Why Business Continuity and Disaster Recovery Plans Fail

The Problem With Plans That Only Exist on Paper

In today’s business environment, keeping your business operating during any type of disruption — including loss of physical office space, cyberattacks, supply chain failures, or natural disasters — requires more than a written plan. A business continuity plan (BCP) or disaster recovery plan (DRP) that has never been tested is simply a document. It is not a capability.

The uncomfortable truth is that most organizations that experience a significant disruption discover their plans have gaps — not before the event, but during it. The time to find those gaps is not when a real crisis is unfolding.

What Is a Tabletop Exercise?

A tabletop exercise is a facilitated discussion-based activity in which key stakeholders walk through a simulated emergency scenario. Participants talk through their roles, responsibilities, and responses as if the scenario were actually occurring — without the pressure and cost of a full operational drill.

Tabletop exercises are designed to:

• Identify gaps and inconsistencies in existing plans
• Test whether key personnel understand their roles
• Evaluate communication and decision-making processes
• Surface assumptions that have never been validated
• Build organizational muscle memory before a real event

Why Business Continuity Plans Fail

Based on our experience working with organizations across industries, business continuity and disaster recovery plans typically fail for one or more of the following reasons:

1. Plans Are Written in Isolation

Plans developed without input from the people who will actually execute them often contain procedures that are impractical, incomplete, or simply unknown to the staff responsible for carrying them out. A plan written by IT leadership may not account for the operational realities of the business units it affects.

2. Contact Information and Resources Are Out of Date

Employee rosters, vendor contacts, backup system locations, and recovery site details change frequently. Plans that are not reviewed and updated regularly become unreliable at exactly the moment they are needed most.

3. Dependencies Are Not Mapped

Modern organizations rely on complex webs of internal and external dependencies. A failure in one area can cascade in ways that a plan may not anticipate. Tabletop exercises surface these interdependencies before they become crisis-amplifying surprises.

4. Recovery Time Objectives Are Untested

A plan may state that a critical system will be restored within four hours. But if that objective has never been tested, no one actually knows whether it is achievable. Tabletop exercises allow organizations to pressure-test their RTOs and RPOs in a low-stakes environment.

5. Leadership Is Not Engaged

Business continuity is often treated as an IT or compliance function. When executive leadership is not engaged in the planning and testing process, critical decisions during an actual event are delayed, escalation paths are unclear, and the organization’s response is slower and less coordinated than it needs to be.

How JBW Group Approaches Tabletop Exercises

At JBW Group International, we facilitate tabletop exercises that are tailored to your organization’s specific infrastructure, industry, and risk profile. We do not use generic scenarios or off-the-shelf scripts. Every exercise is designed around the actual threats and vulnerabilities most relevant to your business.

Our exercises typically include:

• A realistic scenario developed in consultation with your leadership team
• Structured facilitation that keeps discussion focused and productive
• Real-time documentation of gaps, assumptions, and action items
• A post-exercise report with prioritized recommendations
• Optional follow-up support to implement improvements

The Right Time to Test Is Before You Need To

Organizations that regularly conduct tabletop exercises recover from disruptions faster, with less operational impact and lower costs. They also tend to perform better during formal compliance audits, since documented testing is a requirement under standards including ISO 22301, ISO 27001, and many regulatory frameworks.

If your organization has a business continuity or disaster recovery plan that has never been formally tested, the question is not whether you should conduct a tabletop exercise — it is how soon.