I have spent 35 years in operations, compliance, and program management across technology and financial services. I have worked with organizations that had beautiful continuity plans, well structured, board approved, neatly formatted. And I have watched some of those same organizations scramble when something actually went wrong.
The plan was never the problem. Every organization I have worked with had one. Some had several. The problem was always the same: nobody could prove the plan was real.
Not real in the sense that it existed. Real in the sense that people knew their roles during a disruption. Real in the sense that someone had actually tested recovery procedures. Real in the sense that when a client or a regulator asked "show me your evidence," there was something to show beyond a PDF with last year's date on it.
That gap, between having a plan and proving it works, is where organizations fail. Not during the audit. During the disruption.
The honest truth about most BCP programs
I have sat in enough governance meetings to know how BCP programs typically run. Once a year, someone updates the document. Leadership signs off. A drill is scheduled, sometimes it happens, sometimes it gets pushed to next quarter. If it happens, a few people attend. Someone takes notes. Those notes go into a folder. The folder gets forgotten.
Then an auditor asks: "Show me the evidence from your last drill. Who attended? What gaps were identified? Were corrective actions assigned? Were they completed? Who owns them?"
And the scramble begins. Someone searches through emails. Someone checks the shared drive. Someone remembers there were notes but cannot find them. Three days later, a package is assembled, incomplete, inconsistent, and unconvincing.
I have seen this happen at small companies and large ones. The size does not matter. What matters is whether continuity is treated as a living operational discipline or a once a year documentation exercise.
What separates organizations that are ready from those that only look ready
After 35 years, I can walk into any organization and tell you within a day whether their continuity program is operational or decorative. The signs are always the same.
The first thing I check is people. Not documents, people. Does the receptionist know the escalation chain? Does the IT lead know the recovery time objective for the lending platform? Does the vendor manager know which critical vendors have their own continuity arrangements, and which do not? If the people closest to operations cannot answer these questions without looking them up, the plan is not operational. It is a reference document that nobody references.
The second thing I check is vendor depth. Most organizations list their critical vendors in the BCP. Very few track whether those vendors have contingency plans of their own. Even fewer have identified alternative vendors. This is where I have seen real disruptions cascade, not because the organization failed, but because a vendor failed and there was no fallback. A continuity plan that does not account for third party and fourth party exposure is incomplete. Full stop.
The third thing I check is drill quality. Not whether a drill happened, whether it produced anything useful. Did the drill test a realistic scenario? Did the right people participate? Were gaps documented honestly, not glossed over to make the report look clean? Were corrective actions assigned to specific individuals with deadlines? Were those actions actually closed?
A drill without evidence is a meeting. A drill with evidence is proof.
The fourth thing I check is whether leadership is genuinely engaged. Business continuity is an operational discipline that requires leadership accountability, not just a signature on the annual review. Do leaders understand the maturity of their continuity program? Do they know where the gaps are? Are they making decisions based on real readiness data, or are they signing off on a summary they did not read?
The organizations that survive disruption are the ones where leadership treats continuity as an operational priority, not a compliance checkbox.
What the Fannie Mae supplement changed for mortgage servicers
For mortgage servicers specifically, this is no longer an abstract conversation. Fannie Mae's Business Resiliency Supplement made it concrete. Servicers now need to demonstrate, not just document, testing, governance, incident readiness, and continuity controls. Annual validation with board level accountability. A 36 hour cybersecurity incident reporting window. Drill evidence with corrective action tracking.
The supplement did not ask servicers to write a better plan. It asked them to prove their operations are ready. That is a fundamentally different requirement, and it demands a fundamentally different approach.
The servicers who will navigate this well are not the ones rushing to update their BCP document. They are the ones building an operational continuity discipline, with real drills, real evidence, real vendor oversight, and real leadership engagement.
Why I joined this mission
I joined Outamation Labs to help build Beacon BCMS because I believe the mortgage industry needs to make this shift. From documents to discipline. From plans to proof. From annual reviews to continuous readiness.
What convinced me was a simple idea: every action inside a continuity program should produce evidence automatically. Every drill should generate a report. Every corrective action should have an owner. Every vendor risk should be tracked. Every escalation chain should be tested and current. And all of it should be exportable in minutes, not assembled over days.
After 35 years of checking whether operations actually work, I know that the difference between readiness and failure is not the quality of the document. It is the discipline of the operation behind it.
A plan that has never been tested is just a promise. The organizations that keep that promise are the ones that prove it, continuously, not just when someone asks.