The Question Every Large Organisation's Board Should Be Asking, and Usually Isn't
Simon Adair has spent his career in environments where getting it wrong wasn't an option, from covert intelligence operations to leading crisis response for one of the world's best-known broadcasters. As the founder of Crisis Pathway Consultancy, he helps leaders bridge the gap between perceived and actual preparedness.
I like to ask any corporate board: if a major disruption hit tomorrow, do you truly know which activities and processes you must protect to remain viable? Not everything, not every system, just the absolute minimum your organisation cannot afford to lose. In my experience, many large organisations struggle to answer that question confidently. Not because they lack capable people, but because they rarely frame the question in a way that yields a clear, enterprise-wide answer.
The world is becoming increasingly unpredictable: geopolitical tensions, cyberattacks, supply chain fragility, power outages, and third-party failures are now routine features of the operating environment. For organisations with vast international portfolios, the scale of risk can feel overwhelming. Awareness and preparedness help, but only when grounded in the right foundations.
Too often, resilience still begins with a familiar ritual: "Let's run a scenario and see how we respond." It's usually intended to reassure the organisation, not to test it. But that's the wrong place to start, and it's often too early in the journey to ask the right questions or spend money wisely. Here's why.
A simulation isn't resilience, it simply tests whether people know the plan and how they respond to a scenario. But without first clarifying what matters across the whole enterprise, you have no basis for judging whether the response was good enough. You're testing reflexes without knowing what they're supposed to protect.
Critical means something different
Every part of the organisation has its own view of what's "critical", but as the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO) 22301 confirm, consistent thresholds matter.
In a large company, each department has its own essential tasks. Finance has many, so do Operations and Technology. Every team believes its list is crucial, though each reflects its own perspective. The Board's job isn't to collect those lists, it's to ask the harder question underneath them: Critical to whom, and critical enough to protect with genuinely limited resources when the organisation is in a systemic crisis, not a departmental one?
I've been in the room where those lists converge, where Technology's vital systems, Operations' key processes, and Finance's essential controls compete for scarce recovery resources in the first few hours of a real event. Without a clear, organisation-wide understanding of the true Minimum Viable Product (MVP), the loudest voices often win, not those the business actually needs.
Crown jewels, MVP, and the dependency chain beneath them
If you haven't identified your organisation's ‘Crown Jewels’ (the handful of things whose loss would be existential rather than merely damaging), what exactly are your resilience investments protecting?
If you don't know your MVP, how do you know what must keep running when everything else is triaged away? If you haven't mapped the dependencies of that MVP, including the people, technology, data, suppliers, facilities, and third parties involved, and what they depend on, how would you ever find your real vulnerabilities?
In a large organisation, that dependency chain is rarely a tidy org chart. It runs through outsourced IT, a single data centre serving three continents, and a supplier that depends on another supplier nobody in the room has ever heard of. Mapping it properly at enterprise scale is hard work, and it's the only way the MVP becomes meaningful in practice, not just a slide in a governance pack.
Business continuity and resilience are not the same
This is why large organisations need to rethink the relationship between business continuity and resilience.
Business continuity asks: How do we maintain or restore our critical activities when things go wrong? It's a necessary discipline, and most corporates have invested heavily in it.
Resilience poses a bigger question: Can we absorb disruption, adapt to what we didn't anticipate, and still deliver what matters most, even when the disruption doesn't align with the continuity plans?
At enterprise scale, that difference isn't academic. A continuity plan built on known scenarios and predefined critical activities can appear comprehensive, yet still leave the organisation exposed if its assumptions haven't been stress-tested against a genuinely novel, cross-functional event.
So instead of asking, "What scenario should we practise next?" I'd put these questions to your Board:
What must we protect if almost everything else fails, and how long could we survive without it?
What would actually stop us delivering it?
Where are our single points of failure, including those buried three tiers down in the supply chain?
Which assumptions in our continuity plans have quietly stopped being true as the business has grown or restructured?
The hardest one: If tomorrow's disruption looked nothing like anything we've trained for, would we actually know what to do?
Resilience is never about predicting the next crisis. It's about knowing what matters when everything goes off script. In a large organisation, "everything" covers far more ground than any single scenario can rehearse.
The real question is risk appetite
Answer those questions properly, and something shifts: you stop talking about resilience in the abstract and start looking at the real, measurable gap between what you can currently sustain and what full resilience would require.
I've seen that gap once it's properly measured. In one case, we began with more than 500 supposed critical processes and ended with sixty – the difference between what the business assumed was essential and what was actually essential. Once visible, that gap is what the Board is really deciding on.
Closing that gap entirely is possible, in theory, if you're willing to invest enough time, effort, and money. Most Boards don't actually want that: wanting to be resilient in everything is itself a decision, and a very low risk appetite dressed up as a virtue that rarely survives the next budget cycle.
The honest question isn't "Are we resilient?" It's "How much of this gap are we choosing to close, and how much are we choosing to accept?" That's a risk appetite decision, not a technical one, and it belongs with the Board because only the Board can weigh cost against what it's willing to live with.
The harder job: Prioritising the gaps
Even that decision doesn't settle it. A list of sixty or six hundred gaps doesn't arrive one at a time, each with its own cost, timeframe, and owner, all competing for the same limited budget.
Saying yes to resilience in principle is easy. Deciding which gaps to fund this year, which to partially address, and which to accept as risk is the real work: not "should we be resilient" but "where does the effort go first, and who decides?" Get that wrong, and the organisation ends up resilient wherever it is shouted loudest in the boardroom, not where it matters most when disruption hits.
At Crisis Pathway, we help clients uncover the real strength within complex organisations: their critical activities, their MVP, and the dependencies beneath them, and then turn that picture into a risk appetite and investment conversation, not a slide in a governance pack.
Don't start with the scenario. Start with what you cannot afford to lose, then deliberately decide what you can.
Read more from Simon Adair
Simon Adair, Founder of Crisis Pathway Consultancy
Simon Adair is a crisis leadership specialist, executive coach, and founder of Crisis Pathway Consultancy. His career spans the Royal Marines, British Intelligence, British Telecommunications (BT), the National Basketball Association (NBA), and the British Broadcasting Corporation (BBC), where he led the corporate crisis response. He holds an Executive Master of Business Administration (MBA) and is a Chartered Manager Fellow. Through Crisis Pathway, he partners with organisations to strengthen crisis preparedness, leadership resilience, and organisational readiness.
