ISJ hears exclusively from Scott Blake from Ardfern Global about why untested plans fail and how delay disguised as governance amplifies risk.
In late 2007 in Beirut, I ran a readiness test that, at the time, felt like the sort of disciplined prudence security teams like to applaud and occasionally celebrate as if training were a virtue in its own right.
The concept was simple: simulate small-arms fire, watch the guard force react, assess how they moved, how they communicated and whether leadership showed up.
Then the first bursts cracked across the street and I was reminded – quickly and publicly – that your plan is never the system, it is only your best description of the system, usually written while ignoring the inconvenient parts or the parts that sit just beyond your field of view, budget or even authority.
Plans VS planning
People like to quote that no plan survives first contact with the enemy.
But that assumes the plan actually made it to contact, which implies it was exercised before the world chose to do it for you.
In most organisations, the real problem is not that the plan breaks, it’s that it is never tested and we mistake the absence of friction for strength, even for validation the organisation is ready.
In essence, plans are five letters and rarely much more than intention made legible, then quietly filed away on the intranet.
Planning is the work: thresholds, roles, decision rights, posture, rehearsal and the discovery of what you missed or never knew.
Embarrassingly, I had failed to consider the Lebanese Armed Forces (LAF) outpost just beyond our compound wall. They responded exactly as trained: armored vehicles arrived, rifles shouldered and shouted commands cut through the street.
Inside our perimeter, the guards I was testing froze, radios crackling with overlapping calls as everyone tried to locate authority that, in that moment, did not exist.
It resolved peacefully, largely because a local LAF officer decided not to make it worse and because I was lucky enough to learn the lesson without paying a higher price.
The takeaway was not about pyrotechnics or my red-faced embarrassment – it was about second and third order effects, the ones that show up uninvited the moment you touch reality and how quickly “good governance” becomes meaningless if it cannot produce a decision at the speed of the environment.
Avoidance dressed as governance
That failure mode is prevalent in corporate security and resilience teams, especially inside larger organisations that pride themselves on process, stakeholder management, committees and doing things “the right way.”
We tell ourselves we are being prudent, when what we often mean is that we are buying time because we are uncomfortable owning the decision.
Indecision gets rewarded as maturity and rigor and delay becomes a socially acceptable substitute for action because it sounds responsible and spreads responsibility thinly enough that nobody feels exposed.
I call this avoidance dressed up as governance.
Delay is not neutral: it narrows options, compounds risk and creates second and third order harm that can exceed the downside of an imperfect decision made earlier.
The part we dislike admitting is that waiting is still a choice and time does not bill you for it until the invoice is large, irreversible and non-negotiable.
Think of a major storm. In today’s digital world, it rarely surprises people because nobody saw the forecast. It surprises them because the mind is adept at believing the impact will be limited, the storm’s track will shift and the worst-case is too disruptive to take seriously until it becomes unavoidable.
People wait, they soften the language, they “closely monitor” and they assume they can always act tomorrow, right up until tomorrow arrives and the shelves are empty, the roads are clogged and the power is out.
Security and resilience teams fall into the same pattern, except our delays are dressed in careful phrasing and delivered with polished confidence.
We over-index on perfect information and allow the appearance of rigor to stand in for meaningful movement.
Who hasn’t sat through a meeting and had the same two thoughts loop in their head:
- Why am I here?
- What did that achieve, beyond proving that everyone still has access to the calendar system?
Though the issue is not meetings, the issue is when meetings become a substitute for decisions and we pretend convening equals action.
When time becomes risk
Fast-moving crises make this worse, because the decision window is short and the cost of waiting is predictable and rarely favorable.
I was in Doha during the September 2025 strike, close enough to watch a normal day flip into a decision day with little to no warning.
That is when the enterprise needs early posture, not perfect consensus.
But by the time an organisation – large or small – scrambles the right people across time zones and committees, the moment has often passed, the best options have degraded and the “assessment” becomes a retrospective explanation for why it was hard to decide in real time.
We saw a similar psychology before Russia’s invasion of Ukraine, not a lack of warning, but a lag between warning, intelligence and institutional action.
“It can’t happen to me” is not a childish thought – it is a comfortable adult posture and it has a habit of aging poorly.
If you want to reduce paralysis, stop treating speed versus deliberation as a moral argument and start treating it as a design problem, because the right tempo depends on the decision you are making and the environment you are operating in.
Practical decision making
A simple test is usually enough.
If the environment is moving, time is a risk factor and the goal is not perfection, it is a defensible first move that reduces exposure, buys time and preserves options.
A late decision is often worse than an imperfect early one, especially when the first move is reversible.
The ability to revise is the point.
Be bold enough to update and honest enough to admit it.
The alternative is waiting for reality to bend back toward your first assessment, which it won’t.
This is where intelligence teams can get tangled in their own expectations. Analysts are not paid to be perfectly right, they’re paid to be clear, including coming clean on what they do not know.
Naming uncertainty is still analysis, provided it is specific: what is unknown, why it is unknown, what we assume, what we assess as most likely and why, and what would change the assessment.
Done well, that reduces ambiguity, surfaces trade-offs and gives decision-makers the inputs they need to act early and reversibly, with clear conditions for escalation or rollback.
In practice, the output should be decision options, not certainties: pause nonessential travel, adjust event posture, place vendors on standby, raise local controls and communicate what’s known, what’s unknown and what would trigger the next step.
If the environment is stable and the decision is irreversible, time is your asset and deliberation should be exhausted.
Public attribution, actions that materially affect individuals and steps that create durable legal exposure deserve serious review.
Most teams fail because they apply the irreversible-decision playbook to reversible situations, then congratulate themselves on being prudent while the clock keeps running.
The fix is empowerment, properly defined empowerment.
If you want teams to stop drifting into paralysis, you do not fix it by telling people to “be more decisive” and then punishing the first imperfect call.
You fix it by designing strategies that match the tempo of the threat, which often means training and entrusting the most junior person in the chain to make the first move within clear guardrails, while the broader leadership machine catches up.
Not because junior is wiser, but because junior is present, closest to the ground truth and presence matters when the environment is moving faster than your internal convening cycle.
The myth of ‘lessons learned’
And when delay wins, which in many cases it does, we then comfort ourselves afterwards with copy and paste paperwork: the “lessons learned” ritual.
Something happens, we convene, we produce a document, cascade and quietly assume risk has been reduced.
But who decided anything was actually learned. The phrase carries a kind of veiled arrogance, hubris in operational clothing, as if naming the failure is the same thing as building capability.
If there is no owner with authority, no change to playbooks, no rehearsal and no measurement, then your “lesson” is just a nicer-sounding autopsy.
Under pressure, people revert to habit and habit is built through repetition and rehearsal, and occasionally the mistake you bothered to learn from, not through documents.
The acid test is one question: what will people do differently at 2am, under pressure with partial information.
If you cannot answer that cleanly, nothing was perhaps learned.
The Still Point
The still point, the idea I return to throughout my book The Still Point, is not quietness for its own sake and it is not a romantic argument for patience, it’s about composure under pressure: the ability to see clearly enough to act cleanly, without the theatrics of panic and without the comfort of delay.
In other words, the still point is not inactivity, it is disciplined movement at the right tempo.
Governance therefore is not the enemy. Governance that replaces decisions is and “monitoring” that becomes a substitute for action is simply risk, wearing a nicer suit.
