The Human Factor in BCM: Who Actually Knows What to Do

Every business continuity plan I have ever read describes a species of human that does not exist. The incident commander “convenes the response team.” The comms lead “issues a unified statement to stakeholders within thirty minutes.” The escalation matrix reads like a corporate constitution, calm and hierarchical, with no relation to the fact that at 3am the actual incident commander is squinting at a laptop screen, hunting for a password manager app buried behind eleven other icons, and hoping nobody asks him a question that requires more than one working brain cell.

Nobody writes down the real gap: the distance between the procedural voice of the document and the specific, tired, under-caffeinated human who has to become that voice the moment everything catches fire. Plans are written in the passive, reassuring tense of an airline safety card. Reality shows up in sweatpants.

The org chart is a fantasy

Somewhere in most BCM documents sits a diagram: boxes and arrows, one labeled “Incident Commander,” as if that were a job title rather than a person about to have the worst night of their year. The diagram assumes the box is always staffed, that whoever fills it has authority nobody will question and judgment that survives adrenaline. It assumes their phone is charged and switched on.

None of that is guaranteed. The named incident commander might be on a beach with no signal, or asleep with the phone on silent because their kid finally stopped waking up at night and they weren't about to jinx it. The backup might be three weeks into the job and still figuring out where the coffee machine is, let alone the escalation procedure. And even when the right person does pick up, a second problem appears: they now have to establish that they are in charge, out loud, to a room full of people who each think they know better.

Plans skip that part almost entirely. Authority on paper is not authority on a call. Put five capable, opinionated engineers into a bridge line during a crisis and you get five different diagnoses, two people quietly working the actual fix without telling anyone, one person waiting to be told what to do because that is what the plan technically says, and at least one ego relitigating a decision from twenty minutes ago. None of this shows up in a tabletop exercise, because tabletop exercises are run by people who are awake and briefed, not scared out of their mind.

Panic is an outage too

Here is the uncomfortable bit. Organizations spend real money on redundant servers and failover regions, then leave the human layer running on a single point of failure: whoever happens to pick up the phone first, and whether that person is calm enough to think straight. Conflict avoidance alone has killed more incident timelines than any expired certificate. Someone spots the real problem twelve minutes in and says nothing, because the senior person on the call already floated a different theory, and nobody wants to be the one who contradicts them in front of forty listeners.

Fatigue does the rest. A plan will tell you to “assess the situation and communicate a clear timeline to affected parties.” A human three hours into an outage, running on adrenaline and cold coffee, will give you a timeline that is either wildly optimistic or suspiciously vague, because their brain has quietly downgraded “accurate” to “whatever gets this call to end.”

None of this makes BCM plans worthless. They just solve half the problem while pretending they solved all of it. The technical runbook can be flawless, and the whole thing still falls over because the two people who understand it best are unreachable, and the third person improvising from memory has only ever seen the failover procedure in a slide deck.

If you want your plan to survive contact with a real crisis, stop designing it for a version of your team that is well-rested, fully staffed, and immune to ego. Design it for the person who will really be holding the phone at 3am: half asleep and one password prompt away from just yelling into the group chat instead. That person is who knows what to do. Everyone else is just a very well-formatted flowchart.