Business Continuity Plan Exercises and Tests

The primary purpose of testing is to ensure that the strategies, plans and procedures that have been put in place are fully understood by all concerned and are fit for purpose on an ongoing basis.

Business Continuity Plan Exercises and Tests are especially designed to identify problem areas, and so the success of a test cannot be judged solely through whether it worked exactly according to plan (they rarely do!).

The success of a test can be measured by the value which is gained from its performance, particularly in the area of problem identification and resolution.

The objectives of testing and exercising are to ensure that:-

  • All staff are fully aware of their recovery responsibilities and duties;
  • Staff training has been adequate
  • All necessary recovery resources are available as detailed in the recovery plans
  • All essential supplies can be obtained as anticipated
  • All documentation has been kept current and reflects current arrangements and procedures
  • Bottlenecks, uncertainties, and unreliable procedures are identified and resolved prior to any recovery incident
  • Alternate facilities to be utilised in a recovery meet all requirements; and
  • Senior management are comfortable that the plans will work as expected
Test Type Activities Benefits
Table-Top Test or Exercise Normally conducted as one of the first plan ‘tests’, it involves a physical examination and review of the plan documentation.Aims to ensure that:

  • BCP/DRP is complete and relevant to the expressed business needs (operational & strategic).
  • The relevance and currency of the risk assessment, critical applications and the BCP are tested.
  • Inconsistencies in logical flow, resource allocations or conflict between individual plans are recognised
Inexpensive and relatively easy to organise.Allows a rapid test to be undertaken on completion of the plans.
Table-Top Scenario Test Involves a desktop walkthrough of the plan(s), with discussion guided by the use of one or more potential scenarios.The activities are based around a series of questions and answers relating to the deployment of the plans in response to changing issues in the scenario. Has similar benefit to the ‘desktop review’, with the additional advantage that it requires more challenging thinking from the participants.However, it does require a more significant commitment in time and skills to conduct.
Notification and Callout Test Activities are based around the verification of the accuracy, currency and usefulness of contact lists (who you would need to call) Tests notification and contact listsProvides a real time validation of individuals’ ability to respond to the first (and crucial) stage of plan activation.
Live Scenario Test Can be conducted as a limited activation (narrow/specific scenario and/or targeted areas) up to a full-scale activation of all continuity arrangements. Such testing provides the most robust testing (and training) of the plan.However, it takes significant time and resources to plan for and conduct. It may also provide a major distraction from normal business operations.