Written Is Not The Same As Ready
Most large organisations have a written crisis plan, and most of them cannot show that it works. This note is a snapshot as at 11 November 2026.
FTI Consulting published a survey on 28 October 2026. Economist Enterprise surveyed 1,100 general counsel and equivalent legal decision-makers between March and April 2026. Nearly 70 per cent of their organisations had a written crisis plan. Only 17 per cent had a proactive approach to emerging threats that was tested continuously.[1] FTI sponsored the research. Nearly all respondents worked for organisations with revenue above US$1 billion, so the figures describe large organisations. The sample included 600 respondents in Europe, the Middle East and Africa and 300 in Asia Pacific.[1]
The two numbers can be put side by side. If every organisation in the 17 per cent also holds a written plan, then 17 divided by 70 gives about 24 per cent. At most, roughly one in four plan holders has a tested approach. If the two groups overlap less, the share is lower. This is the firm's estimate, not a survey finding, and it uses a proxy: the survey measures the approach to emerging threats, not the plan document itself.
Where Plans Fail In Use
Our assessment is that most plans fail at the first step, which is the decision to invoke them.
Crisis24 surveyed leaders in the first quarter of 2026. Security magazine reported the results on 17 June 2026. The report does not state the sample size. Some 93 per cent of respondents said their company had missed warning signs of a crisis or disruption, and one in four said this happens frequently or all the time. Some 48 per cent agreed that leadership is frequently caught off guard.[2]
The FTI survey points to the cause. Some 42 per cent of respondents said concern about overreacting made them hesitant to escalate serious issues.[1] Some 40 per cent said false alarms reduce the credibility of future warnings.[1] More than 80 per cent said their organisations wait until risks have escalated before accessing external support.[1]
Each one delays the decision that starts the plan. A plan cannot be activated if nobody is willing to say the word.
A plan cannot be activated if nobody is willing to say the word.
Distributed operations make this harder. The person who sees the first sign is often at a site, a depot or a port, not at head office. If that person does not know who may declare a crisis, or on what trigger, the plan stays in the folder. This is our assessment, drawn from the survey pattern, not a measured finding.
Sources Differ On How Often Plans Are Exercised
The evidence on exercising is mixed, and the sources should not be merged. A Semperis study of 1,000 organisations in nine countries, reported on 15 August 2026, found that 78 per cent ran monthly or quarterly tabletop exercises or plan audits. It covers cyber crisis response only, and the fieldwork took place in early 2025.[3] The FTI figure of 17 per cent covers all emerging threats, in 2026, among larger organisations.[1] The two use different definitions and cannot be compared directly.
One detail in the Semperis data deserves attention. Only 35 per cent of respondents involved legal, finance or human resources in their exercises, and only 37 per cent involved business continuity.[3] Our assessment is that exercises are common in name but narrow in attendance. The people who will approve spending, notify authorities or stand down a site are often absent when the plan is rehearsed.
Four Questions For Any Manager
A manager can test a plan without a consultant. Four questions are enough. Who may declare a crisis, and what trigger lets them do so without waiting for permission? Can the person on site open the plan in two minutes, on a phone, without a login? Were the people who decide on money, law and staff in the room the last time it was exercised? What changed in the plan after that exercise?
The fix is rarely a longer document. It is usually four small steps. Name one owner for the decision to invoke the plan, and one deputy. Agree the trigger in plain words before an incident, not during one. Put the people who control money, law and staff into the next exercise. Record what each exercise changed in the plan.
A plan that has been changed by an exercise has been read by the people who will use it. A plan that has not been changed is probably still untested. If any answer to the questions above is unclear, the plan is a document, not a capability. The questions and steps are the firm's own and carry no survey backing. They are cheap to apply, and the answers show quickly where the plan will stall.
M2 Solutions International is a management consultancy that provides security risk services and information training; to discuss how your plan would perform under pressure, write to info@m2fze.com or visit www.m2fze.com.
Neil MarshallManagerM2 Solutions Internationalinfo@m2fze.comwww.m2fze.com