A Business Continuity Plan (BCP) must be tested and
updated on a regular basis to ensure its effectiveness in
the event of a disaster and its continuing relevance to
the Business.
To be successful, BCP testing requires careful planning
with consideration given to the following aspects:
The type of test undertaken should be commensurate
with the BCP’s maturity, the needs of the business and
be economically viable. It is essential however, that the
full BCP is tested at least once a year.
The types of tests that can be undertaken can be
defined as: -
A plan review is similar to an audit of the BCP and involves the BCP team discussing/reviewing the plan, to determine if any elements are missing or inconsistent. This type of test is also very useful for training new members of the BCP team.
A simple test would include testing the activation of the staff call tree, checking of suppliers/customers details and other contacts etc. This ensures all relevant details are kept up to date. Whilst this is a practical test it is limited in its extent.
Desk top exercises involve all the crisis management team plus an observer(s) being gathered together in a meeting room, where they are presented with a specific disaster scenario and asked to use the BCP to simulate dealing with it. The circumstances of the scenario can be randomly changed, during the test as the team’s responses develop, to assess how they react and adapt to a changing situation.
Desktop tests enable the company to determine if the BCP team members know their duties or whether further training is required. It also enables the effectiveness of the BCP to be assessed and helps identify any errors or inconsistencies.
Simulation tests are the closest thing to actual
invocation of the BCP and are therefore the most
effective in determining if it will work as expected in a
realistic situation. In simulation tests the team is
provided with a scenario and they actually follow the
procedures developed in the BCP and use the resources
allocated to deal with it e.g. use of a separate disaster
recovery site, use of alternative equipment, use of
services from a third party or buddy site. These tests
can involve sending teams to other locations e.g. to
restart technology or business functions. This type of
test should identify any staff concerns with regard to
their role/nature of their role, any missing or
insufficient resources and any errors or omissions in the
BCP.
Testing should be prioritised by starting with the plan
review then moving on to the very simple and desk top
testing. The final more complex simulation testing
should only be undertaken, when the other tests have
all been completed successfully.
Regardless of the type of test undertaken it is important
to keep the scenario plausible and relevant and small
scale issues are often just as useful, when testing the
BCP as large scale disasters.
Also as the primary purpose of testing is to identify the
effectiveness and possible limitations of the BCP it is
essential that a full debrief is undertaken after each
test, to discuss the outcome(s) e.g. what worked well,
what was missing and any participant concerns
identified. The BCP should then be updated to reflect
these findings.-
For further information, please contact your RMC Engineer
RMC Insight document “Business Continuity Planning”.