Why Resilience Plans Fail When Systems Collide

Governments, companies and communities face gaps in the systems they use to prepare for and recover from disruption. The gaps affect critical infrastructure, technology networks, health services, food systems and financial markets.

Many organizations have plans for individual risks, including cyberattacks, extreme weather and equipment failure. Fewer plans address several disruptions happening at the same time or spreading across regions.

The systems depend on one another. Power providers need telecommunications networks. Hospitals need electricity and digital services. Manufacturers rely on transport links and suppliers in several countries. A failure in one system can affect others, while public agencies and private companies may share responsibility for the response.

Data sharing remains a problem during emergencies. Organizations may hold information about damaged infrastructure, available supplies and public needs but lack compatible systems for sharing it. Security rules and unclear authority can delay the release of information or leave decision-makers with incomplete reports.

Supply-chain planning has similar limits. Companies often know their direct suppliers but have less information about lower-tier suppliers that provide raw materials, components and specialist services. That makes it harder to estimate the length of a disruption or identify alternative sources.

Cybersecurity plans often focus on blocking an attack and restoring networks. Recovery can take longer when organizations have not tested manual procedures, data checks or customer communications for periods when systems are offline. Public services face the same risk when digital platforms replace paper procedures without a workable alternative.

Staffing can further limit response capacity. Organizations may lack enough trained workers to cover prolonged emergencies when employees are unavailable, exhausted or unable to reach their workplaces. Communities with limited financial resources, internet access or transport can experience longer service interruptions.

Exercises often test one event over a short period. They may not reflect disruptions that last for weeks, affect several regions or involve multiple organizations. Plans can also become outdated after staff changes, new technology, supplier changes or shifts in climate and security risks.

Organizations use recovery time, service availability and financial losses to measure performance. Those measures do not show whether services reached vulnerable groups or whether one organization’s recovery caused problems for another. Different reporting standards can make comparisons between agencies and companies difficult.

Current resilience planning includes coordination agreements, backup suppliers, offline procedures, staff training and regular exercises. Plans also define who can act during a crisis, which services should be restored first and how information will be shared.

The effects of a disruption can continue after one organization resumes operations. Customers may remain affected by damaged power networks, blocked transport routes or unavailable public services. These links require planning between organizations that rely on the same infrastructure and suppliers.