Testing and Exercise Outputs are the Building Blocks of a Successful Resiliency Program

When it comes to disaster recovery exercises, your exercise outputs—the reports and results—can be just as valuable, maybe even more so, than the actual exercise itself. That’s why it’s critically important to test, exercise, and document your business continuity and disaster recovery plans frequently.

In a recent blog post, we talked about a gamut of issues relating to exercises including the top 10 considerations for success. While in that blog we shared a lot of insight about how to prepare and be successful, we didn’t, until now, talk much about exercise results and outputs. Let’s do that now.

In our blog “Exercises in Resiliency: 10 Key Considerations for Business Continuity Success”, we talked about how the most successful exercises aren’t the ones where everything goes off without a hitch, instead, the most successful ones are where you identify weaknesses and failures.

Sounds counterintuitive, right?

It kind of is, but at the same time, identifying these issues—before a disruption—enables you to resolve issues so that when a real disruption happens, you’re prepared to respond. This is a great place to highlight the value of exercise outputs and reports.

Before, during and after your exercise, documentation is key.

Before you begin your exercise, you should review your existing documentation such as policies and procedures.

• What has changed since your last exercise?
• Should the plan have updates that reflect those changes?

After you review those plans, it’s a great time to document objectives and set parameters. Be sure to share those objectives with your participants.

For example:

• Does your testing environment have limits?
• If yes, what are they?
• Are there accessibility limits for the exercise (for example no internet or no electricity?)
• Are all systems and applications accessible for the test?
• What are your recovery time objectives?

Documenting your objectives and parameters can help ensure your team members don’t waste valuable time trying to work through scenarios that don’t fit your exercise and can potentially facilitate more engagement and value-add.

Next, be sure that all your team members understand the difference between documenting testing issues and recovery issues.

For example, one of your parameters, no internet access, would be a testing issue. How does that testing issue affect your exercise?

On the other hand, a recovery issue might look something like this: Because our testing parameters determined we had no internet access, we realized our planned recovery processes wouldn’t work because we couldn’t access our data back-up.

• If this happened in a real disruption, this would negatively affect your ability to recover and resume normal operations.
• What is your work-around?
• How could you correct this part of your plan to ensure you have a path to success during a real scenario?

Exercise Reports

Immediately following your exercise, conduct a review. Here are some areas to explore:

• What worked properly?
• Where did your plans have holes?
• What worked as planned?
• Which roadblocks did you encounter and how did you overcome them?
• Which assumptions were correct?
• Which assumptions missed the mark?

You can use this information, and additional follow-on information gathered after the team has had time to digest their experiences, to build your testing report. You can then share your report with your exercise team members and other team members affected by, or who will contribute to, changes that may be required for your plan’s processes. As well, you should share with your executive leadership and key stakeholders.

Know Your Limits

In addition to creating reports, a key output of your exercise should always be continuous improvement.

• What were your limits?
• Do you need additional engagements with your resources?
• When you have to adjust policies or procedures, how are you communicating that across your organization to ensure that key players have awareness and are better prepared to participate in the next exercise or real-world disruption?
• Do they understand why these changes are needed and how they affect their roles both day-to-day and during times of crisis?

Knowing your limits—and explaining them to your key players—is an important part of adopting an organization-wide business continuity culture. You can move your program from one that is heard about only a couple times a year to a program that’s integrated throughout your organization—one where everyone speaks and understands resiliency language.

Executive Engagement

In addition to continuous improvement and solidifying your plans, one of the greatest benefits of the outputs and reports that follow your exercise is the ability to communicate critical information to your executive team and key stakeholders.

Why is this important? Because these exercises give you insight into where you have deficiencies, where your assumptions are incorrect, and reveal where your plans have gaps that could prevent you from restoring operations post-disruption, which can cost your organization unnecessary time and money.

By carefully documenting all of your exercise results and roadblocks, you can share this with your stakeholders to support needs for additional tools, resources, and personnel as they arise—long before a disaster.

Do you need help planning your next business continuity exercise? Check out our Exercise Template for a fully editable template  designed to guide you through the development and effective execution of a wide range of business continuity exercises. Have other questions or need help? Contact a Castellan advisor today.