What happened
Compliance Week published a piece built around a new book by compliance veteran Tom Fox, "Deluge Before Dawn: Heartbreak, Survival and Resilience After the Guadalupe River Raged". Fox lives in the Texas Hill Country and experienced the July 4, 2025 Guadalupe River flood as a local, and the article draws five lessons for organisations planning their own worst days.
The first is that systems which function under stress are activated, not invented during the crisis. When the river rose, the data that mattered was unavailable, information arrived in fragments, the people responsible for crisis oversight were unreachable, and nobody had been deputised to set priorities. By the time the picture was clear, several options for reducing harm had closed.
The second concerns lines drawn years earlier. Camp Mystic had operated for nearly a century. When FEMA maps placed its cabins in a potential flood area, the directors contested the maps on the strength of historical experience, appealed, and won. The site carried on and new structures went up. The article's assessment is blunt: fully compliant and still a disaster waiting to happen.
The third is that crises arrive together. The flood came at night, on a holiday, with cell service failing and evacuation routes becoming impassable. One failure fed the next.
The last two lessons are about trust and memory. A local community foundation stood up a dedicated fund within hours because decades of grant reviews, board governance and donor stewardship had made its credibility work like infrastructure. A 1987 storm that killed ten children produced lessons that did not hold, and the article warns that forgetting invites tragedy anew.
Why this is a GRC story
Compliance sets a floor, and this story is about what happens when a team treats the floor as the ceiling. Contested maps are a legitimate process, and the appeal was procedurally correct. The problem is that the decision weighed historical experience against evolving conditions and chose the answer that preserved the business, with the downside carried by other people. That is a risk acceptance decision, and risk acceptance is where governance either works or does not.
The planning lessons transfer without stretching. Named decision makers, pre-authorised deputies, one source of truth for status and a rehearsal of multisystem failure are the same requirements any continuity plan needs, whether the trigger is a flood, a ransomware event or a supplier outage. An organisation that has never tested who takes over when the usual owner is unreachable does not have a plan, it has a document.
The trust lesson is the one most often skipped. Good governance is slow work with no visible output until the day it is needed. Here it was the difference between hours and weeks in getting help to people.
What to watch
Watch how anniversary coverage treats resilience as against emergency response, because the harder questions are about decisions made years earlier and who owned them. For teams well outside Texas, the practical follow up is a plan review with three questions attached: who decides when the usual owner is unreachable, what happens when two critical systems fail at once, and where the organisation has accepted a risk on the strength of experience rather than evidence.
Attribution: Analysis based on Compliance Week and related public reporting. This article is original commentary, not a repost of the source material.