gone up. What we’ve started seeing more and more is compounding incidents. You don’t finish one before the next begins. You also begin to recognise the limits of business continuity planning.

Most crisis plans I see are single-thread: one incident, one team, one timeline. But you might be managing three concurrent incidents at once: a site safety event, a supply chain disruption, and a reputational issue on social media. In this example, you have three responses drawing on the same leadership bandwidth and the same small pool of experienced people.

If you aren’t systematically capturing what worked and what didn’t after each one, you’re simply repeating the same mistakes under pressure.

How to make better crisis management decisions

Why do smart people make poor choices under pressure and what can organisations do about it? Read how we can ensure that our approach to crisis management doesn’t make a bad situation worse:

#3 Readiness: is the team actually exercised and crisis response trained?

This is where response shifts into readiness. The question can’t be whether a plan exists or not, that is no longer enough. A better question to ask is whether the team has run a crisis simulation exercise under conditions that remotely resemble a live incident. If they have, how long ago was it (and how much of the team has changed since then)?

The organisations that handle crises well aren’t the ones with the thickest manuals. They’re the ones that have built operational muscle memory through real practice, with training and exercises tracked, so they know precisely who is response-ready and who isn’t.

Recovery, too, is part of readiness. Not just operational recovery, but confidence, reputation, and the wellbeing of the people involved.

#4 Coordination across teams

Response breaks down most often at the handoff, and more specifically, during handoffs between teams, not within. The site team hands to corporate, operations hands to comms, initial responders hand to the next shift. Every transition is where context gets stripped out and assumptions creep in.

The shift change is the classic example. A team manages an incident for eight hours, then hands to a fresh team in a five-minute verbal briefing. The new team doesn’t know what was tried, what failed, or that the regulator said something specific three hours earlier.

In several organisations, this handoff is ad hoc at best. One organisation we work with takes proper handoffs so seriously that they immediately send members of their team to rest, the moment a crisis alert goes out. This way, they ensure that a rested team can take over cleanly twelve hours later. That’s the level of emergency planning I think everyone should be aiming for.

Something to think about: in your organisation, are roles and ownership genuinely clear, visible, and actionable? Or only documented somewhere?

#5 Maintaining real-time incident visibility

In an active incident, the most dangerous thing for situational awareness is an assumption. Someone assumes the site has been evacuated. Someone assumes the contractor was notified. Someone assumes leadership already knows. When those assumptions prove wrong, the consequences can be severe to catastrophic.

Real-time visibility keeps response(s) on track. I mean genuinely real-time, not a status report compiled half an hour later.

Here’s the tell: if anyone in your organisation has to ask “what’s the latest?”, you’ve already lost visibility. Because if they have to ask, that means they’re now pulling information, which is too slow. It needs to be pushed, continuously, into a shared view everyone is working from.

Accounting for people is where this gets very real, very fast. After an evacuation, can you see at a glance who’s been mustered, who’s unaccounted for, and where people have moved to — with several responders updating those statuses as information comes in, rather than one person trying to hold it all?

It matters acutely in the moment, and it matters again afterwards, when you need to demonstrate you did everything possible. Visibility is also what gives leadership the confidence to commit to a decision, because delay in a crisis is often about confidence in the information (and less so about capability).

Did you know?

Globally most employees believe that a cyberattack or data breach poses the greatest risk to business operations.

#6 Post-incident documentation and compliance

Everything I’ve written above gets tested in the post-incident reviewThe test is your documentation.

The uncomfortable and unavoidable truth is that you’ll be judged not on what you did or intended, but on what you recorded.

Regulators, insurers, legal teams, even coroners, all work from the record. If it’s patchy or contradictory, it won’t matter how good your response was in the moment.

The trap is treating documentation as a burden, a thing that slows you down mid-response. But the alternative (reconstructing an emergency response audit trail from memory, texts, and sent mail) is where a good response quietly turns into a liability.

The goal is compliance by design, where the act of responding automatically include the act of documenting, capturing information as a natural byproduct rather than retrospective note-taking.


Closing the crisis preparedness gap

If there’s a single question I’d hand back to any leadership team about their crisis readiness, it’s this: is your emergency and crisis response baked into how you actually work every day?

Because if the first time your team runs the plan for real is when it actually matters, that’s the very definition of being prepared on paper and exposed in practice.

The deeper reframe underneath all six challenges is this: stop treating safety, crisis readiness, and organisational resilience as a compliance tick boxand start treating them as a source of operational visibility and predictability.

Done well, the same discipline that protects people in a crisis tells you more about how your organisation runs on an ordinary day. That’s exactly the gap our emergency and crisis management solution is built to close: turning what’s documented into something usable, accessible, and actionable the moment an incident begins. But the tool is only ever the expression of the deeper shift: from a plan you own to a capability you can execute, together, under pressure.

Calendar Icon

Frequently asked questions

Why isn’t having a crisis plan enough?

Because a plan built on assumptions – that people are available, systems are working, and incidents arrive one at a time -breaks down the moment a real incident begins.

Planning for emergencies cannot be considered reliable until it is exercised and has proved to be workable. False confidence may be placed in the integrity of a written plan. Crisis readiness requires practiced execution, not just documentation.

What is the difference between a crisis plan and crisis readiness?

A crisis plan is a thoroughly documented framework that sets out how an organisation will respond to a range of emergency scenarios.

Crisis readiness is the organisational capability to execute that plan under pressure. More than three-quarters of board members believe their companies would respond effectively if a crisis struck tomorrow, but less than half have taken steps to be truly crisis-ready.

You can find a crisis management plan checklist in our health and safety compliance toolkit.

How do you test a crisis plan?

Through regular crisis simulation exercises and tabletop drills that replicate realistic conditions. Exercises help build preparedness by providing a low-risk environment to test and validate plans, policies, procedures and capabilities, and to identify resource requirements, capability gaps, and areas for improvement.

What causes crisis response to break down?

Most failures happen at handoffs between teams, not within them.

Research shows gaps between the crises organisations have experienced and those they have actually planned for. Some crises are experienced far more often than they appear in plans. Unclear ownership and loss of context at transition points are the most common causes.

What is a common operating picture and why does it matter?

A common operating picture in incident management is a continuously updated overview of an incident, compiled throughout its life cycle from data shared between integrated communication and information management systems. The goal is real-time situational awareness across all levels of incident management.

Without it, teams operate on incomplete and conflicting information.

What should post-incident documentation include?

A timestamped record of decisions made, actions taken, communications sent and people accounted for. This information should be captured in realtime, not reconstructed afterwards. When regulatory bodies such as the state and territory regulators (Australia), HSE (UK), HSA (Ireland) investigates, documentation review forms a substantial part of every investigation.

What are the benefits of software for crisis readiness?

Organisations can benefit from a software that provides a collaborative platform to manage incidents from start to finish, with tools to assign tasks, track progress, and share critical information in one secure location.

D4H is a leading crisis management software, highly rated by trusted outlets such as CapterraGartner and G2.

Need convincing? Check out our demo video library and ROI calculator.

About the author

Mats Liljeström

Global Marketing Manager