Hour 0–24: the scope freeze
The first action of a recovery is not investigation. It is a scope freeze.
A program in recovery is, by definition, a program where the relationship between commitments and capacity has broken down. New scope cannot be absorbed; existing scope is already under pressure. Yet in the absence of a formal freeze, change requests continue to enter the program, dependencies continue to shift, and stakeholder expectations continue to expand. Each of these is reasonable from the perspective of the individual stakeholder making the request. Together, they are fatal to recovery. The freeze stops the bleeding.
The freeze does not need to be perfect. It needs to be explicit, communicated to every workstream lead, every vendor with an active commitment, and every governance body with the authority to introduce change. It declares that for a defined period — typically four to six weeks — no new scope will be accepted, no existing scope will be expanded, and no commitments will be made against capacity that the program does not currently have. The freeze gives the recovery team something it has not had for some time: a stable boundary.
Done properly, the scope freeze takes most of the first twenty-four hours. Most of that time is communication. The freeze that is announced once and never repeated is the freeze that erodes within seventy-two hours. The freeze that is restated daily for a week is the freeze that holds.
Once the scope is frozen, the next priority is establishing what is actually true.
A program in recovery typically has multiple, partially overlapping versions of its delivery position — what the steering committee was last told, what the workstream leads believe, what the vendors are operating against, what the technical team observes in the system itself. Each of these is partial. None of them, on its own, supports a defensible plan forward. The evidence reconstruction is the disciplined process of consolidating these into a single, evidence-based position that everyone can act on, regardless of where they were positioned before the recovery was called.
The reconstruction has a specific structure. It begins with the artifacts — the plan, the dependency map, the RAID log, the milestone list, the financial position — and tests each one against the latest direct observation. Where the artifact and the observation disagree, the artifact is provisionally suspended pending resolution. The output is not a new plan; it is a credible baseline against which a new plan can be built. The baseline is shared in writing within forty-eight hours of the recovery being declared.
The discipline of this phase is the refusal to skip ahead. Recovery teams that try to produce a new plan before the evidence base is reconstructed will produce a plan that perpetuates the assumptions that caused the original failure. The forty-eight hours spent establishing what is true is the most valuable forty-eight hours of the recovery.
Figure 1. The structured sequence of activities across the seventy-two hour recovery window — scope freeze (0–24 hours), evidence reconstruction (24–48 hours), and stakeholder reset (48–72 hours) — each prerequisite to the next. Source: IT Delivery Assurance methodology, 2025.
"The forty-eight hours spent establishing what is true is the most valuable forty-eight hours of the recovery."
PMI Pulse of the Profession (2024) and Standish Group CHAOS Report (2023). Combined recovery-success analysis. Across the two studies, projects identified as in trouble and subjected to formal intervention within the warning-signs window achieved stabilization or partial recovery in approximately 70% of cases, compared to 30% when intervention came after that window had closed.
