Finally! You've got your Business Continuity plan finished. Will it work, though?

Will your Business Continuity plan really work?

You’ve spent the time to create a plan. Perhaps you’ve followed all the right steps. Maybe you’ve even used the Good Practice Guide available from the Business Continuity Institute – available here, if you haven’t, by the way: it’s a great tool.

So, already, you’re ahead of most of the competition.

Question is – will in work in practice? At Oakview, we’ve seen the results of plans that look good on paper, but don’t worked in practice. We’ve also, perhaps unusually, managed major disruptions through fire and the loss of a senior individual – and seen the benefit of a well-rehearsed plan.

And identified ways to improve it for any future disruption, despite ‘knowing’ that we had practiced and thought we’d got it close!

One solution is to run a quick exercise – see how, here…

A tabletop exercise is a great and relatively painless way to move your plan from a theoretical exercise stimulating few, to a practical example which if run well, will stimulate many by simulating disruption.

And it needn’t be a major problem. Sometimes, the simplest examples will do. We’ve may scenarios which can be used, for different industries.

Best of all – a table-top can be done without the interruption of and the risks connected with a full-scale drill. Rather than actually simulating a disaster, the Incident Management Team is taken through a simulated disaster, ideally with a facilitated discussion focusing on the objective outcomes and the practical process-driven considerations.

It can be a simple affair conducted your own people, or with the assistance of externally qualified support. We recommend an escalating scenario that unfolds in several phases, sometimes in a linear fashion; sometimes with the unexpected results of earlier research. If prepared well, the facilitator will make sure that the uncertainties or shortfalls identified when writing the plan will be included. The CEO or equivalent should be canvassed to make sure that any concerns he or she have are also included, if possible.

After each phase, the IMT should discuss how they might respond, and how they ought to react. The plan is then adapted to cater for the potential problems and alternative actions. The improvements are used for the next exercise – because if run well, those involved will have seen the potential problems caused by inadequate planning.

In a perfect world, it provides the springboard for wider exercising, including more realistic scenarios and expanded teams. These further exercises should then involve the Disaster Recovery Team and Business Continuity Teams – the people who will determine success or failure for your organisation!

Top tips:

1. Talk to your CEO, or their equivalent. Get their buy-in to the objective, and support for the IMT involvement. It is amazingly hard to get this level of management involved without such support
2. Talk to colleagues in similar industries or get close to someone with that experience – they’re more likely to know what disruptions are most likely to attract the attention of busy senior executives
3. Decide how much gloom and doom you want because too gloomy an exercise can cloud people’s perception – going over the top with unrealistic exercising can cause damage to the idea of a plan. You’re always better choosing something disruptive yet credible
4. Agree your parameters – what should be available, and what not. Offsite exercises bring home the need for planning and awareness better than if facilities or devices are closer and more available. However, getting busy people away from a desk is hard
5. Test how quickly you can pull together key players – knowing that people are available and not away on business or holiday can allow you test just how quickly you can get hold of them. Or not…
6. Involve everyone. Make sure each person has a role. If one person answers all the questions, have others enact how they would respond if that person were unavailable
7. Acknowledge that first-timers may be nervous. Some people will be nervous if they feel judged, and may not want to show uncertainty in responding to issues, so consider an introduction to Business Continuity planning
8. Take the lessons with you. A designated note-taker should keep track of what happens; always leave time for lessons learned
9. ACT! We have seen many exercises conducted because people think they should, or have had it recommended. However, simply running an exercise without learning lessons is a real and dangerous waste of time because it can breed complacency. Think about whether you need a further exercise involving the same people, or a wider audience

Not every organisation will want to go through the exercise. If you’re skilled or fortunate enough to get this far – make it count!

Good luck.