Organizations often assess crisis readiness by checking whether plans, teams, procedures, training, and exercises are in place.
These are important foundations, but their existence does not necessarily show that the organization can manage a crisis effectively.
A crisis-management plan may exist but be difficult to use. Roles may be documented but poorly understood. An exercise may have taken place without testing the most important decisions or interfaces.
The existence of crisis-management arrangements is therefore an important starting point, but it does not by itself demonstrate organizational crisis readiness.
A useful assessment should look beyond documentation and consider what the organization has actually established, understood, practiced, demonstrated, and improved.
1. Start with the Crisis Management Framework
The first question is whether appropriate crisis-management arrangements have been established.
This includes areas such as governance, leadership, escalation and activation, Crisis Management Team responsibilities, decision-making, communication, coordination, recovery, exercises, and improvement.
The objective is not simply to count documents.
The assessment should determine whether the arrangements collectively provide a coherent way for the organization to recognize and manage a crisis.
Gaps, overlaps, conflicting responsibilities, or unclear authority can weaken the overall capability even when individual procedures exist.
2. Determine Whether People Understand Their Roles
Documented responsibilities have limited value if the people expected to perform them do not understand what they mean in practice.
Assessment should therefore consider whether CMT members, business representatives, alternates, operational teams, and relevant specialists understand their responsibilities and interfaces.
They should know what decisions belong at their level, what information needs to move elsewhere, when escalation is required, and who has authority to act.
This is particularly important at the boundaries between strategic crisis leadership, business management, and operational response.
3. Look for Evidence of Actual Use
Readiness cannot be assessed from documentation alone.
Organizations should look for evidence from exercises, tests, simulations, actual incidents, reviews, and other relevant activities that show how crisis-management arrangements perform in practice.
The important question is not simply:
“Was an exercise conducted?”
It is:
“What did the exercise actually test, and what did the organization actually demonstrate?”
An exercise may test activation and communication without meaningfully testing strategic decision-making. Another may test the CMT but not the interfaces with business or operational teams.
Evidence should therefore be interpreted according to what was actually observed.
4. Consider the Conditions Under Which Performance Was Demonstrated
Demonstrated performance should be understood in context.
A team that performs effectively in a facilitated discussion exercise may provide useful evidence of capability, but that does not automatically demonstrate how the same team would perform under materially different conditions.
Relevant considerations may include uncertainty, time pressure, information quality, participant availability, operational disruption, stakeholder pressure, and the complexity of the decisions involved.
This does not make exercise evidence weak.
It means the conclusions drawn from evidence should remain proportionate to what was actually tested and demonstrated.
5. Assess the Interfaces, Not Only the Components
Organizations can have capable individual teams and still experience significant crisis-management problems.
The weakness may exist between them.
Assessment should therefore consider whether information moves effectively between operational teams, business management, the CMT, communications, and specialist functions.
Can operational teams provide the information strategic leadership needs?
Can the CMT establish priorities without taking over operational management?
Do strategic decisions reach those responsible for implementation?
Can business management continue managing the business while remaining connected to crisis leadership?
Readiness depends on these interfaces as well as on the effectiveness of individual components.
6. Distinguish Evidence from Assumptions
Assessments inevitably encounter areas where information is incomplete.
An organization may know that one team has exercised a process but have little evidence about another. A capability may appear reasonable based on documentation without having been meaningfully tested.
These situations should remain visible.
Lack of evidence should not automatically be treated as proof that capability exists or that it does not exist.
Instead, the assessment should identify where confidence is supported by evidence and where uncertainty remains.
This is particularly important when conclusions about one exercised situation are being considered more broadly across the organization.
7. Examine Whether Improvements Actually Work
Lessons identified from exercises and real crises are valuable, but identifying an improvement is not the same as implementing it.
Similarly, completing an improvement action does not necessarily demonstrate that the underlying weakness has been resolved.
Organizations should therefore follow significant improvements through implementation and, where appropriate, further validation.
The question should not stop at:
“Was the action closed?”
It should continue to:
“Do we have sufficient evidence that the change works?”
Avoid a False Sense of Precision
Organizational crisis readiness is complex.
Reducing it to a single percentage or maturity label can be attractive, but the result may hide important differences in evidence, conditions, dependencies, and uncertainty.
A useful assessment should help leadership understand:
- what is established;
- what has been meaningfully exercised or demonstrated;
- where confidence is supported by evidence;
- where important gaps or dependencies remain;
- where conclusions are uncertain; and
- what should be improved or validated next.
The objective is not to produce the highest possible readiness score.
It is to develop a credible picture of organizational crisis readiness that supports better decisions and targeted improvement.
Readiness should be based on what the organization can reasonably support with evidence—not simply on what its plans say it should be able to do.
For professionals seeking a structured learning path, the online crisis management course Mastering Crisis Management with ISO 22361 explores crisis governance, leadership, assessment, exercises, decision-making, communication, and continual improvement in greater depth.
The Professional Crisis Management Toolkit provides editable resources and working tools that can support the development, exercise, review, and improvement of practical crisis-management arrangements.
Independent Resource Notice: Crisis Readiness Pro resources are independently developed by Shalom David and aligned with ISO 22361 principles where applicable. They are not ISO publications and are not affiliated with, endorsed by, approved by, or certified by the International Organization for Standardization (ISO).