In line with accepted best-practice, most organisations’ business continuity arrangements will include some kind of crisis or incident management team, which is responsible for managing the response to and recovery from a major disruptive incident. 

Whatever the make-up of this key team, it can only operate effectively if it’s able to actually make decisions, some of which may result in significant financial, operational, legal or other commitments. It therefore either needs to include people who are senior enough to make those types of decisions or be given the authority to do so in certain situations. In the latter case, this delegated authority really needs to be agreed in advance, rather than trying to sort it out after an incident has happened. 

In the heat of the response to a crisis or major incident, the people trying to manage it need to be able to get on with things. The last thing they need is delays caused by them having to refer every decision upwards.