Getting the most out of a business continuity exercise

A business continuity incident is a rare event, so it makes sense to practice occasionally to ensure:

  • People with response and leadership roles know, or can remember, what to do and how to use the planning collateral
  • Contingencies and other resources are actually available as expected
  • Changes in the organisation that could affect the response are picked up and acted upon
  • The governing body, or board, understands the state of preparedness for responding to unforeseen incidents

When planning and running an exercise, there are some key points to bear in mind:

Establish the aims of the test/exercise

Doing this can help:

  • The design of an exercise which meets the organisation’s needs and priorities
  • Participation of the right people
  • Clarify to participants why they are participating.

Set out basic ground rules and principles

Doing this can help:

  • Participants to be put at ease and more willing to take part
  • Set ‘standards’ around certain aspects e.g. confidentiality.

If needed, provide general information on business continuity management

Doing this can help:

  • Reinforce and explain the need for a Business Continuity Manager (BCM) e.g. contractual or in-house requirements
  • Provide an overview for participants who may not fully understand the benefits of business continuity management
  • Clarify popular misconceptions or understanding.

If needed, provide general information on business continuity exercising

Doing this can help:

  • Put testing into context e.g. as one part of the organisation’s business continuity programme
  • Help staff understand that it is an opportunity to practice their individual roles

Clarify the assumptions that participants need to bear in mind throughout the exercise

Doing this can help:

  • Increase the level of engagement in the exercise by participants
  • To signify the start of the scenario phase
  • Avoid mistakes that people might make by mixing up the scenario with ‘real life’.  This is particularly important in a live exercise: One example from an exercise describes how a participant playing the part of an injured person was unable to get treatment when he really became ill because everyone else thought he was still ‘in exercise role’!

Outline the elements of the scenario that you want participants to consider

Doing this can help:

  • Make the test feel more realistic
  • Help get the participants to get ‘in role’
  • Focus the thinking of the participants on elements that you consider important

Set clear and open-ended questions that you want the participants to consider

Doing this can help:

  • Identify issues that even the plan author hasn’t thought of
  • Guide less confident or knowledgeable participants

Record the discussions that take place and the decisions made

Doing this can help:

  • Identify gaps in the plans and arrangements that need to be addressed
  • Items in the Business Continuity Plan (BCP) that need to be altered e.g. because of a change of staff member
  • Enable evaluation of both individual and group performance

Complete a report of the test

Doing this can help:

  • Delivery of future actions needed to improve your BCM approach
  • Updating of information and correcting of any errors in your BCP and procedures
  • Provide evidence that you are using a good practice approach
  • Provide a record of how your plan has been tested
  • Raise awareness of business continuity throughout your team or organisation e.g. by circulating the test report

Ensure you and your staff get the most out of business continuity exercises by being up-to-date with the latest information. Resilient Thinking – Protecting Organisations in the 21st Century is the latest business continuity title from IT Governance Publishing, discussing the importance of thinking laterally about potential impacts on your organisation and examining a ‘thinking’ approach to resilience management.

Additionally, if you want to improve your career in the field of business continuity, take a look at our range of BCMS Training Courses, ranging from foundation through to  lead implementer and lead auditor levels. Find out more >>