[OR] [BCPC] [C4] The Cultural Gap in Business Continuity

Chapter 4

The Cultural Gap in Business Continuity

Introduction

Despite significant investments in Business Continuity Management (BCM), many organisations continue to experience breakdowns during real disruptions. 

Plans are documented, exercises are conducted, and governance structures are in place—yet, when incidents occur, the response is often slower, less coordinated, and less effective than expected.

This disconnect highlights a critical issue: the cultural gap in business continuity. It is not the absence of frameworks that causes failure, but the gap between what is designed and what is actually practised. 

This chapter examines the common symptoms of this gap, illustrates how it manifests in real-world situations, and introduces the concept of the “illusion of readiness.”

Purpose of the Chapter

The purpose of this chapter is to:

• Identify the common symptoms of cultural misalignment in BCM 

• Explain how these symptoms impact organisational resilience 

• Provide illustrative examples of failures linked to cultural gaps 

• Highlight the risks of assuming readiness based on documentation alone 

By the end of this chapter, readers will recognise the warning signs of a cultural gap and understand why addressing it is essential for effective business continuity.

Understanding the Cultural Gap

The cultural gap in BCM refers to the disconnect between:

• What is documented (plans, policies, procedures)
• What is understood (awareness, training, intent)
• What is executed (actual behaviour during disruptions)

This gap is often subtle and difficult to detect during normal operations. However, it becomes highly visible during crises, when organisations are forced to rely on real-time decision-making and coordination.

Common Symptoms of Cultural Gaps

Organisations experiencing cultural misalignment in BCM often exhibit recurring patterns. These symptoms may appear minor in isolation, but collectively indicate deeper issues.

Plans Exist but Are Not Used

Many organisations have comprehensive BCM documentation, including:

• Business Continuity Plans (BCPs)
• Disaster Recovery Plans (DRPs)
• Crisis Management frameworks

However, during actual disruptions:

• Employees may not refer to these plans
• Plans may be outdated or unfamiliar to users
• Teams may improvise instead of following documented procedures

This reflects a lack of ownership and internalisation. Plans exist as documents, but not as operational tools.

Exercises Treated as Checkbox Activities

Exercises are a critical component of BCM, designed to validate plans and build capability. Yet, in many organisations:

• Exercises are conducted primarily to satisfy audit or regulatory requirements
• Scenarios are predictable and lack realism
• Participation is passive rather than engaged

As a result:

• Little meaningful learning takes place
• Weaknesses are not fully explored or addressed
• Confidence in readiness is overstated

Exercises become performative activities rather than genuine tests of resilience.

Lack of Ownership at Business Unit Level

Effective BCM requires active participation from business units. However, a common issue is:

• BCM is perceived as the responsibility of a central team
• Business units rely on escalation rather than taking the initiative
• Roles and responsibilities are not clearly understood

This leads to:

• Delayed response during incidents
• Overdependence on a small group of specialists
• Limited integration of BCM into day-to-day operations

Without ownership, BCM cannot be embedded into the organisational fabric.

Poor Cross-Functional Coordination

Modern disruptions often affect multiple functions simultaneously. Effective response requires:

• Coordination across departments
• Clear communication channels
• Shared situational awareness

In organisations with cultural gaps:

• Silos persist between functions
• Information is not shared effectively
• Teams operate independently rather than collaboratively

This results in fragmented responses, duplication of effort, and inefficiencies that prolong recovery.

Case Examples of Failures Due to Cultural Gaps

To understand the impact of cultural gaps, it is useful to examine illustrative scenarios where organisations had plans in place but failed to respond effectively.

Case Example 1: Cyber Incident in a Financial Institution

A mid-sized financial institution experienced a ransomware attack affecting its core banking system.

What was in place:

• A documented cyber incident response plan
• A crisis management framework
• Regular compliance-based exercises

What went wrong:

• Employees were unsure of escalation procedures
• Decision-making authority was unclear
• Communication between IT, operations, and management was delayed

Outcome:

• Prolonged system downtime
• Customer service disruption
• Reputational damage

Root cause:

Not a lack of plans, but a lack of cultural readiness—particularly in decision-making and cross-functional coordination.

Case Example 2: Third-Party Service Disruption

An organisation relied heavily on a cloud service provider for critical operations. When the provider experienced an outage:

What was in place:

• Vendor risk assessments
• Contingency plans for service disruption

What went wrong:

• Business units were unaware of alternative processes
• No clear ownership for activating contingency measures
• Communication with the vendor was inconsistent

Outcome:

• Operational delays
• Customer dissatisfaction
• Internal confusion

Root cause:

A disconnect between documented dependencies and operational awareness.

Case Example 3: Flood Disruption in a Regional Office

A regional office in a flood-prone area experienced severe flooding.

What was in place:

• Site-specific business continuity plans
• Evacuation procedures

What went wrong:

• Staff were unfamiliar with recovery procedures
• Remote working arrangements were not fully operationalised
• Coordination with headquarters was slow

Outcome:

• Extended downtime
• Loss of productivity
• Increased recovery costs

Root cause:

Failure to embed BCM into daily operations and employee preparedness.

The “Illusion of Readiness”

One of the most dangerous consequences of cultural gaps is the illusion of readiness.

This occurs when organisations believe they are prepared because:

• Plans are documented and approved
• Exercises have been conducted
• Audit requirements have been met

However, this perception does not reflect actual capability.

Indicators of the Illusion

• High confidence in plans that have not been stress-tested
• Limited challenge during exercises
• Overreliance on documentation rather than demonstrated performance

Why It Is Dangerous

The illusion of readiness creates complacency:

• Risks are underestimated
• Gaps remain unaddressed
• Response capabilities are not fully developed

When a real disruption occurs, the organisation is unprepared despite appearing compliant.

Breaking the Illusion

To overcome this, organisations must:

• Conduct realistic, scenario-based exercises
• Encourage critical evaluation and challenge
• Focus on behaviour and decision-making, not just processes
• Measure actual performance rather than assumed capability

True readiness is not defined by the existence of plans, but by the ability to execute them effectively.

Closing the Cultural Gap

Addressing the cultural gap requires a deliberate and sustained effort. Organisations must:

• Shift from documentation to behavioural capability
• Embed BCM responsibilities across all levels
• Foster collaboration and shared accountability
• Reinforce learning through continuous improvement

This transformation is not immediate, but it is essential for achieving resilience.

The cultural gap in Business Continuity Management is a silent but significant risk. It manifests through unused plans, superficial exercises, lack of ownership, and poor coordination—ultimately leading to ineffective responses during disruptions.

Real-world examples demonstrate that failures are rarely due to missing frameworks. Instead, they stem from the inability to translate those frameworks into action.

The concept of the illusion of readiness serves as a warning: compliance does not equate to capability. Organisations must look beyond documentation and focus on building a culture that supports real-world execution.

Closing this gap is critical. It is the difference between organisations that appear prepared and those that are truly resilient.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.