Plan for the Saturday when nothing connects
Boards usually ask how likely a payments, network or cyber outage is. The more useful question is how long each store can keep selling with nothing behind it, and whether someone owns the answer as carefully as they own a new system.
On the Saturday before Christmas 2023, the processor that handled all our card payments stopped working at twenty past eleven in the morning. It came back at five past two. For two hours and forty-five minutes, more than six hundred Ravessa supermarkets could take cash and nothing else, on one of the busiest trading days of the year, in a country where most shoppers no longer carry much cash. We estimated the lost sales afterwards at €2.3 million. The number I remember better is the store managers' reports of abandoned trolleys, which came from more than two hundred stores.
Nothing that happened that day was inside our systems. It was a failure at a supplier, and it would have counted as a low-probability event on any risk register. I had raised the risk of a single payment route in 2022, accepted the answer that a second route was too expensive for the likelihood involved, and moved on to other work. I have since changed my mind about how retail boards should think about resilience, and the change starts with that answer.
Probability is the wrong question
Risk registers in retail, as elsewhere, rank threats by likelihood and impact. A card-processing outage, a regional network failure, a ransomware attack on a distribution centre: each is assessed as unlikely in a given year, and each is given an owner and a mitigation. The approach is sensible for deciding where to spend. It is a poor basis for deciding how a store should behave, because a supermarket chain with six hundred stores, four distribution centres and dozens of external services will experience some serious outage most years. What varies is which one.
A more useful question for a board is not how likely each failure is, but how long each store can keep selling when the thing behind it is gone. That question has an answer that can be measured and improved, independent of which failure arrives. When we asked it at Ravessa in early 2024, the honest answers were uneven. Our stores could sell for three days without head office, because the in-store servers held prices and promotions. Without our single card processor, they could not take one card payment. They could receive goods for a day or so without a distribution centre, depending on how much was in the back room.
The second number was the one that had cost us the Saturday. It now looks different. A second acquirer receives part of our normal traffic every day, so that we know it works, and limited offline acceptance applies if both routes fail. When our main processor failed again for fifty-five minutes on a Friday evening in September 2025, 97 per cent of card payments still completed.
What a supermarket needs to keep selling
Thinking in terms of time without support changes what a technology function builds. The core of a store's ability to sell is surprisingly small: a product file with prices, a till that can record a sale and print a receipt, some way of taking payment, and a record that can be sent onward when connections return. Each element can be held in the store, with explicit limits. Our tills can sell for seventy-two hours without the centre. Offline card acceptance runs to €80 per transaction for at most three hours. Fresh counters can weigh and price without the network, because the scales hold their own price files.
The limits matter as much as the capability. Offline card acceptance moves fraud and decline risk onto the retailer, and that was a real objection from our finance director and internal audit. We answered it with a ceiling, a time limit and a declared-outage trigger, not with an argument that the risk did not exist. Every degraded mode involves a trade of that kind, and the trade should be decided in advance by the people who own the risk, not improvised by a store manager at a quarter to twelve on a Saturday.
The same reasoning applies upstream. When ransomware reached our Guadalajara distribution centre in February 2023, the store-level question was how long 164 stores could stay stocked while their warehouse was rebuilt. The answer was several days at reduced availability, because colleagues picked from printed orders at about a third of normal speed. That fallback had not been designed in advance. It worked because experienced people improvised it. We have since written it down and trained it, and we have separated our distribution centres from one another so that an attack on one need not stop all of them.
Rehearse it in a real store on a real Tuesday
The third part of my argument is about testing. Most organisations test their continuity plans in a meeting room, against a scenario, with the systems running normally outside. That tells a board whether the plan has been written, not whether it works. Degraded modes fail in mundane ways: a receipt printer that needs the network to print a logo, a self-checkout that will not start without a central licence check, a card terminal whose offline setting was never switched on in one region.
We now disconnect a trading store completely twice a year, on an ordinary weekday, with real customers in the aisles and the store manager in charge of when the exercise ends. We also send a small share of live payment traffic down the second route every day. Both practices have found faults that no meeting would have found, including a batch of self-checkouts that refused to start offline after a software update. The exercises cost little. They do require the operations director to accept a small risk to one store's sales on the day, and that acceptance has to be agreed at the top rather than requested by the technology team each time.
For a board, the useful questions follow. For each store-critical service, how long can a store sell without it, and how was that figure tested? Who owns each degraded mode as a product, with a budget and a test schedule, rather than as a document? And what trade-offs, such as offline payment risk, has management accepted in advance, at what limits? A retailer that can answer those questions has not eliminated the bad Saturday. It has decided in advance what the bad Saturday will cost.