Are your business continuity exercises effective enough?

Choose the exercises well

Most organizations have limited time, budget, and resources available to exercise. To optimize success, facilitators and senior management need to set realistic goals and be clear about how well the type of exercise they will select will prepare them for a real-life disruption.

Inevitably, within an organization there will be different expectations for the results of the exercise. If the objectives are not ambitious, it will result in a boring exercise, but if they are too ambitious, they can create unrealistic pressures on the participants, who may feel overloaded and exposed. In both cases, it would be a disincentive for future participation.

Exercises and reality

Real-life incidents take days or weeks to resolve, but most organizations can't spend more than a day on an exercise. This creates an asymmetry in terms of time scale, in which information must be managed and all required corrective actions coordinated, while delivering the main results.

Achievements according to the type of exercise

• Discussion and scenario based exercises can be used to promote experiential learning and collaborative planning and enable broader stakeholder groups to discuss the incident response.
• Exercises involving multiple scenarios and problem sets are a useful advocacy tool for socializing different risk profiles with senior leadership, developing and verifying risk significance, and reviewing and refining existing blueprints.
• Simulation exercises, live and test, replicate the interaction between incident response teams. These exercises can condition people to some of the pressures of an incident, but rarely to the fatigue of a prolonged crisis.

The key trade-off when determining what type of exercise is required based on the organization's needs is its complexity and the lead time required to develop a plausible scenario; the more complicated and ambitious the exercise, the higher the preparation requirement.

Better reflexes

Whatever the outage, most of the time it results in the same symptoms: reputation management, communications, stakeholder engagement, and the need to restore operational production. Therefore, the exercise benefits by developing institutional synapses and the knowledge of how to respond to any incident.

Source: Robin Bucknall MA, MSc, MBCI, is a Senior Consultant, Needhams 1834 Ltd.