How to Run a Great Business Continuity Exercise

James Stevenson, MBCI, writes on his blog in this piece about creating successful business continuity exercises. He shares 10 tips, listed below:

  1. 1) People first – Stevenson says it’s important to understand the people involved because that can help determine how difficult the exercise needs to be. Ask yourself questions such as who’s the sponsor for the exercise? How much money/what resources are they ready to commit? How experienced are the people in the team doing the exercise?
  2. 2) Understand the business – If you’re planning an exercise for a business that you’re unfamiliar with, then you’ll need to find someone in that business to help you gather information (someone not on the exercise team), Stevenson advises. You’ll need to ask about site plans/layouts/process flows, incident management plans, any particular areas/customers/suppliers/third parties of concern, what they do, how it works, what goes wrong, what they’re worried about, etc.
  3. 3) Balance training and practice – In advance of the exercise, the facilitator needs to gently assess the team’s capability and determine the required balance of training and practice, Stevenson says.
  4. 4) Set exercise objectives – When setting your clear objectives for the exercise, think about the changes you want to see as a result of the exercise.
  5. 5) Pick the right type of exercise – There are four levels of exercises, Stevenson says, so you’ll need to figure out which one is right for your specific situation with each company: a walk-through, a desktop/table top, a time-pressured desktop, and live or real time. For further explanation of these exercise styles, click the link at the end of this article.
  6. 6) Write a great exercise – Stevenson offers a number of points to help you do this, including making sure the scenario is plausible and something that will resonate with the team. He adds, don’t be too complicated and keep an eye on the news for ideas.
  7. 7) Do the admin – Plan well ahead to fix a date, keep the scenario secret from anyone involved in the exercise, have the exercise sponsor send out the invitations, organize food/drinks/location/conference calls etc.
  8. 8) Run a great exercise – Complete any training, set the ground rules, share the exercise objectives, share the initial scenario and then work through the injects, have people talk through what they would do at each stage of the incident.

 

For an example of how to write a great exercise, see Stevenson’s piece here: http://www.smartbusinesscontinuity.com/10-steps-to-great-business-continuity-exercises/