The theme for Business Continuity Awareness Week 2015 is about the value of exercising and testing plans. Having facilitated, participated and observed in my fair share of exercises over the last 8 years I’ve reached the conclusion that they’re a waste of time. Worse than that, I think a bad exercise can do more harm than good. I know that’s not going to be popular, so let me explain what I mean…
The process of exercising is designed to validate the assumptions in a plan (or elements of a plan). This is a process which I absolutely think is necessary, but one which, all to often, isn’t effective.
From full-blown reconstructions to glossy media injects, exercise planners or consultants do their best to make the exercise environment realistic. However, this realism tends to evaporate quickly.
I think the problem with exercising starts in the planning phase. Committees meet for months before an exercise to determine locations to use, dates and times, who should participate and what scenarios to use. I think these conversations are pointless, here’s why:
Location: Don’t take people out to a nice conference venue. Yes it’s lovely to have refreshments on tap, but does it familiarise people with the locations they could be working in? If your plan identifies an emergency operations centre, use it! If that facility has a ‘business as usual’ function then make staff there aware that it also serves another function and so they need a business continuity plan themselves! If your facilities are poor all the more reason to use them – it might just help secure investment!
Date and Time: Incidents often happen without warning, therefore so should your exercises. There are some dangers associated with no-notice exercises, but planning in advance can mitigate this. Nor do incidents always respect the convenience of occurring within office hours. Think about conducting your exercises outside of normal office hours. A plan that works effectively at 3am on a Sunday is a good plan!
Invitees: Don’t invite people to your exercise. That might sound a bit odd, but anyone with a defined role in a plan has a responsibility to participate in exercises. The planning process should identify 24/7 contact details for people able to undertake the roles identified. Use those contacts! For instance: if you have a Duty Director on-call, call them. If you use a telephone tree or other alerting system, test it in anger to see if it works.
Scenario: Unlike the three aspects above, picking the right scenario is important. However, beware of falling into the trap of picking a scenario and designing objectives to fit. The focus should be on your capability to respond to issues, the scenario is just a vehicle to facilitate that.
In my opinion, the only two aspects that should be discussed before an exercise are the objectives (what are you trying to learn) and the evaluation (how do you plan to learn it).
Objectives: Exercises really do work best when the objectives are specific and measurable. Specific objectives need to be developed at a high level in advance of the exercise. They should be made clear to all participants so they have a shred understanding about the purpose of the exercise. Don’t be scared of having lots of specific objectives, they’re far more useful than an all-encompassing generic objective like “demonstrate an understanding of plans and procedures”.
Evaluation: There is no correlation between the size of an exercise and its utility. If you’re only interested in whether people can communicate then think about a simple communications test. If you’re interested in how people perform under pressure then look at job-task analyses. The easier an objective is to measure objectively the more confident you can be in your evaluation. Part of your evaluation discussion should also identify the next steps. Have a system in place to make sure you don’t learn identical lessons from one exercise to the next.
Avoid the pitfalls, concentrate on the objectives and exercises can be useful in validating your plans. Happy Business Continuity Week!