A question that comes up from time to time is what form the incident management and business recovery plans should take – should they be scenario-based or generic? Some organisations favour the former and some the latter but, before you make the decision, there are some important considerations.

One method used by advocates of the scenario-based approach is to brainstorm every conceivable scenario and write a plan for each. Fires, floods, explosions, power failures, hurricanes, pandemics, plagues of locusts, you name it. And, in fairness, there may be some merit in that approach for some organisations. But all too often the end result is an awful lot of effort and a plan about a metre thick, that sits proudly on a shelf (assuming there’s a shelf large enough for it), that no-one ever reads.

And more to the point, the scenario that subsequently befalls the organisation in question isn’t one that they thought of and therefore they don’t actually have a plan for it. A few real examples of this include :

• A  hydro-electric power company that had to shut down the plant because a whale had swum into their sluice;
• A company that fell victim to an industrial-sized version of a well-known scam, ending up with a huge bill for a lousy resurfacing job on their car park and suffering threats of blockades and violence against their staff when they refused to pay;
• An airport whose terminal building disappeared into a hole in the ground while everyone was looking up watching for planes falling out of the sky.

The point is that there are disasters and disruptions waiting to bite us that we couldn’t possibly second-guess before the event. And, therefore, the likelihood is that, if we go down the scenario planning route, we won’t have a plan that fits the situation we find ourselves in. So we end up either trying to cobble together some sort of hybrid of the plans we did write, or we throw the whole lot away and wing it on the day, neither of which is particularly desirable.

It may be (nay, almost certainly is) far better to have a more generic plan – with checklists that assist with specific issues (e.g. staff welfare, emergency services liaison, internal/external communication, relocation, supply chain management, salvage, etc, etc) as opposed to specific scenarios – along with a well-briefed, well-trained, well-exercised incident management team that’s capable of responding to and dealing with whatever scenario presents itself.

In other words, a plan that provides a toolkit to select from to fit the specifics of the situation you find yourself in. After all, if what you really need is a screwdriver, a bag of spanners – no matter how large or how many spanners it contains – isn’t really much use.