A plan that is written, maintained and subject to review can demonstrate that an organisation has established the required arrangements. What it cannot, on its own, demonstrate is how those arrangements will perform on the day.
The gap between having plans and processes in place and being able to act effectively when it matters is one we see regularly at Kenyon. It rarely comes down to a lack of compliance. More often, it comes down to capability — whether people understand their roles, can make decisions under pressure and can put those plans into practice.
This article looks at what compliance and competence actually tell us, where capability gaps tend to appear, why those gaps can develop over time, and what organisations can do to turn what they learn into meaningful improvement.
Compliance and competence answer different questions.
Compliance looks at whether the arrangements required by a regulator, standard or internal policy are in place. That might mean having an emergency response plan, defined procedures, trained personnel and records to demonstrate that those requirements have been addressed.
Competence is different. It is about whether the people responsible for the response can use those arrangements effectively, making decisions, coordinating with others, communicating clearly and adapting when circumstances change.
In aviation, emergency response planning is an established part of preparedness. ICAO describes an emergency response plan as an operational-level document setting out roles, actions and timeframes for responding to unexpected situations and disruptions. IATA's Emergency Response Best Practices Handbook similarly covers areas including command and control, crisis communications, family assistance, telephone enquiry centres, mutual assistance and emergency response exercises.
Having those arrangements in place is essential. But it does not necessarily tell us how effectively the current team will use them when an incident occurs.
Can people find the information they need quickly? Do they understand who has authority to act? Can different functions coordinate when information is incomplete? Can the organisation adapt when the situation develops differently from the plan?
Those are questions of capability, and they are difficult to answer from a document alone.
The capability gaps we see most often
The weaknesses that emerge in exercises and reviews are often surprisingly consistent. They tend to sit at the point where a documented arrangement meets the reality of people, decisions and operational pressure.
The plan is difficult to use
Emergency response plans need enough detail to be useful, but they also need to work for people who may be using them in unfamiliar and stressful circumstances.
In the opening stages of an incident, there may be little time to work through a lengthy document or interpret complex instructions. The strongest plans give people a clear starting point, define who does what and provide practical tools and checklists that can be used when the pressure is on.
ICAO's emergency response planning guidance similarly emphasises defined roles, actions and timeframes, while its guidance material includes consideration of checklists, training and exercises.
The people and contacts have changed
Organisations rarely stand still.
People move roles, leave the business and take on different responsibilities. Deputies change. Contact details change. Suppliers and external partners change.
A plan can be reviewed on schedule and still contain assumptions that no longer reflect the organisation as it exists today. Testing notification arrangements and key contacts therefore matters just as much as maintaining the document itself.
Decision-making is unclear
In a crisis, decisions often need to be made before all the facts are available.
If it is unclear who can activate the response, commit resources, escalate an issue or approve an initial communication, valuable time can be lost while people work out who is actually empowered to act.
Exercises are particularly useful here because they force those decisions into the open. What looks straightforward in an organisation chart can become much less clear when several decisions need to be made at the same time.
Communications are not fully integrated
Operational response and communications develop together from the first moments of an incident.
What is known, what is not known, what action is being taken and what needs to be communicated are all connected. If communications are treated as something that happens after the operational response, important opportunities to coordinate information and manage expectations can be missed.
IATA's current emergency response guidance includes crisis communications as a core element of emergency response planning and training.
Too much depends on key individuals
In many organisations, a small number of experienced people carry a disproportionate amount of the knowledge and confidence needed to manage a crisis.
They know the relationships, understand the processes and may have been through previous exercises. The risk is that capability becomes dependent on particular people being available.
A deputy's name on an organisation chart is not the same as a deputy who has practised the role and knows how to step in.
Capacity is assumed rather than tested
An organisation may know how it intends to scale its response, but that is different from knowing whether it can actually do it.
Can additional people be mobilised quickly? Can a telephone enquiry centre or family assistance operation scale when demand increases? Are systems, facilities and suppliers able to cope? What happens when normal arrangements are overwhelmed?
These questions are difficult to answer from a plan alone. They need to be tested.
IATA's emergency response material specifically addresses areas such as telephone enquiry centres, humanitarian response, family assistance, crisis communications and exercises, reflecting the breadth of capability that may be required during a major incident.
The common thread across all of these gaps is that they may not be obvious during a document review. They become visible when people have to use the plan, make decisions, coordinate with others and deal with a situation that is moving faster than expected.
That is where exercising adds value.
Capability changes even when the plan doesn't
One of the challenges with preparedness is that capability changes over time.
The team that exercised the plan two years ago may not be the team responding today. People who understood the roles, knew who to call and had experience making decisions together may have moved on. New people may have joined without ever having practised their role in a crisis.
The same applies to relationships. Regulators, authorities, emergency services, suppliers and other partners can change over time. Relationships that were once well established can become less familiar, particularly if they have not been used or tested.
This does not necessarily mean the plan is wrong. It means the organisation around the plan has changed.
Maintaining capability therefore requires more than reviewing the document. People need opportunities to practise their roles, teams need to work together, and important assumptions need to be tested rather than simply carried forward.
It also means recognising that capability is not something an organisation establishes once and then retains indefinitely. It needs to be maintained.
Finding the gap is only the beginning
An exercise is useful because it creates an opportunity to see how plans, people and processes perform in practice.
A well-designed exercise introduces enough uncertainty and pressure to reveal things that are difficult to see on paper: an unclear role, a contact that no longer works, a decision that needs too many approvals, a team that is unsure how to respond or a capability that has never really been tested.
But finding a gap is not the end point.
The real value of an exercise comes from what an organisation does with what it learns. Closing an action is not necessarily the same as closing a capability gap. The measure of learning is not simply that something was done. It is that the organisation can perform differently because of it.
A finding might lead to a change in a procedure, additional training, clearer decision-making authority, new resources, a different approach to communications or a change in how teams work together.
The important question is what happens next.
If an exercise identifies a weakness in crisis communications, for example, updating the plan and closing the resulting action is only part of the process. The organisation should then practise the new approach and, where appropriate, test it again.
This is where organisations can fall into the trap of measuring activity rather than improvement. An exercise is completed, an after-action report is produced, and actions are recorded as closed, but the same issue appears in the next exercise.
Closing an action is not necessarily the same as closing a capability gap.
The measure of learning is not simply that something was done. It is that the organisation can perform differently because of it.
That creates a much more useful cycle:
Identify → Improve → Practise → Test → Measure → Repeat
The objective is not to create a perfect exercise or prove that everything works. Exercising cannot guarantee that a response will work perfectly on the day. What it can do is bring weaknesses to the surface while there is still time to address them — and provide an opportunity to test whether those improvements have made a difference.
IATA's current emergency response training similarly places emphasis on implementation, training, exercises and simulation, reinforcing the role of practical testing alongside emergency response planning.
A simple test of readiness
A senior leader can learn a lot about their organisation's readiness by asking a few straightforward questions.
If a serious incident happened tomorrow, is it clear who has the authority to make the first critical decisions, and can that person be reached?
Is the crisis plan practical enough for a team under pressure to use, or does finding the right information depend on working through pages of detail?
When were the contacts, roles and call-out arrangements last tested rather than simply reviewed?
Does every critical function have someone who can step in if the usual lead is unavailable?
Has the team that would respond today ever worked through a realistic scenario together? Have they had to make decisions with incomplete information, coordinate across functions and deal with the unexpected?
And perhaps most importantly:
When your last exercise identified a significant weakness, what actually changed afterwards, and have you tested whether the change worked?
The answers to these questions provide a useful indication of current capability. Where the answer is uncertain, that uncertainty is itself worth investigating. It may point to a gap that only becomes visible when the organisation is under pressure.
Understanding your Organisations readiness
The gap between a compliant organisation and a capable one is closed on the quiet days, through the plans, people and practice built long before an incident arrives.
Training and exercising are an important part of that process, but sometimes it can be difficult to know where to start. You may have a plan in place but be unsure whether it is still fit for purpose. You may have identified gaps through previous exercises but be struggling to prioritise what needs to change. Or you may simply want an experienced, independent view of where your organisation is today.
That's where a conversation can help.
At Kenyon, we have decades of experience helping organisations prepare for, respond to and learn from serious incidents. We can talk through your current arrangements, the challenges you are facing and the areas where you have concerns or uncertainty.
That might mean looking at your emergency response plans, discussing how your teams are trained and exercised, exploring how you manage lessons and improvement actions, or simply challenging some of the assumptions that sit behind your current approach.
We can use our experience to help you identify where there may be gaps, where your preparedness is working well and where there may be opportunities to strengthen capability. Sometimes that may lead to training or exercising; sometimes it may be a change to a process, a clarification of roles or a different way of approaching preparedness.
The important thing is to start the conversation.
If you want to understand how prepared your organisation really is, get in touch with Kenyon today. We can talk through where you are, where you want to be and how we can help you get there.
Kenyon is the crisis management and response capability of TrustFlight, with more than 120 years of experience across more than 700 incidents in 170 countries and a global network of over 2,500 trained responders. That experience gives us a practical perspective on the difference between having arrangements in place and being able to put them into practice when an incident occurs.
The best time to understand the gap between compliance and capability is before you need to respond.