If the greatest recoveries in our collective history occurred because of human will and ingenuity, why would we seek to take that away? There are many examples of unquestionably effective responses to crisis events: NASA’s solutioning following the Apollo 13 mission disaster, Johnson & Johnson’s response to the Tylenol crisis, Cantor Fitzgerald’s recovery after the events of September 11, and Nokia’s response to the Philips semiconductor factory fire just to name a few.

Critical Components of Response and Recovery Capability

Capability does not mean having a plan. Capability does not even include a plan. I would even argue that plans and procedures themselves can negatively impact capability. This is because directing people to follow a plan robs them of agency. Setting the expectation that plans will answer difficult questions when the time comes limits learning potential. Restricting people to documented strategies and procedures negatively affects creativity. Individual agency, learning and creativity are critical components of response and recovery capability. This means our traditional, plan-focused approach has been systematically robbing the very organizations and communities we support of the qualities they need most to respond and recover effectively.

The Rule of LGOPs

This can be illustrated using a story from the World War II battlefield. American paratroopers were dropped behind enemy lines in Europe with plans to disrupt operations in support of the Normandy invasion. Weather, haste and some degree of wartime confusion resulted in allied forces being scattered and in locations they were not familiar with. Rather than abandoning the mission because the plan was no longer viable, individuals endeavored to carry it out anyway. Well trained, armed to the teeth and lacking serious adult supervision, these men remembered their mission’s intent: “March to the sound of the guns and kill anyone who is not dressed like you…”

The results? “They tore down communications lines, demolished enemy infrastructure, set up both random and planned roadblocks, ambushed Axis forces, and killed everything in their path. A group of 16 German pillboxes that controlled key roads was even taken out despite the fact that the attacking force had a fraction of their planned strength.”

This episode became legend and later came to be called the Rule of Little Groups of Paratroopers, or LGOP. The rules of LGOPs (or anyone wishing to do the same) are simple:

They share a common vision
The vision is simple, easy to understand, and unambiguous
They are trained to improvise and take initiative
They need to know what to do; not how to do it

This, my friends, is what Adaptive Business Continuity aims to achieve.

Challenges

The issue with this analogy, of course, is that those of us in the resilience profession do not have the luxury of developing corporate response teams like military forces. We don’t have unlimited resources with which to arm them. We cannot devote countless hours to training and drilling – people have other jobs to do. And we cannot automatically grant people authority to take initiative.

Capability is always present

There is no evidence that the leaders at Johnson & Johnson went through any type of regimented exercise activities to prepare for the crisis they experienced. Nokia was quick and aggressive in their response to the Philips facility fire, not because they had trained that way, but because it was a part of their corporate culture. Many companies have weathered storms, acts of terror and even world wars and global pandemics without benefit of pre-planning. My two favorite examples come from the Failover Plan podcast: Episode 5 and Episode 6

We can easily deduce from this that capability exists in every organization to some degree. Clearly, capability will vary from company to company and even within the same organization depending on the context. For example, the way an institution along the Gulf Coast responds to a hurricane does not necessarily correlate to how it might act if it were hit with a ransomware attack.

All the resources needed may not be available, but there is a great chance that some resources exist. Even if you haven’t conducted an exercise or tabletop, people across the organization have intrinsic knowledge about the work they do and how it is performed. This may include the use of different equipment, creative workarounds or the ability to leverage the knowledge of other team members. Some level of authority and empowerment almost certainly exists across teams, departments and organizations. What people need to understand is the level of trust they have and what they are authorized to do in situations where they may not be able to obtain immediate approval.

This should be the starting point. We should strive to understand what capability looks like, then help people to improve along the way. This might mean making them aware of resources they did not know existed. It could mean pointing them to training to build competence or facilitating team-building or collaboration exercises. Perhaps people have more authority than they realize and just need to be made aware of what they are trusted to do. Most important is an understanding and embrace of the mission – to enable the business to navigate unforeseeable consequences and deliver profitable operations through any manner of unexpected events.

Paradigm Shift

This is a major paradigm shift when compared to the traditional business continuity methodology. There are no priorities to establish. No objectives to define. No time-bound targets to satisfy. No plans. The work of planning itself looks drastically different in the Adaptive world. Strategies and procedures may enter the picture but they are not at the root of capability. We, instead, dig deeper into the organization, its teams and individuals to determine, first and foremost, what is intuitive or instinctual; what is known, what is assumed, and believed. Through this approach, improvement is not translated into updates to a plan but instead to education and learning, to resource deployment, empowerment and trust building. It is more challenging but the results, in terms of improved communication, decision-making and creative problem solving, are significantly greater.

This also allows resilience professionals and teams to approach their work more strategically. Understanding where the organization, its departments and services sit, in terms of capability, provides a window into what must be done. This is the secret to maximizing the value we deliver and moves us far beyond the cookie-cutter approach we get from the traditional methodology.

In Summary

Understanding and improving capability should be the heart of all that we do as professionals. Doing this properly, however, means we need to abandon old notions and assumptions about the work we do. Capability is not a function of plans and procedures. Capability will always exist, even in places where a moment’s thought has never been devoted to preparedness. The Rule of LGOPs tells us that satisfying the mission is less a matter of having a plan and more the result of having adequately resourced teams with clarity, competence and initiative.

These are major changes in perspective so you may have to let this simmer for a while. In the meantime, stay curious, friends!