Your crisis plan has never met a real crisis. Deloitte shows the gap

Deloitte and the Society for Corporate Governance just published a board crisis management survey. One number stopped me cold.

41% of private companies experienced a regulatory investigation in the last three years. Only 8% had it in their crisis plan.

That's not a gap. That's a structural failure.

The Risk Was Already There

My friend Mike Rizzo at Legend Labs has a name for this: dormant vulnerability.

The organization already knows the risk exists. Legal flagged it. Compliance raised it in a quarterly review. Someone on the board mentioned it in passing. And then the meeting ended, everyone moved on, and the risk went back to sleep.

Until it stops being dormant.

The Deloitte data shows this pattern isn't an exception. It's the rule.

• 25% of large-caps faced a regulatory investigation. 9% had it in their plan.
• 28% of large-caps faced major litigation. 9% planned for it.
• 41% faced a supply chain or geopolitical disruption. 32% planned for it.

These aren't obscure tail risks. Regulatory investigations, major litigation, supply chain disruption. These are the crises that show up on the front page. And most organizations are running plans that don't account for them.

The reason isn't ignorance. It's the way crisis plans get built. They're designed around what companies fear in the abstract. Cyber breach. Natural disaster. The scenarios that feel dramatic enough to warrant planning. Not the ones that actually arrive.

The Board Problem Is Worse Than It Looks

The survey also looked at board involvement in crisis preparedness. The findings are their own quiet warning.

Fewer than 10% of companies, large-cap, mid-cap, or private, have their board participating in scenario planning or tabletop exercises.

Most boards review a plan. Almost none run it under pressure before the pressure is real.

I've heard this confirmed firsthand by practitioners in this space. The tabletops get cancelled. Far too often. A scheduling conflict. A competing priority. An assumption that the plan is good enough on paper. And so the board that is supposed to provide strategic oversight during a crisis has never actually practiced the scenario they would need to lead through.

That's not a governance failure in the abstract. It's a concrete operational gap.

Crisis decisions don't happen in a conference room with a PowerPoint and unlimited time. They happen at 11pm on a Tuesday when the CEO is on a plane, the GC is fielding calls from three law firms, and someone has to decide what goes out in the next two hours. The board member who has never run that scenario is being asked to govern it in real time.

A Plan That Has Never Been Tested Is a Document

There's a meaningful difference between having a crisis plan and having crisis capability.

A plan is a document. It describes what the organization intends to do. It lists the people who are supposed to be in the room. It outlines the communication protocols. It satisfies the audit requirement.

A capability is something else. It means the people in that room have run the scenario before. They've made the hard calls under simulated pressure. They've identified the moment where the plan breaks down and built a contingency for it. They know what decision architecture they're working from.

A crisis plan that has never been stress-tested is not something you can execute under pressure. You find out what it's actually worth at the worst possible moment.

Why This Gap Persists

The coverage gap in the Deloitte data isn't a mystery. Organizations update their crisis plans in response to crises they've already had. Cyber breach goes on the list after the breach. Regulatory investigation goes on the list after the investigation.

The problem is that crisis planning designed around past events doesn't prepare you for the next one. By the time the scenario makes it into the plan, you've already paid the tuition.

What's missing is the practice of running the scenario before the crisis selects it for you. Looking at the dormant vulnerabilities that exist right now, not the ones that materialized last year, and asking: what does our decision architecture look like if this activates?

Most organizations don't have a clean answer to that question.

The Infrastructure Gap

I spend my days building an AI-powered decision support tool instead of writing crisis plans for a specific reason. The problem isn't that organizations don't know crises are coming. The Deloitte data confirms they do. 41% of private companies dealt with a regulatory investigation. They knew the exposure existed.

The problem is that knowing a risk exists and being structurally ready to respond to it are two completely different conditions.

Dormant vulnerability doesn't become dangerous when it appears. It becomes dangerous when it activates and the organization has to make high-stakes decisions without having rehearsed them.

Most companies know what's coming. They just haven't practiced arriving.

---

The Deloitte and Society for Corporate Governance Board Practices Quarterly on Crisis Management and the Board, fielded Q4 2025, surveyed members representing 76 public and 17 private companies of varying sizes and industries. Full report available at Deloitte.com.

Mike Rizzo is a partner at Legend Labs.