Most organisations discover their true crisis capability in the middle of a crisis — which is the one moment it can't be improved. The plan turns out to name people who left two years ago. The communication tree assumes systems that fail in exactly the scenario at hand. The team that was supposed to make decisions has never once practised making them together. A crisis management assessment exists to move that discovery forward in time: to examine, while things are calm, the system that will determine how the worst day goes.
A plan is not readiness
The most common form of crisis preparation is a document: a crisis management plan, written carefully, approved formally, and filed. The document matters — but it's one component of one dimension of readiness, and organisations that equate the two are usually far less prepared than their filing suggests. What actually determines how a crisis unfolds is a system: who leads and how they hold themselves under pressure, whether processes connect vertically and horizontally, whether named people exist at every level, whether anyone has practised, and whether the physical and communication resources will hold up when normal channels degrade. A serious assessment therefore examines the system, not the binder.
The five dimensions
The assessment method examines crisis readiness across five dimensions. Each is scored on its own evidence, because strength in one does not compensate for weakness in another:
- Leadership — composure under pressure, whether business continuity is integrated into normal management or bolted on, whether prevention is treated as a discipline, and the leadership team's actual reputation for handling serious incidents.
- Process — how well continuity processes integrate vertically (site to region to corporate) and horizontally (across functions and with partners), whether information flows for rapid decisions are mapped, and whether lessons from past incidents were genuinely implemented or just recorded.
- Personnel — whether crisis roles are assigned in writing at every level, including decision support and stakeholder management, and whether external partners and advisors are identified by name with current contact details.
- Training — whether people have been validated in their continuity roles through real practice: theoretical grounding, simulated exercises, and drills that include the partners and stakeholders who would actually be involved.
- Resources — whether equipment and communication systems are fit for a crisis and integrated with partners' systems, and whether insurance and financial requirements are scoped to the scenarios that could actually occur.
Five tiers, honestly anchored
Each dimension is rated against five maturity tiers, and the anchors are deliberately blunt. At the bottom — behind — there is no plan at any level; processes evolve during the crisis at the expense of decision-making, communication fails internally and externally, and the organisation takes physical, commercial and reputational damage it could have prevented. In the middle — acceptable — a coordinated business-continuity system exists and is managed: risk assessment, business impact analysis, prevention and response planning, and lessons-learned implementation are connected rather than free-floating. At the top — world class — the posture inverts: crises are turned into opportunities with measurable upside, corporate reputation is enhanced by the sound management of serious incidents, and other organisations seek the team out for advice.
The value of blunt anchors is that they resist self-flattery. "We have a plan" reads very differently once the question becomes whether the plan covers all components, whether it exists at every level, and whether anyone outside the team that wrote it could act on it under pressure.
Your crisis capability is your weakest dimension, not your average.
The limiting dimension
A composite score across the five dimensions is useful for tracking progress over time, but it's the wrong number to manage by — because a crisis doesn't consult your average. An organisation with world-class processes and untrained people will perform like an untrained organisation on the day. The assessment's working output is therefore the limiting dimension: the weakest of the five, which sets the ceiling on what the other four can deliver. The improvement logic that follows is equally disciplined — lift the limiting dimension one tier, not five. Tier-skipping plans ("we'll go from no plan to world class by Q4") fail for the same reason crash diets do; each tier is built on capabilities the tier below has made routine.
Readiness is not the same question as recovery
It's worth being precise about what this assessment is not. Turnaround work diagnoses where you are once serious decline has already hit, and sequences the recovery. A crisis management assessment sits upstream of that: it examines the system that determines whether an incident becomes a managed event or a full-blown crisis in the first place. The two connect — organisations that skip readiness work tend to meet the turnaround sequence later, under worse conditions — but they answer different questions. One asks "how do we get out of this?"; the other asks "what would happen to us tomorrow, and are we prepared to handle it?"
What the first four hours reveal
If you want to see why each dimension earns its place, look at what the first hours of a real incident demand. Someone has to declare the crisis explicitly — because without declaration, people keep running normal management on top of an abnormal situation (leadership). Someone has to separate what is actually known from what has merely been heard, because first reports are almost always partly wrong (process). An incident commander has to be named, and it is rarely the chief executive — the leader owns the strategic and stakeholder layer, and one person trying to run both drops one of them within hours (personnel). A holding statement has to go out that neither speculates nor goes silent (training shows here — teams that have practised produce it in minutes). And the channels carrying all of this have to work when normal systems are degraded (resources). Every one of those moves is easy to describe and hard to perform cold. The assessment measures, in advance, whether your organisation could perform them.
The uncomfortable arithmetic of crisis readiness is that the assessment is cheap and the discovery is not. Examining the five dimensions honestly costs a few hours of leadership attention. Discovering the limiting dimension live — in front of employees, regulators, customers and cameras — costs whatever the crisis decides to charge. The only real choice is which invoice you'd rather pay.