Across sectors, organisations continue to refine crisis manuals designed to guide responses to cyberattacks, outages, reputational incidents, or regulatory problems. Yet when disruption strikes, these documents often fall short. A 2023 PwC survey found that although most organisations maintain crisis plans, fewer than half believe their teams can handle a real, unfolding event. The distinction between “having a plan” and “being prepared” is widening.
A crisis can be defined as any unexpected event with adverse consequences. The breadth of this definition reveals the core problem: crises are not confined to neat categories. They can originate from internal systems, external forces, or personal and family matters affecting senior leaders. They can unfold rapidly, overlap with other challenges, and escalate in unpredictable ways. Written plans are static. Crises are not.
Steve Keogh, head of corporate training at Periculum Security Group and a former Scotland Yard detective, has seen the disparity firsthand. “The biggest misconception is that a plan guarantees a response,” he said. “Crises depend on how people think and act when the situation is unclear, pressured, and emotionally charged.”
The Hidden Risks Organisations Don’t Anticipate
Many organisations assume that a plan addressing a specific scenario — such as a cyber incident — will be sufficient. But crises frequently arrive in combinations that no manual fully anticipates.
One U.K.-based firm discovered this when a data breach struck during a holiday period. The plan required a particular executive to authorise key steps, but he was dealing with an unexpected family emergency. Without clear guidance on how to deviate from the plan, junior staff waited for instructions. The delay extended the breach and worsened the reputational fallout.
Another organisation faced a different challenge: a senior executive’s personal dispute unexpectedly became public. While the company had a detailed communications plan for corporate issues, it had no system for a crisis rooted in an individual’s private life. The absence of a general decision-making method led to hesitation, inconsistent messaging, and uncertainty across departments.
These examples reflect findings from the Institute for Crisis Management, which reports that nearly 70% of crises in 2024 originated from issues not accounted for in corporate documentation. In many cases, the problem was not the absence of planning, but the absence of people capable of applying judgement when conditions diverged from the written scenario.
“Real crises don’t respect the lines we draw around them,” Keogh said. “They overlap, they evolve, and they often start in places organisations never thought to look.”
Why Organisations Need a General Crisis System
Traditional table-top exercises tend to reinforce a belief that documented plans are sufficient. These simulations rarely replicate the emotional stress, time pressure, and contradictory information that define actual crises. A 2022 Deloitte analysis found that more than half of companies that performed regular exercises still experienced decision-making failures during real disruptions.
This is why Periculum Security Group emphasises the need for a general crisis system rather than scenario-based planning alone. Their Now, Where, How® (NWH®) framework draws on decades of criminal investigation work, corporate crisis cases, and risk management experience. It teaches leaders and teams how to think when conditions are ambiguous, fast-moving, or overwhelming.
Unlike scenario plans, NWH is designed for any crisis. It guides individuals to assess what is known, identify the most critical immediate decisions, and determine what must happen next, even when details are missing or the event does not match any documented category.
Keogh’s policing background shapes this philosophy. “In major crime work, you don’t get perfect information,” he said. “You get fragments. The question is whether people can make structured decisions when the pressure is affecting their thinking.”
This framework reflects the reality of modern crises: the specific threat may change, but the cognitive demands remain consistent. Whether facing a cyber intrusion, a supply chain failure, or a personal crisis affecting key staff, leaders must navigate uncertainty.
Preparing the People Who Carry the Plan
The lesson emerging across public and private sectors is that documentation cannot substitute for capability. Plans help, but they cannot compensate for indecision, emotional overload, or fractured communication. Organisations that train teams to function under stress tend to stabilise faster and limit secondary damage.
As crises become more complex and interconnected, the question shifts from Do we have a plan? to Do we have people who can respond when the plan no longer fits the situation?
That shift is where frameworks like NWH aim to operate, not as a replacement for corporate plans, but as a system that allows leaders and teams to think, act, and adapt when reality moves beyond what was written.
Media Contact
Steve Keogh
info@periculumsecuritygroup.com
