Exercising your Business Continuity Plan

There are so many things to consider with regard to exercising your business continuity plan. How will you do it? Who should be involved? Did it work? And, of course, Why bother? If you haven't exercised your plan at least once, completely, in the past year, you can't know if it will work. Read on and get busy with those exercises!

Why do almost 30 percent of DRPs and BCPs fail when they are activated? (Item #1)   If you're not sure how to exercise your plan, the ABA offers great information. (Item #2)   There's no better way to keep your plan up to date than to exercise it. (Item #3)  

Here's a view of training from the risk management perspective. (Item #4)   No matter the scope or complexity of the exercise, several key elements enable the successful outcome of this important component of the business continuity lifecycle. (Item #5)   Are your exercises testing or demonstrating? (Item #6)  

As always, we look forward to hearing your comments & insights regarding business continuity. If you have a topic you'd like us to cover, email me at [email protected].

Bob Mellinger, President
Attainium Corp

1. Why Disaster Recovery Business Continuity Plans Fail

One of the primary reasons why disaster recovery and business continuity plans fall short when they are needed is the failure to test and train staff in how to use the plan. The reasons for this are many; read on.
http://www.e-janco.com/Articles/201107Why_DRP_Fails.html

2. Guide to developing and conducting business continuity exercises

This guide from the ABA shows the high level steps in planning and conducting an exercise. The approach shown breaks the tasks of developing the exercise plan, developing exercise materials and conducting the exercise into manageable pieces.
http://www.americanbar.org/content/dam/aba/migrated/disaster/
pdfs/aba_bcm_guide_final.authcheckdam.pdf

3. Exercises and Testing

Exercising Business Continuity or Disaster Recovery Plans is necessary and should be completed on a regularly scheduled basis and whenever a BC or DR plan has had significant changes made to it. This is essential for ensuring that your plan is current, fully functional and addresses your current operational processes and procedures.
http://continuity.georgetown.edu/exercises/

4. Awareness and Training

Another critical component of business continuity, which will determine the success of business continuity management, is awareness and training. This section will focus on the creation of a program to increase employee awareness and enhance the skills required to develop, implement, maintain, and execute the business continuity plan.
http://www.sorm.state.tx.us/risk_management/business_continuity/aware_training.php

5. The Business Continuity Exercise: Where the Rubber Meets the Road

Nearly every business continuity standards and regulatory body recognizes the need for exercises to validate and continually improve continuity plans, including the National Fire Protection Association (NFPA), the British Standards Institute (BSI), and even the Federal Financial Institution Examination Council (FFIEC). Exercising is also one of the most visible activities in which a business continuity practitioner is involved; it's where the rubber meets the road.
http://perspectives.avalution.com/2012/the-business-continuity-exercise-where-the-rubber-meets-the-road/

6. Disaster recovery plan testing primer: Test to fail

So if everyone agrees that testing of business continuity/disaster recovery plans is a genuine, certified good thing, then there's nothing to argue about here, right? I, however, have reason to disagree with the claimed success of disaster recovery testing. I've seen too many examples of DR plans that have been tested routinely over extended periods of time, but still fail when needed.
http://searchdisasterrecovery.techtarget.com/feature/Disaster-recovery-plan-testing-primer-Test-to-fail