Assumption

Every plan stands on conditions nobody states aloud: staff can reach the site, the backup supplier has capacity, two systems will not fail together. An assumption is such a condition taken as true, and the term exists to force these silent load-bearing walls into daylight. For leadership the danger is asymmetric, because a wrong assumption costs nothing until the incident, and then it decides everything. Naming assumptions is the cheapest risk control a continuity programme has.

In practice each BIA and each continuity plan carries an explicit assumptions register, written by planners and reviewed by process owners. Assumptions are then deliberately attacked in exercises: the plan assumes 40% of staff can work remotely, so today the VPN is down, prove readiness another way. A famous class of failure is the shared dependency, as when a firm assumed its primary and backup telecoms routes were independent and both ran through the same duct. The register is updated after each exercise and at least annually, and material assumptions reach the board when they touch appetite or investment.

The mistake is treating assumptions as fine print instead of testable claims; an unwritten assumption cannot be challenged, so it silently becomes fact. The correct discipline is to write them down, assign an owner to each and test the critical ones every year. Plans rarely fail dramatically; they fail at the moment a quiet assumption does. In the ERGP programme, a chapter of Module 4 on crisis and exercising deals with surfacing and stress-testing plan assumptions.