Most people who underprepare for a disaster are not ignorant of the risk. They know about it. They underprepare anyway. That gap between knowing and doing is the psychology of preparedness, and it applies to your executives and your crisis team as much as it applies to households.
I’m not immune to it. When I was five, a tornado hit my hometown of Covington, Indiana. My family sheltered in an interior closet, and the town was without power for about two weeks. I went on to make a career out of crisis management, and so did my wife. On Managing Uncertainty, Episode 6, recorded in 2017, I admitted where our own household stood: “You would think both of us being crisis management folks that we would be better at this, and we’re not.”
If two crisis professionals can put off their own plan, so can your organization. The fix starts with understanding why.
Why we underprepare: six biases behind the psychology of preparedness
The most useful research on this comes from Robert Meyer and Howard Kunreuther of the Wharton Risk Management and Decision Processes Center. In The Ostrich Paradox: Why We Underprepare for Disasters (Wharton Digital Press, 2017), they trace most preparedness errors to six decision-making biases. Their 2018 issue brief defines each one. Here they are, with what each looks like inside a company.
1. Myopia
“A tendency to focus on overly short future time horizons when appraising immediate costs and the potential benefits of protective investments.”
In a company, myopia is the annual budget cycle. The cost of a recovery strategy lands this year. The benefit shows up in a year nobody can name. The investment loses to whatever pays back by the fourth quarter.
2. Amnesia
“A tendency to forget too quickly the lessons of past disasters.”
Three years after the ransomware attack, the people who lived through it have moved on, the AAR is in a folder nobody can find, and the urgency is gone. This is why we tell clients to make only new, original mistakes. Repeating an old one means the organization forgot.
3. Optimism
“A tendency to underestimate the likelihood that losses will occur from future hazards.”
Meyer has said that if one of the six is most fundamental, it is excessive optimism. In business it sounds like “that won’t happen to us,” or “our IT team would never let that happen.” What practitioners often call normalcy bias, the assumption that the next ten years will look like the last ten, is amnesia and optimism working together.
4. Inertia
“A tendency to maintain the status quo or adopt a default option when there is uncertainty about the potential benefits of investing in alternative protective measures.”
Inertia is the business continuity plan that has been “due for an update” for three years. Nobody decided not to update it. Nobody decided to.
5. Simplification
“A tendency to selectively attend to only a subset of the relevant facts to consider when making choices involving risk.”
Simplification is why so many organizations prepare for one scenario, usually the last one they lived through. It is also why a 300-page plan doesn’t help. When people are overwhelmed, they pay attention to a few facts and ignore the rest.
6. Herding
“A tendency to base choices on the observed actions of others.”
Herding works in both directions. If your executives skip the tabletop exercise, their direct reports will too. If peers in your industry are investing in a capability, your board will ask why you aren’t.
| Old View | New View |
| People underprepare because they don’t know the risk | People underprepare because of predictable biases, even when they know the risk |
| Fix it with more awareness and more warnings | Fix it by designing around the biases |
| Fear motivates action | Confidence and practice motivate action |
| Preparedness is something people opt into | Preparedness is the default people would have to opt out of |
How to change the psychology of preparedness in your organization
Meyer and Kunreuther’s key point is that these biases are hard to overcome, so you design strategies that work with them rather than against them. They call it a behavioral risk audit. Here is how I’d translate that for a resilience leader.
Make preparedness the default
Inertia is powerful, so put it to work. Don’t ask business units whether they’d like to update their plans this year. Put the BIA refresh, the plan review, and the exercise on the calendar before the fiscal year starts, with an owner and a date. Make skipping it the thing that requires a conversation with an executive.
Stretch the time horizon
Myopia and optimism both shrink when you change the time frame. A risk with a 1% chance in any given year sounds remote. The same risk carries about a 22% chance, roughly one in five, of happening at least once over 25 years. That is the life of a building, a data center, or a long supplier contract. Present the longer horizon to your executives, and the investment looks very different.
Translate the risk into the business
Executives respond to dollars, customers, and strategy, not to disaster vocabulary. Show what one day of downtime costs a critical service, and who notices first. That moves the conversation from “will it happen?” to “what would it cost us?”
Shrink the first step
Simplification and inertia both punish big, vague asks. “Build a business continuity program” stalls. “Name the five services we can’t lose for more than a day” gets done. Start small, deliver something in weeks, and build momentum.
Use herding on purpose
Put your executives in the room for the exercise, and let the rest of the organization see them there. Share what peer organizations are doing. When preparedness is visibly what leaders do, people follow.
Build confidence through practice, not fear
Fear makes people avoid a topic. Practice makes them capable of handling it. Train people on their roles first, then exercise them often enough that the process becomes muscle memory. On Episode 319, I said: “We don’t just rise to the occasion, but rather we fail to the level of training that we have.” I made the same case for training before you exercise on Episode 307.
Short, frequent practice beats one big annual event. Crisis microsimulations give teams reps in an hour, which fights amnesia without burning people out.
Write down what you learned, and use it
Amnesia is beaten by records, not memory. Run an After-Action Report (AAR) after every exercise and real event, assign every action to a person with a date, and read the last AAR before you design the next exercise. I talked about why on Episode 163.
Start with your people’s families
Personal preparedness is the easiest way into the topic, because everyone already cares about the outcome. As I put it on Episode 6: “If they can’t take care of themselves and they can’t take care of their families or they’re worried about their family, they’re not coming to work.” Use National Preparedness Month each September to help employees build household plans and kits. People who have prepared at home understand why the company is preparing too.
The role of leadership in preparedness
Every one of these biases is stronger when leaders signal that preparedness is optional. Your executives set the default, model the herd behavior, and decide which time horizon the organization uses. If they treat the exercise as a calendar conflict, no awareness campaign will undo it.
The good news is that the reverse is also true. When executives show up, ask hard questions, and fund the gaps the exercise exposes, the rest of the organization follows. The exercises section of our Ultimate Guide to Crisis Management covers how to get them there.
Knowing the risk has never been the hard part. Design for the biases, and the preparation follows.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- Make practice easy. Exercise in a Box® gives your leaders 15 microsimulation scenarios they can run themselves, so preparedness becomes a habit instead of an annual event.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
Unlocking Success: Exploring the Benefits of ERM for Your Organization