What carries an organisation through: a capability framework for disruption and uncertainty
In brief: Organisations often mistake documentation for preparedness. Plans and risk registers matter, but real capability lies in how leaders make decisions, how people work together and whether systems function when normal conditions fall away. The greatest weaknesses tend to sit between these areas rather than within any one of them. The Safer Future Capability Framework brings those three areas, leadership, culture and systems, together across three orders of capability: withstanding shocks, adapting to conditions that have changed, and regenerating the wider systems an organisation depends on.
In early 2022 the Northern Rivers went under. The floods that came through Lismore and the towns around it were bigger than the plans allowed for, bigger than the levees were built for, bigger than almost anyone had seen in their lifetime. I spent those weeks among the organisations trying to respond: emergency services, councils, businesses, and the community groups that formed overnight in halls and kitchens. A great deal of what was achieved extraordinary. People pulled neighbours off roofs, ran supplies in by tinnie, and kept the most vulnerable alive through days when no official help could reach them.
Alongside that, a great deal went badly. Effort was duplicated while other needs went unmet. Time and resources drained away into confusion about who was responsible for what. Information that should have moved in minutes sat with people who were unreachable, or under water themselves. Some organisations found that the systems they had carefully built were housed in buildings now full of river, which is a blunt lesson in where capability actually lives.
What troubled me most was what happened to people. By the end of the first week the exhaustion was total, and it changed how they treated one another. Coordination frayed into argument. In some places the argument tipped into verbal abuse, and in a few occasions, into physical violence too as people were burnt out, frightened, carrying responsibility they had never been trained to carry, and doing it without the plans, the authority or the relationships that might have taken some of the weight.
What that period showed me, more plainly than any exercise could, is everything a plan takes for granted: that people will be rested enough to think clearly, that they will trust one another when the pressure comes, and that the systems they lean on will still be standing.
* * *
In my work helping organisations and communities navigate uncertainty, I found that most organisations have a plan. Some have several. Depending on their size and sector, they may also have business continuity arrangements, emergency procedures, risk registers, delegations, contact lists and a collection of policies setting out who should do what when something goes wrong.
This is all necessary, but it is also a long way from proving that the organisation is ready.
The problem is not usually that the plans are wrong, but that while a plan describes how an organisation intends to behave under pressure, a crisis reveals how it actually behaves, and the two are not always closely related.
A document might assign responsibility to an incident team, while everyone still waits for the chief executive to make the important calls. An escalation pathway might look perfectly clear on paper, while staff avoid using it because they are uncertain about what will happen if they do. A continuity plan might set out alternate arrangements that have never been tested, and that depend on the very people, suppliers or systems the disruption will take out.
This is why an organisation can comply with every requirement placed upon it and still perform poorly when the situation becomes unfamiliar, fast-moving and consequential.
The difference is capability.
What actually carries an organisation through disruption?
When a serious disruption occurs, three things become especially important.
The first is leadership, and I mean something more specific than authority or visibility: the capacity to exercise judgement when the information is incomplete and every available option carries some risk. Leaders must decide what matters most, what can wait, what must be abandoned and how much uncertainty can reasonably be tolerated before acting.
They must also contend with their own response to pressure. Some people become controlling when the situation is uncertain. Others seek more information long after a decision is required, minimise what is happening, or move too quickly because action offers relief from the discomfort of not knowing. These tendencies are deeply human, and they become organisational risks when leaders remain unaware of them. Much of what went wrong in 2022 can be tied to tired people whose judgement had narrowed without their noticing, or who reached for control because control was the only thing left that felt like relief.
The second is culture: the network of trust, relationships and habits through which people coordinate. During ordinary operations, formal structures may be enough. During disruption, communication channels become overloaded, responsibilities overlap and people need to work outside their usual routines. What counts then is whether people know who to contact, whether bad news can move quickly, and whether someone feels able to question a senior decision when something looks wrong.
The third is systems: the strategy, governance, delegations, plans, escalation pathways and continuity arrangements that convert judgement and relationships into organised action. Good systems reduce the need for individuals to hold everything in their heads. They clarify who can decide, how authority shifts when normal operations degrade and what happens when critical personnel or infrastructure are unavailable.
Some of the most reliable responses to disruption work precisely because they take judgement out of tired hands: the checklist, the incident command structure, the drilled sequence a crew can run when they are too depleted to reason it out from scratch. But there’s a skill in telling which situation you are in, the one where the procedure should hold and the one where it has stopped describing reality, and telling them apart while the water is rising. Capability is the discipline to follow the plan together with the judgement to know when it no longer fits.
Leadership, culture and systems are familiar enough as categories, and together they form the spine of the Safer Future Capability Framework, the model underneath this work (Safer Future is a for-purpose resilience consultancy that I run).
(Picture from Safer Future)
Now, what’s really interesting, is what happens where leadership, culture and systems meet, because that is often where organisations actually fail. Each of the following three patterns highlights one of those gaps.
Compliance theatre - the plan nobody uses
The first pattern is what I call compliance theatre.
The organisation has policies and procedures and plans. The documents may be current, professionally prepared and reviewed on schedule. Yet when disruption arrives, people bypass all of it and rely on private phone calls, favours and improvised workarounds.
Sometimes this happens because no one has rehearsed the formal process. Sometimes the process is too cumbersome for the reality of the situation. Often staff have learned that escalating a problem creates friction, exposes them to blame or changes very little, so they solve what they can on their own and avoid the official pathway.
The system exists, but the culture required to make it function does not.
This pattern is difficult to identify through a document review because the evidence of preparedness is all there. The weakness becomes visible only when people are asked what they would actually do, or when the organisation is observed under realistic pressure.
Compliance theatre also appears in longer-term work. An organisation may have a climate adaptation strategy, a transformation plan or a public commitment to sustainability, but no one with sufficient authority owns it, no budget supports it and no investment decision has changed because of it. The plan is real, and the organisation carries on much as before.
Hero dependency - the person holding everything together
The second pattern is hero dependency.
Most organisations have people who know how to get things done. They understand the systems, hold the relationships and know which procedures can be relied upon and which need to be worked around. When disruption occurs, everyone turns to them.
Their competence is valuable, but it can conceal a real organisational weakness.
If a single executive, manager or long-serving staff member is always required to interpret the situation, authorise expenditure, contact critical partners and work out what the organisation should do next, the capability does not really belong to the organisation, but to that person.
This may work for years. It may even produce impressive results, because experienced and committed people are often exceptionally good at improvising under pressure. Yet it also creates exhaustion, bottlenecks and a false sense of security.
The vulnerability becomes visible when the person is ill, on leave, burnt out, leaves the organisation or faces two serious problems at the same time. What looks like resilience is really personal endurance. In 2022 I watched capable people carry whole organisations on their backs until they buckled, and the organisation go down with them.
Valuing capable people less is not the answer. What helps is making sure their judgement is supported by systems, that authority can be distributed, and that other people have had the chance to practise leading when the usual person is unavailable.
Coordinated drift - the team moving confidently in the wrong direction
The third pattern is coordinated drift.
This occurs when relationships are strong and people work well together, but no one is adequately questioning whether the chosen direction still makes sense, or when the direction is itself unclear.
It is an uncomfortable pattern because the organisation often feels healthy. Meetings are constructive, teams communicate, people support one another and there is considerable activity. Yet strategies continue because nobody has made the decision to end them. New initiatives are added without old ones being retired. Everyone is busy and broadly aligned, but the assumptions beneath the work have not been seriously tested.
During a crisis, coordinated drift may mean teams cooperate efficiently around a course of action that nobody has clearly chosen. Under slower forms of disruption, it may mean the organisation continues to invest in assets, services or operating models built for conditions that are disappearing.
Climate change provides an obvious example. An organisation may become increasingly capable at responding to floods, fires or heatwaves while continuing to plan, build and invest according to historical conditions. It gets better at managing the consequences without reconsidering the decisions that keep reproducing the exposure.
Adaptation therefore demands more than coordination. It requires judgement: the willingness to ask whether an activity, strategy or assumption should continue at all.
Preparedness has to be demonstrated
These three patterns show why resilience cannot be assessed by documentation alone: the plan nobody uses, where a system has run ahead of the culture meant to carry it; the indispensable individual, where capability never made the journey from a person into a system; and the well-coordinated team, where coordination has outpaced judgement.
The real question is less whether the organisation has a plan and more whether the plan has made contact with reality.
Has the escalation pathway ever carried real or simulated traffic? Has someone other than the usual leader made consequential decisions during an exercise? Have continuity arrangements been tested rather than discussed? Can staff raise bad news without first reshaping it into something more comfortable? Has anything significant changed because of an incident review, a scenario process or new information about future conditions?
These questions shift preparedness from intention to evidence.
They also explain why realistic exercises can be so valuable. A well-designed scenario does more than test whether participants remember a procedure. It reveals how authority, trust, information and judgement interact when the situation becomes uncertain. It creates a safe environment in which the organisation can observe itself before the consequences are real.
The purpose is not to catch anyone out. A good exercise reveals the distance between the organisation as imagined in its documents and the organisation as it actually works, and gives you something to build on.
Beyond surviving the next crisis
Being ready for the immediate crisis is one thing, but as we have collectively experience this year with the wars in the Middle-East, the disruptions brought by AI or the heatwaves and bushfire in the Northern hemisphere, organisations now face larger, compounding and cascading challenges as well. Many disruptions are no longer isolated events after which conditions return to normal. Climate stress is the clearest of these, with technological change, workforce pressure and a hardening insurance market close behind, and together they are altering the operating environment in more durable ways.
This means building capability across three orders, not one.
The first order is to withstand shocks: to prevent what they can, prepare, respond, recover and learn. Most crisis work already aims here.
The second order is to adapt when the operating conditions themselves have changed: reconsidering strategy, assets, services and assumptions rather than repeatedly responding to the consequences.
The third order is regeneration, and it asks the most of an organisation. Withstanding a shock gets you back to where you were, and adapting adjusts you to conditions that have changed. Regeneration goes further than both. It means contributing to the health of the systems you depend on rather than drawing them down, so that the ground you stand on is being renewed rather than worn away with each disruption.
An organisation's resilience is bound up with the place and community it sits in, and with the stakeholders, networks and people it relies on, whose own lives have to hold together for the organisation's to. In 2022 no council, business or service was resilient on its own. Each of them leaned on staff who were themselves flooded, on volunteers under no obligation to appear, on a community absorbing its own losses at the same moment. To regenerate is to build so that those wider systems come out of each disruption stronger rather than more depleted. An organisation that treats its resilience as a purely internal affair has misread the problem.
What this looks like in practice is more ordinary than the word suggests. Take an organisation that depends on a handful of critical suppliers. The extractive move is to drive their margins to the floor, which looks efficient right up until one of them fails under pressure and takes part of your operation down with it. The regenerative move is to invest in those suppliers' own resilience: to pay terms that keep them solvent, to help them diversify, to treat their continuity as part of your own. It costs a little more in the good years but it is why the network still stands in the bad ones.
The same logic applies to the people an organisation relies on. A regional employer can protect its own premises and still find, when a flood or a downturn arrives, that its workforce cannot reach work because the housing, transport and services around them have given way. The regenerative choice is to put something back into those surrounding conditions: to keep people on through a slow period so the local skills base does not scatter, or to invest in the housing, training or childcare the workforce depends on. That community is part of the infrastructure the business runs on, and its health shows up on the balance sheet whether or not anyone accounts for it.
Withstand, adapt, regenerate: these are the three orders of capability the Safer Future Capability Framework works across, bringing leadership, culture and systems together at each of them.
It is more than a diagnostic model. It offers a practical map for leadership development, scenario exercises, governance and continuity design, strategic foresight, adaptation and partnership work.
The framework begins with a simple proposition: an organisation should not have to wait for a crisis to discover what it is capable of.
Plans remain important. So do risk registers, policies and compliance requirements. But they are the beginning of preparedness, not proof of it.
The proof lies in whether people can exercise judgement, trust one another and use their systems when normal conditions have fallen away, and in whether the organisation can learn quickly enough to change before the next disruption exposes the same weaknesses again. The people I stood beside in 2022 already knew this in their bodies. The work is to build organisations that know it before the water arrives, not after.
Need help applying these ideas inside your organisation? I work with boards and executive teams to build crisis-ready capability across leadership, culture and systems.