Volcano, Earthquake, Hurricane, Tsunami – all of the above!
Choosing a realistic and engaging scenario for a business continuity exercise is probably the first thing that comes to mind when you begin the planning process. Although a great scenario is important, it is definitely not the first thing to consider.
Planning a business continuity exercise can be a daunting task. You need to decide which aspects of your plan to test, what type of exercise is most appropriate and finally the scenario. Following the below tips will help you to develop a comprehensive exercising strategy.
The first step is to review your Business Impact Analysis and list all your products, services and activities in an Excel spreadsheet. Next to each item you need to record the exercise type and frequency.
Types of Business Continuity Exercises
The type of exercise you choose will depend on the importance of the area you are testing, bigger exercises give increased assurance; all areas of your plan should be covered.
- Desktop Check: Go through your plans and write a report with improvement actions
- Walk Through: Physically walk through the processes and procedures recorded in the plan, take action to fix any errors
- Note – 50-60% of exercises should be one of the above
- Call Tree: Send out a test message to ensure your staff will receive your communications
- Simulation: Pose an incident and ask for a theoretical response
- Limited rehearsal: Ask a specific business unit to respond to an incident
- Full exercise: put into place the organizations complete BC arrangements
Once you have developed an exercise strategy and schedule you should assemble a planning group, so you can discuss ideas. This group will need to set objectives and define what you want to achieve from this exercise.
It would be useful to develop an incident communication strategy to be tested in any limited rehearsal or full exercises. This could be developed by the planning group, or in a larger organization would be produced by the communications team.
Now it is time to choose an exciting scenario! A great way to engage your staff and create emotion is by choosing a realistic and relevant scenario, set a time-frame for the exercise and include surprising injects.
Bring the scenario to life by using captivating images and short videos in your presentation to set the scene.
For the limited rehearsal and full exercises, it would be beneficial to hold a participant workshop prior to the exercise to discuss the scenario, scope and assumptions. Allow enough time following this workshop to make any changes to the exercise to increase realism and participant buy-in.
One of your main objectives will always be to familiarize teams with their plans and the procedures they should be following. To achieve this, ensure hard copies of the relevant business continuity plans are available for teams to work through, tick-off actions and note anything that is missing.
Debrief
Immediately after the exercise is finished it is vitally important to hold a “hot-debrief” asking the following questions:
- What was your key learning?
- Strengths: What went well?
- Weaknesses: What did not go well?
- Opportunities: Recommendations for improvement?
- Threats: Did you identify any new risks or threats?
If you don’t hold a hot debrief you are wasting a huge opportunity for learning. Once the exercise is over and your participants have left the exercise room, the emotion is gone and they will forget the details.
Make sure you capture everything in the heat of the moment to produce a highly valuable written report detailing the exercise objectives, details of the scenario, hot-debrief and recommended actions.
Resources
Click here to access all of BCP Builder’s available resources, including a PDF copy of the Exercise Cheat-Sheet the above article is based on and a Microsoft Word Template for an Exercise Report.
