Business Continuity Plan Depends on Everything Continuing Normally

CASE STUDY | Resilience in practice

The brief to the crisis-management team was straightforward: test whether a major law firm could keep serving clients if its primary technology platform became unavailable. The exercise lasted eleven minutes before the participants discovered they could not open the instructions for the exercise.

The business continuity plan was stored in the primary platform. Its backup was in a separate repository accessed through the primary platform's single sign-on. A printed copy existed, according to the policy, in a cabinet in the office that had been removed during the firm's transition to a flexible working model.

“We designed away single points of failure,” said the operations partner. “It appears we have designed one particularly efficient point of failure.”

Scenario A: No systems. The response team telephoned its emergency contacts. The first number belonged to a former senior associate, the second was an office extension and the third reached the director of knowledge, who asked why a simulated emergency required the same approval process as a real one. This was recorded as a useful escalation insight.

Scenario B: No spare capacity. The firm's fallback proposed moving urgent work to the disputes team. The disputes team was already doing temporary cover for the corporate team, whose members had been described as available because they had no remaining annual leave. Finance confirmed that temporary cover did not count as headcount.

Scenario C: Clients manage without us. The plan assumed disrupted clients would bring work in-house for a few days, then return. The facilitator asked whether they might discover a cheaper and more reliable service. The relationship partner said this was an interesting strategic question but not a continuity risk. The facilitator wrote it down under both headings.

The internal report recommended offline instructions, verified contact details, a properly tested alternative provider and a candid assessment of how much work people could actually absorb. It also suggested replacing the word seamless with a description of the seams.

The management committee accepted the findings in principle, although several partners asked whether the report could be made more positive before circulation.

A revised executive summary now states that the firm maintained perfect control of the exercise: no critical procedure was performed without reference to policy.

The detailed report remains on the intranet. Partners have been invited to read it while they still can.