Why Business Continuity Plans Fail (and How to Fix Them)

Here's the uncomfortable pattern: continuity planning is treated as a document project. A template gets filled in, a binder gets produced, an insurance questionnaire gets a checkmark, and everyone feels safer. But a plan is a hypothesis — and industry surveys keep finding that roughly one in four companies never tests the hypothesis at all, while about two-thirds of those that do test fail the first attempt. The plan wasn't wrong to write. It was wrong to trust untested.

The five ways plans actually fail

1. The backups were never restored. Backup software reporting "success" and data being restorable are different facts. Jobs silently skip databases, retention quietly expires, and encryption keys live on the server that just died. If nobody has performed a full restore recently, the backup is a belief. Fix: restore something small monthly, restore a whole system quarterly, and log the timing.
2. Everything lives in one place. One office, one server room, one region — fire, flood, or a regional grid event takes the production systems and the "backups" on the NAS beside them. Fix: the 3-2-1 rule (three copies, two media, one offsite), with the offsite copy geo-separate and immutable so ransomware can't reach it.
3. Nobody chose the recovery numbers. Without an RTO and RPO, the outage becomes a live negotiation between what leadership expects ("this afternoon?") and what the infrastructure can do ("Thursday, maybe"). Fix: pick the two numbers per system, write them down, and let them drive the architecture — a four-hour RTO and a four-day RTO are different price tags, and that's a business decision to make in daylight.
4. The plan covers systems but not people. Where does the team work when the office doesn't exist? Who calls the top twenty clients, and what are they told? Who is authorized to approve emergency spending if the owner is unreachable? Technology recovery with no operational layer is a server humming in an empty room. Fix: one page per scenario listing people, places, phones, and decisions — kept where people are, not where servers are.
5. The plan itself is a casualty. The beautiful binder is on the SharePoint that's down, or in the office that's cordoned off. Fix: printed copies at leadership homes, a copy in the DR vault, and a one-page quick card in wallets or phones. Unromantic, decisive.

The two numbers that turn a wish into a plan

Everything above converges on RTO and RPO, so they deserve a worked example. A ten-person escrow office decides a four-hour RTO and a one-hour RPO for its transaction system — closings can't wait, and re-keying an afternoon of wire instructions is unacceptable risk. The same firm gives its marketing file share a two-day RTO and a 24-hour RPO without losing a minute of sleep. Those two decisions just designed the architecture: the transaction system needs replication to a warm standby, the file share needs a nightly backup, and nobody overpays for either.

Now invert it: no numbers chosen. The outage arrives, leadership expects everything back "today," the infrastructure supports "Thursday," and the gap between those two sentences becomes a negotiation conducted at the most expensive hourly rate a business ever pays — mid-crisis. The plan didn't fail on technology. It failed eleven months earlier, in a meeting that never happened.

A continuity plan that survives contact: the short version

• Inventory ruthlessly. Systems, vendors, and the processes that depend on them — if the phone system, payment processor, or line-of-business app died, what stops? (Vendors fail too; that's its own risk category.)
• Tier by tolerance. Tier 1 back in hours, Tier 2 in a day, Tier 3 can wait a week. Spend accordingly — flat spending across tiers means overpaying for some systems and under-protecting the ones that matter.
• Make one copy unreachable. Immutable or offline. Modern ransomware hunts backups first, because operators know the backup is the ransom's competition.
• Rehearse annually, people included. A tabletop exercise — two hours, one scenario, leadership in the room — finds more plan defects than any audit. IBM's breach-cost research has consistently ranked tested response plans among the largest cost reducers, and the same logic runs through continuity: with US breach costs averaging $11.5M in 2025, and a global average of 247 days to identify and contain a breach, rehearsed beats documented every time.
• Assign the plan an owner. Plans without a name attached rot in fourteen months flat. Ours get reviewed on a schedule because it's in the retainer, not in the good intentions.

None of this is exotic. That's the point — continuity fails on discipline, not sophistication. A modest plan that's been rehearsed beats an impressive plan that hasn't, every single time it matters.