Business continuity planning is crucial to post-disaster recovery and success. But testing your BCP is just as important. So, why is testing not ubiquitous?
It could be that organizations don’t know what steps to take once BCPs are developed.
To help, we’ve compiled some testing best practices you can follow to test your BCPs.
The benefits of business continuity testing
The insurance brokerage, Gallagher estimates that more than 70% of companies without a comprehensive business continuity plan (BCP) fail to recover from a significant business interruption.
What does comprehensive mean, though?
Beyond being complete in covering all systems of prevention and recovery from potential threats to a company, a business continuity plan must be adequately tested to be considered comprehensive.
The other benefits of business continuity testing include:
- Helps identify gaps and areas for improvement in the business continuity management system (BCMS)
- Ensures compliance with regulatory requirements
- Improves the quality of the plan itself by introducing new, relevant information
- Demonstrates commitment to BC to clients, which might help secure new business and/or deepen existing relationships
- Reduces recovery time and costs
Putting together a best-practice business continuity testing program
However, the fall-off in numbers from organizations who have developed a BCP to those who regularly test their BCPs indicate that business continuity testing isn’t intuitive.
How to make it clearer?
Business continuity testing best practice consists of picking the right business continuity plan exercise out of the many available option.
What are the options? They include:
Alert exercise
The purpose of an alert exercise is to test the organization by alerting the involved participants and getting them to arrive at a designated place within a certain time. It can also be used to test an alert mechanism. This type of exercise is primarily applied to internal staff.
Start exercise
Building upon the alert exercise, the start exercise tests how fast an organization can be activated and start carrying out its tasks. A start exercise is therefore a means to test and develop the ability to get started with resilience processes.
Decision exercise
A decision exercise is primarily used to exercise decision-making processes within an organization, e.g., the ability to make fast and clear decisions on actions and to initiate cooperation between those responsible and stakeholders, under time pressure.
Management exercise
This type of exercise is a combination of alert exercise, start exercise, staff exercise, decision exercise, and system exercise. The focus is often on the roles, organization, SOPs, etc.
Cooperation exercise
A type of exercise where coordination and cooperation between management levels is exercised. A cooperation exercise can be carried out both, in large and small scales.
This kind of exercise may consist of: “Vertical” coordination (between national, regional, and local levels); “Horizontal” coordination in a sector where public and private stakeholders participate.
Crisis management exercise
A crisis management exercise simulates crisis conditions and gives personnel the opportunity to practice and gain proficiency in their plan roles.
Strategic exercise
A strategic exercise refers to comprehensive exercise activities at a strategic level (e.g., inter-ministerial crisis staff, political-administrative staff, cross-sector and cross-departmental management staff, crisis management organization of corporate management).
Aims of strategic exercising include improving the integrated crisis reaction ability in exceptional threat and danger situations (crisis situations) and developing a comprehensive coordination and decision culture.
Exercise campaign
An exercise campaign is a series of recurrent exercises with a common generic organizational structure.
Business continuity testing from beginning to end
Once scheduled, the actual exercise should run according to best practice, too, starting with an initial run through.
From there, the exercise will move to a start-up briefing then launch. For the launch, the organization should check the communications that will be used to launch, stop (temporarily), and terminate exercises and testing prior to the scheduled launch.
Organizations should wrap things up with a post exercise briefing to gather information from actual exercises and testing. Critique of actual incidents and near-incidents will provide valuable information concerning the following:
- The validity of the plan
- The resources that were available
- How the resources were used
- The transfer of behavior learned in training.
Finally, business continuity plan tests aren’t complete without an after-action report, whose primary purpose is to inform stakeholders which practices are working as planned and which are not.
But how to create a repeatable business continuity testing program? Check out the repeatable steps we lay out in the article: 6 Business Continuity Plan Testing Best Practices.
.svg)
.svg)
.svg)