As an operational risk consultant, I encounter clients who have no business continuity plans—“that takes too much time and money” and/or “we don’t have anyone on staff who knows how to do that kind of stuff”—and who have opted instead to create plans around disaster response and/or crisis management. Sometimes such plans are emergency management oriented, with a fat binder full of procedures, and in such situations, what can be done to...