Business Continuity Forum
EXERCISE CHECKLIST:
Following our forum in May 2015 we have produced the following checklist
that offers simple guidance in planning and delivering a business
continuity exercise
‘If you haven’t tested your plan, you haven’t really got one’
THE PLANNING PHASE
Fixing a date - Setting a schedule for exercises in the corporate or business plan
Corporate Clash – getting it on the corporate calendar; avoiding the leadership away-day (unless
that’s part of your plan!) Scheduled work IT/Estate/Facilities that might clash
Executive Diary – part of obtaining commitment
Participants – some may book leave!
Book rooms and equipment
Before an external or internal audit
Executive commitment – set out your case
Some people will not fully co-operate without this. Use executive meeting minutes as a reference
point.
Budget & Funding
May need to account for production time lost but weigh against losses without a plan.
Refreshments.
Internal cost centres - eg room rentals.
Determine type of exercise – from ‘walk through’ to ‘full
simulation’ – linked to length of exercise from 1 hour
discussion to 1 day high pressure and time driven!
A simple ‘walk through’ might be a pre–cursor
to a larger event.
For smaller companies – a 1 hour structured
discussion is a good place to start. Consider
multi-lateral – ie other
agency/entity/critical supply chain/
involvement; role of head office. Your business is
not an island. The red line in the diagram opposite
represents a difficulty threshold that has to be
crossed in order to build excellence.
Suffolk Resilience – Business Continuity Forum. Main Author: Alan Pawsey with contributions from
other forum members. June 2015.
Obtaining support & marketing the exercise to colleagues
‘Know your people and culture…cut
Consider forming a Planning team – for larger exercises (if
your exercise cloth accordingly’
budget permits).
Administration Support – something different for a trainee for example
Exercise Integrity – do you want people to know what the exercise is about?
Posters, team agendas – get some ‘what if’ questions circulating to stimulate interest in Business
Continuity Planning.
Exercise Objectives
Setting out what you want to test – the whole plan or just
‘Some may initially be reticent
parts of it. You might want to validate how IT Disaster
about taking charge of a
Recovery works with Business Continuity that includes fall
situation…others can’t wait. Both
back locations, staff re-location, IT ‘work-arounds’ and
need careful handling…’
communication. Also to see if people with specific
responsibilities act according to the plan. Not forgetting leadership structures, time drivers,
suppliers, contractors and partners. Are there ‘single points’ of failure that should be explored? Are
different parts of your company able to talk to each other and understand the problem?
Above all be realistic about resources, experience and capability. An over-arching objective could be
to learn from the experience and provide a lever to improve planning.
The Scenario - fire, flood and an attack from Mars!
…the usual suspects are power
The Scenario is simply a means to introduce realistic problems
failure, fire and flood.
for people to solve.
Focus on specific risks to your
Avoid very unlikely events – even though they may be high
business
impact. Power failures, flooding, severe weather damage &
fires are all good scenarios.
Good scenarios uncover dependencies, single points of failure and fit with your Objective.
The Exercise Plan – the mechanics of how it will work and who is doing what and when.
What is happening and when. How will events be introduced – eg. telephone/radio, in person, slips
of paper, who? Almost everything from start to finish – sometimes called a Major Events List (MEL).
Think of it as a travel itinerary. Ensure those that are contributing are fully briefed and contactable –
eg. someone coming in to give/receive information – you might want to change things.
Prepare to play with time – differentiate between ‘exercise time’ and ‘real time’ – eg enabling focus
to shift from incident management to recovery within the time allocated. Also for example, to
manage pre-exercise emails building up the scenario – eg. – Severe weather warnings.
Build in time drivers – ‘the chairman needs a briefing by 2pm for a press conference’
Start of Exercise: Briefing
Explaining build up to exercise, what’s happened and why are
they here – ‘the Business Continuity Plan has been invoked by…’
Do people remember to bring their
BC plans with them to the Exercise?
No!
Suffolk Resilience – Business Continuity Forum. Main Author: Alan Pawsey with contributions from
other forum members. June 2015.
More basic ‘walk-though’ type exercises tend to require more guidance and explanation.
Consider prompt on planned leadership structures and a pre-briefing for leadersthat may enable a
prompt start.
Work through your Exercise Plan!
If something really interesting starts to happen don’t feel constrained by your plan – prepare to be
flexible. If necessary, allow for ‘time-out’ to deal with specific issues – sometimes people get
entrenched in a particular issue or have taken a completely wrong track.
End of Exercise – ‘Hot Brief’
‘No such thing as a bad exercise as
What needs to change? Enable participants to describe
long as you learn from it’
identifiable points for action – ‘lesson identified’, thoughts
and feelings. Give your feedback last – be critical but end
on a positive.
Invite email feedback that could feed into a more formal debrief or Exercise Report for your
executive/board. Consider ‘Survey Monkey’ or similar to gain feedback from many.
Exercise Report – Action Plan
A more formal paper drawing conclusions about the exercise and what it achieved. It should also
include an Action Plan to deal with issues and faults that emerged (non-comformities). Where an
audit is likely or your organisation undergoes due diligence with clients, this provides a trackable
evidence base adding substance to your claims. Most Action Plans include the fact that a further
exercise is required before a specific date in the future!
Suffolk Resilience – Business Continuity Forum. Main Author: Alan Pawsey with contributions from
other forum members. June 2015.