Winery operational resilience framework: build a risk register, contingency playbooks and capital prioritization

Most wineries don't fail because of one catastrophic event. They get worn down by a stack of medium-sized disruptions that all hit during the eight weeks when you have the least slack — a chiller compressor that dies mid-ferment, a labeling shipment stuck at customs, a forklift that goes down the same week two cellar hands quit. Each one is survivable alone. Together, during crush, they compound into missed pickups, oxidized lots, and cash that arrives two months late.

The problem with "resilience" as most people talk about it is that it's abstract until you're standing in it. Nobody prioritizes a backup glycol pump in February. Everybody wishes they had one in October. A real resilience framework isn't a binder of worst-case scenarios — it's a repeatable way to rank what actually threatens your operation, estimate what it would cost you, and tie those decisions to a budget cycle you'll actually follow.

This is the system side of resilience: how the pieces connect, where they quietly break as you grow, and how to make funding decisions without either over-insuring against nonsense or getting blindsided by the obvious.

Why resilience planning quietly falls apart at most wineries

The typical winery has resilience knowledge — it's just trapped in three or four people's heads and never written down. The cellar master knows which tank valve leaks. The vineyard manager knows which block floods. The bookkeeper knows which distributor always pays 45 days late. None of that is connected, so when something breaks, the response depends entirely on who happens to be on-site and awake.

That works fine at 3,000 cases. It stops working around the point where you're running multiple ferments, multiple sales channels, and a crew large enough that no single person sees the whole board anymore.

The pattern that shows up again and again: a small winery treats every disruption as a one-off emergency. Something breaks, everyone scrambles, it gets fixed, and nobody records what happened or what it cost. So the same category of failure hits again next vintage and gets treated as another surprise. There's no memory in the system. Resilience requires memory — a place where "the chiller failed twice in three years and each time cost us roughly a lost tank" becomes a data point instead of a war story.

The second failure is scope. Owners tend to obsess over the dramatic risks — fire, frost, a bad harvest — while ignoring the boring operational ones that are far more likely and cumulatively more expensive. A frost event might hit once a decade. A packaging delay hits most seasons. Guess which one people build plans for.

Start with a risk register that ranks by business impact, not drama

The foundation of the whole framework is a risk register: a living list of everything that can disrupt operations, scored so you can compare a rare-but-severe risk against a frequent-but-annoying one on the same scale.

Skip the elaborate risk-matrix theater. You need three numbers per risk and one tier assignment.

1. 1
   Likelihood — roughly how often per year or per decade this occurs
2. 2
   Impact — what one occurrence costs you in dollars, including lost product, idle labor, and delayed revenue
3. 3
   Detection lead time — how much warning you get before it hurts (a distributor slow-paying gives you weeks; a stuck fermentation gives you hours)

That third factor is the one people forget, and it changes everything. A high-impact risk you can see coming a month out needs a different response than a high-impact risk that gives you no warning. Lead time determines whether you need a prevention plan or a reaction plan.

Once you've scored risks, sort them into impact tiers. This is what turns a messy list into a decision tool.

The point of tiering is honesty. You cannot fund everything, and pretending you can is how wineries end up with an expensive backup generator and no plan for the far-more-likely event of their bottling line supplier missing a delivery. If you've already worked through a supply-chain resilience blueprint for packaging and dry goods, a lot of your Tier 2 risks are already half-documented — pull those directly into the register instead of rebuilding them.

A simple workflow for maintaining the risk register looks like this.

Use the register to connect detection lead time to funding decisions and make the trade-off between prevention and reaction explicit.

Playbooks: one per risk type, not one per scenario

A common mistake is trying to write a plan for every specific bad thing that could happen. You'll never finish, and you'll produce documents nobody reads. Instead, build playbooks by risk type, because the response pattern is usually shared across many specific triggers.

Cooling failure, a stuck ferment, and a contamination scare are three different events, but the response scaffold is similar: detect fast, contain, escalate to the right person, and document. Write the scaffold once per category.

A usable playbook is short. If it runs past a page and a half, nobody will open it at 11pm during crush. Each one should answer:

1. 1
   Trigger — what condition activates this playbook (specific and observable, e.g. "any tank above target temp for more than 90 minutes")
2. 2
   First 30 minutes — the immediate containment steps, in order
3. 3
   Who to call — named person, backup person, and the outside vendor, with numbers
4. 4
   Fallback resources — where the spare part, rental unit, or alternate supplier is
5. 5
   Cost threshold for escalation — at what point this stops being a cellar decision and becomes an owner decision
6. 6
   After-action note — a two-line record of what happened and what it cost, which feeds back into the risk register

That last step is what most operations skip, and it's the one that makes the whole framework improve over time. Every activated playbook should produce a data point. After three vintages you stop guessing at your likelihood and impact numbers because you have actual history.

Playbooks also expose coordination gaps you didn't know you had. When you write down "who to call" for a cellar cooling failure and realize the only person who knows the glycol system is a contractor who's often two hours away, you've found a resilience hole that no amount of capital spending would have surfaced on its own.

“

Keep playbooks under a page and a half so the person on duty at 11pm will actually use them.

A usable playbook is short. If it runs past a page and a half, nobody will open it at 11pm during crush. Each one should answer:

The CAPEX/OPEX trade-off: how to actually decide what to buy

This is where resilience becomes a money conversation. For any Tier 1 or Tier 2 risk, you generally have two ways to protect against it, and they hit your books differently:

1. 1
   CAPEX — buy the redundancy outright. A backup chiller, a second bottling head, an on-site generator.
2. 2
   OPEX — pay for access to redundancy when you need it. A rental agreement, a service contract with guaranteed response time, a standing arrangement with a second co-packer.

The instinct at most family wineries is to buy the equipment because ownership feels safer. Sometimes it is. Often it's the wrong call, because owned redundancy sits idle 95% of the year, ages, and still needs maintenance.

A simple worksheet keeps this decision honest. For each protective option, lay out:

A worked example makes the trade-off concrete. Say you're a ~15,000-case winery weighing protection against cooling failure during ferment. A redundant glycol chiller runs somewhere around $28k–$40k installed, plus a few hundred a year in maintenance and the reality that it'll sit unused most of the time. The OPEX alternative — a standby rental agreement with a 4-hour response guarantee — might cost roughly $1,500–$3,000 a year to hold, plus rental fees only if you actually activate it.

If the odds of a cooling failure severe enough to need backup are maybe once every 6–8 years, the rental math is far better, provided the response window is fast enough to save the tank. If you're in a remote area where the nearest rental unit is six hours out, the response window kills the OPEX option and the owned chiller suddenly justifies itself. The right answer depends on your detection lead time and your geography — which is exactly why the risk register feeds this decision.

The mistake to avoid: making these calls one at a time, in a panic, right after something broke. That's when wineries overpay for owned equipment out of fresh trauma. The trade-off worksheet forces the decision into a calm season.

The annual resilience budgeting ritual

None of this survives without a recurring calendar slot. A risk register that gets built once and never revisited is just a document. The framework works because it's a ritual tied to your operations calendar.

The natural spot is right after harvest wrap-up and before you lock next year's capital budget — typically late fall or early winter, depending on your region. By then last vintage's failures are fresh and honest, and you haven't yet committed the money. This is the window where after-action notes actually get written down truthfully instead of being smoothed over.

A tight annual ritual looks like this:

1. 1
   Pull the after-action notes from every playbook that got activated this year and update likelihood/impact numbers in the register.
2. 2
   Re-tier anything that changed. A Tier 3 nuisance that hit four times this season might be a Tier 2 now.
3. 3
   Run the trade-off worksheet on the top three or four unfunded risks.
4. 4
   Fund from the top down until the resilience budget runs out — Tier 1 first, always.
5. 5
   Assign an owner to each funded item and each active playbook, with a review date.
6. 6
   Schedule the one test you'll actually run. Testing every plan is unrealistic; testing your single highest-impact plan once a year is not.

Sequencing this against the rest of your operational planning matters. If you already run a seasonal operations playbook that syncs block tasks, cellar capacity and cashflow, the resilience budgeting ritual should slot into that same planning session — resilience spending and operational cashflow are the same conversation, not two separate ones.

A real scenario: mid-size winery, cooling and packaging exposure

A roughly 12,000-case winery in a warm inland region kept getting hit by the same two categories every vintage: cooling strain during peak ferment and late dry-goods deliveries that pushed bottling windows.

Before building a register, they'd handled both reactively. Two vintages earlier, a cooling shortfall cost them a compromised tank — call it a mid-five-figure loss between lost product and the discounted bulk sale of what they salvaged. The prior season, a late label delivery pushed a bottling run by nine days, which cascaded into overtime and a delayed distributor shipment that arrived after the buyer's promotional window closed.

They ran the framework over a single afternoon. Cooling failure landed as Tier 1, packaging delay as Tier 2. On the trade-off worksheet, they chose an OPEX path for cooling — a standby chiller rental with a guaranteed 4-hour window from a supplier 40 minutes away — for a holding cost in the low thousands rather than buying a $30k+ unit. For packaging, they built a Tier 2 playbook with a pre-qualified second label supplier and a rule to order dry goods two weeks earlier than their old habit.

The following vintage a compressor did fail. The standby unit was on-site inside three hours and the ferment held. No lost tank. The label supplier slipped again, but the earlier order date absorbed it and bottling stayed on schedule. Their total resilience spend for the year came in under what that one compromised tank had cost them a couple of seasons before. Nothing dramatic happened — which is the entire point.

When this framework is worth it, and when it isn't

When it makes sense: You're past the size where one person can hold the whole operation in their head — usually somewhere north of 5,000–8,000 cases, or any winery running multiple ferments and multiple sales channels at once. If disruptions during crush regularly turn into scrambles, you've outgrown ad-hoc.

When it's overkill: A very small operation with one owner doing everything, a single sales channel, and enough personal slack to absorb shocks doesn't need a formal register. You'd spend more time maintaining the framework than you'd save. A lightweight one-page list of your top three risks is plenty.

Who should be careful: Wineries in a fast growth phase sometimes build the framework once and then let it calcify while the operation changes underneath it. If you added a new label, a new tasting room channel, or doubled production, your old risk tiers are wrong. Growth invalidates last year's register faster than anything else — which is exactly why the annual ritual matters more the faster you scale.

Where this connects to the rest of your operations

Resilience isn't a standalone project. Your risk register pulls from the same knowledge that drives your seasonal planning, your supplier relationships, and your cashflow forecasting. The reason it's usually kept in people's heads is that there's rarely a single place to record and connect operational history — which failures happened, what they cost, who owns the response, and when each plan was last reviewed.

That's the practical case for keeping this in a shared operational system rather than a spreadsheet that lives on one laptop: the after-action notes, the playbooks, the tier assignments, and the review dates all need to be visible to the people who'll actually use them at 11pm during crush. Whether that's dedicated operations software or a well-disciplined shared workspace matters less than the discipline itself — but the framework only compounds in value when its memory is centralized and doesn't walk out the door when a cellar hand leaves.

Build the register, write the playbooks by risk type, run the trade-off worksheet before you spend, and lock the budgeting ritual into your post-harvest calendar. Do that for three vintages and you'll stop being surprised by the same disruptions — not because you predicted the future, but because you finally started keeping score.