Giving consideration to the vulnerabilities of your organisation’s daily operations and documenting planned responses in a Business Continuity Plan is good practice in today’s volatile and fast-paced business world.

However, once you have been through the process of developing a BCP, the task is not finished. You can’t have confidence that the strategies in the BCP are right for your organisation, or that your workforce is sufficiently familiar with the plan to put it into effect, unless you conduct regular testing exercises.

Such a testing exercise will be most beneficial if the scenario underlying the test is selected with care to suit your organisation.

Some of the pitfalls to be avoided in scenario selection are:

  • Being overly influenced by the hype surrounding recent incidents in the media, e.g. setting a scenario based around workplace quarantine due to Australian Bat Lyssavirus when your organisation has no exposure to the risk factors.
  • Using scenarios that are easy to stage but bear little or no relevance to the risks actually faced by the business, e.g. a fire on a premises with excellent fire protection strategies in place but the organisation’s most serious risk is inability to keep staffing at full levels.
  • Ending the scenario at the point when the Business Continuity Team / Crisis Management Team is notified, on the assumption that responses from this point cannot be realistically played out in a desk-top/hypothetical situation.
  • Using much the same scenario year after year with largely cosmetic changes to detail, thus minimising the learning opportunity as well as potentially failing to pick up flaws in untested portions of the plan/team.

Considerations for useful scenarios and test exercises include:

  • Involve the personnel who gather risk management data for the organisation, as this data can suggest realistic scenarios which actually do need to be solved and documented in the BCP.
  • Give consideration to the credibility of the scenario – what is realistic for your organisation and/or location? For example, the main production facility being taken out by a crashing commercial jet airliner is probably a fairly remote chance, but the loss of power to a CBD building is certainly feasible (as Darwin residents recently experienced).
  • Set measureable objectives for the exercise to give focus and ensure that the exercise achieves something concrete. The objectives will also often assist in the selection of suitable scenarios.
  • Ensure the scenario facilitates an exercise through to business resumption (the goal of BCPs), rather than ending when personnel safety has been assured.
  • Require participants in the emerging hypothetical responses to justify the feasibility of their stated actions (not only what they would do but also how and why).

With consideration of all of the above, the business continuity plan testing exercise stands a much better chance of returning useful results for the improvement of both plan and staff responses.

Please contact QRMC for more information.