How Testing Your Business Continuity Plan Identifies Gaps

Businesses face myriad threats: everything from a rodent infestation to a planned renovation. A developed business continuity plan provides your organization with the tools to predict, prevent, and respond to risk efficiently. The strategy ensures that the organization and its clients will remain operational with minimal to no downtime or threat to operations.

However, drafting a plan is half the battle. What’s most important is ensuring your business continuity strategy is sound, useful, and practical. This is where testing your plan comes into play. Testing business continuity allows you and your workforce to exercise how to approach an emergency and find gaps in the plan to address where it needs improvement.

Types of Business Continuity Tests

Plan Review

A plan review is much like an audit of the BCP. The BCP team and the C-level management or department heads get together to review the plan and decide if any components are missing or need revision. This type of test is beneficial for training new members of the BCP team or in regular onboarding. Among other aspects reviewed during a meeting are contact information, the validity of recovery contracts, and coverage of applicable business continuity and disaster recovery scenarios. A plan review may also include training new managers on plan details so they can pass that knowledge down to their teams.

Tabletop Test

This is a more involved way of reviewing and testing a BCP. Employees participate in an actual exercise during a tabletop—a scenario-based, role-playing exercise. Everyone involved practices their roles and responsibilities during an emergency, such as an earthquake, hurricane, or active shooter.

Walk-Through/Simulation Test

A BCP simulation test is a more hands-on type of tabletop exercise. While a tabletop test, as the name suggests, typically consists of discussing plan details around a table, a simulation test combines real recovery actions. It can be data loss and restoring backups, live testing of redundant systems, network outage, physical recovery, emergency notification, and other relevant processes. In addition to critical personnel, all employees would be involved in this BCP event testing process.

Frequency of Business Continuity Plan Testing

The frequency of testing your BCP depends on your company.

We recommend evaluating each of your emergency preparedness plans, such as business continuity, disaster recovery, incident response, and other plans, during a year. Testing would typically include an annual tabletop exercise or a walk-through test of all individual EPP plans, including testing various scenarios for threats that are a high risk to your organization. Make sure to continually test those scenarios of higher priority to your organization.

Many factors can help you determine how often your organization needs to test its EPP plans.

• Employee count changes
• Changes in clients/vendors or their contact information
• Department changes
• Employee job function updates
• Structural changes to the building

The size, location, and how often your company goes through changes are typically the most significant factors in determining how often you should test your BCP. Enterprise companies and employees who experience regular turnover should be updating and testing their BCPs twice a year. For small to mid-sized organizations, it is recommended to do a run-through test once a year to make sure that the plan is still effective and all staff is refreshed on what to do in the event of an emergency.

Involving Vendors in Your BC Testing

In the course of your testing process, whether you’re doing a plan review, tabletop test, or simulation test, you need to make sure your critical vendor partners are included in your testing. Verifying that your vendors are prepared for the unexpected and have a contingency plan is essential, as it allows for greater accuracy and usability of your strategy. It also allows your vendors to provide feedback that may be valuable to your plans or testing process.

Document the Testing Process

Finally, it’s necessary to document the results of any testing conducted, along with any actionable findings from those tests. Doing so will help your workforce learn what can and should be improved and visualize progress that's been made. Following up on these items and consolidating recommendations from tests is the most crucial process in the BCP testing lifecycle. Testing, registering your testing results, and executing methods to improve your BCP is the most reliable way to strengthen your organization’s response processes.