A crisis management plan that assigns roles but skips assumptions will fail at its first real decision. BP's Gulf of Mexico plan ran to 582 pages, was copied from an Arctic template, and listed walruses as sensitive species in the tropics. Roles were clear. The assumptions behind them were fiction.
In April 2010, BP's crisis management plan for the Gulf of Mexico ran to 582 pages. It had been copied from an Arctic drilling plan. It listed walruses, sea lions, and seals as sensitive biological resources in the Gulf of Mexico, where none of those animals live. It named a wildlife expert who had been dead for four years. It linked to a Japanese home shopping website as a primary equipment provider. All of this had been approved. Nowhere across those 582 pages was there a single reference to how to stop a deepwater blowout.
Eleven workers died. Nearly five million barrels of crude spilled into the Gulf. It took 87 days to cap the well. Marine professor Rick Steiner concluded that BP's response plan "consist[ed] largely of lists, phone numbers and blank forms." The company had not put any money into crisis management and had assumed that a catastrophic blowout could not happen to them. The $5.5 billion fine came later. The 582-page plan that was supposed to prevent it sat on a shelf the entire time.
That definition will look unfamiliar. I have read crisis management plans that run to hundreds of pages, and not one named the assumption it depended on. What you find instead are step-by-step checklists and communication templates. That gap, between a shelf document and the ability to lead under pressure, is what separates a plan that exists from one that works.
A crisis management plan is a document that names the assumptions a decision depends on, assigns an owner to each, and defines the triggers for re-evaluation.
Why Crisis Plans Fail When Someone Has to Decide
On 3 February 2023, 38 Norfolk Southern freight cars derailed in East Palestine, Ohio. Eleven carried hazardous materials, including five tank cars of vinyl chloride monomer. Three days later, Norfolk Southern officials told the local fire chief and the Ohio governor that the vinyl chloride was polymerising and a catastrophic explosion was imminent. The fire chief was given 13 minutes to approve a controlled vent-and-burn of the tank cars.
He approved. The National Transportation Safety Board later determined the vent-and-burn was unnecessary. The temperature had stabilised hours before the burn. The vinyl chloride was not polymerising. The chemical manufacturer, Oxy Vinyls, had concluded no vent-and-burn was justified, but that expert opinion was never relayed to the incident commander. Norfolk Southern had, in the NTSB's words, "compromised the integrity of the vent and burn decision by creating unwarranted urgency." OSHA separately cited the company for failing to develop an emergency response plan with clear lines of authority. Norfolk Southern's costs exceeded $1.1 billion.
The plan assigned a role: incident commander. It did not specify what that role required. Which assumptions must be verified before an irreversible action? What is the minimum deliberation window when the action cannot be undone? The fire chief had formal authority and no usable information. The party with the commercial interest controlled the information flow and the clock. I would call that a decision-architecture failure, not a planning failure.
Take your crisis management plan and name the assumption, the owner, the trigger, and the reversal path it still lacks. Start the Walk →
The Assumption the Plan Never Examined
The United Kingdom had a pandemic plan with a dedicated team structure, 11 tabletop exercises over two decades, and a committee framework built to convene at speed. When COVID-19 arrived, none of that helped.
The 2011 Influenza Pandemic Preparedness Strategy was built on a single foundational assumption: the next pandemic would be influenza-like and its spread could not be prevented. Planning focused on managing the consequences of inevitable illness and death. The plan explicitly rejected quarantine, lockdowns, and mandatory mask-wearing. Exercise Cygnus in October 2016 tested a scenario with 200,000 to 400,000 excess deaths and found the UK underprepared. The findings were never shared with local councils. The people responsible for the plan had no incentive to question its core assumption, because questioning it might have revealed the plan was worthless.
Inquiry chair Baroness Hallett concluded that when the UK was described as "well prepared," this meant the UK should have been able to manage the deaths, not prevent them. The plan assumed a worst case of 837,500 deaths as manageable. When SARS in 2003 and MERS in 2012 showed that respiratory pathogens could be contained through aggressive suppression, the assumption should have triggered a review. Nobody reviewed it because nobody was assigned to. The plan documented roles. It did not document the one thing that would have made those roles useful: the sentence "we are assuming the pathogen will spread regardless of intervention," with a named owner and a trigger for re-evaluation. Deciding under uncertainty means knowing which uncertainties you chose to accept.
What a Crisis Management Plan Should Actually Name
ISO 22361 arrived in 2022 as the first dedicated crisis management standard, and it says, explicitly, that crisis plans should not include specific scenarios. That is the standard-writers admitting that what the plans-and-playbooks industry has sold for decades does not work.
Roger Estall and I argued the same thing in Deciding. Plans are secondary elements: contingent actions prepared in advance that cannot substitute for the live decision made under pressure. A plan that lists scenario-specific playbooks trains the organisation to follow a script rather than judge the situation. The Universal Decision-Making Method asks: what are we assuming, and do we have sufficient certainty to act?
Start with assumptions. Not "risks" in the sense of a register entry with a likelihood and consequence score. Assumptions, stated as sentences. "We are assuming the vinyl chloride is stable." "We are assuming the pathogen cannot be contained." "We are assuming a deepwater blowout is impossible." A sentence forces clarity. A matrix cell does not.
Each assumption needs a named owner responsible for monitoring whether it still holds, and a trigger: the observable event or data point that tells the organisation the assumption may no longer be true. For BP, a trigger might have been a near-miss on a deepwater well. For the UK pandemic plan, it might have been a respiratory pathogen successfully contained through suppression. Without triggers, monitoring is theoretical, and without someone's name on the assumption, nobody checks. When the trigger fires under pressure, the question is not whether to act but which assumption actually broke.
The final requirement is a reversal path. Before committing to any irreversible action, the plan should require the decision-maker to answer: can this be undone, and what is the cost of waiting 24 hours? The fire chief in East Palestine was given 13 minutes for an irreversible decision. A plan that required a minimum deliberation window would have changed the outcome.
Most crisis management strategies lack these four elements because naming assumptions exposes how fragile the original call was. Fragility is often what the plan was commissioned to disguise.
Test your own plan against those four elements. If it lists roles, communication trees, and escalation procedures but does not name the assumptions those procedures depend on, it is a document, not a capability.
When to Abandon the Plan
During the early months of COVID-19, I watched organisations reach for their plans and find nothing useful. The situation was novel, the scenarios did not match, and the people holding formal crisis roles had no framework for deciding what to do when the plan itself had failed.
That is the hardest moment in any crisis: recognising that the plan no longer fits and switching from execution to judgment. The Universal Decision-Making Method calls this variance: the gap between what was assumed and what is actually happening. When variance exceeds the threshold the plan was designed for, the plan should say so. Not by anticipating every possible scenario, which ISO 22361 rightly rejects, but by including a clause that says: if these conditions no longer hold, stop following this plan and convene the decision-makers to frame the decision fresh.
That clause is the most valuable line in any crisis management plan, and almost none contain it. The plans I have reviewed across nearly fifty years of work in risk and decision-making all do the same thing wrong: they tell people what to do but never tell them when to stop. A crisis playbook that tells you when to break it needs four fields per prepared action, and almost none contain them. A plan that cannot tell you when it no longer applies is a script, and scripts do not survive contact with a situation their authors did not imagine. Monitor the variance. Name the conditions under which the decision must be made again from scratch.
You could approve the next crisis plan and still leave the fatal assumption unnamed.
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.