Exercising

The annual business continuity exercise checklist

· 6 min read · PlanProof

Short answer

An annual exercise runs all year: confirm last year’s actions are closed, pick this year’s risk and the plan it tests, set a date that avoids Ramadan hours, summer leave and year-end, write two or three objectives, brief the team, run the exercise with an observer, report within three working days, assign actions with owners, feed the management review, and keep the evidence pack together.

The exercises that go wrong are rarely badly run on the day. They go wrong in October, when someone realises the annual exercise has to happen before the audit in December, the crisis manager is travelling, the only free date is during year-end closing, and nobody checked whether last year’s actions were ever closed. This checklist is the one we wish every client had taped inside the front cover of their plan. It follows the year, and it assumes a UAE calendar, because that calendar is where most of the trouble starts.

First quarter: set the year up

  • Pull out last year’s report and the action list. Which actions are closed with evidence, which are closed on paper, which are still open? Open actions from last year are the first finding of this year, and an auditor will look for them early.
  • Decide what this year tests. One risk and one plan. If last year was cyber, this year might be site loss or severe weather. Look at the three-year programme and pick the gap. If there is no three-year programme, this is the year to write one — a single page listing which critical activities and sites are covered in which year.
  • Decide the type. A facilitated tabletop for the crisis management team is the default. Add a technical test for every recovery promise the plan makes that has never been tried. Only plan a full simulation if the last two tabletops found little.
  • Name the sponsor. One senior person who will attend, approve the report, and chase the actions. An exercise without a sponsor produces a report nobody reads.
  • Book the date now. Avoid Ramadan working hours, the summer leave season, the last weeks of the financial year, and your own peak periods, whether that is the Eid holidays for a hotel or the exam season for a school. In the UAE that leaves fewer good weeks than people expect, and they fill up. Put a second date in the calendar in case the first one is lost to a real incident. NCEMA 7000:2021 (8.6.2) also says an exercise must not adversely affect normal operations, which is one more reason to keep it away from your peaks.

Eight weeks before: design

  • Write two or three objectives, each one specific enough to be judged met or not met. “Confirm the plan can be activated within 30 minutes of the first alert.” “Confirm the regulator notification is made in the right order with the right content.” “Find out whether the manual payroll workaround can run for two cycles.”
  • Agree the scenario family with the sponsor, not the detail. The detail stays with the designer and the facilitator; the participants must not see it.
  • Confirm the participants. The people who would really make the decisions — the ones who can stop a service, approve spending and speak to a regulator. If a deputy will attend, decide whether testing the deputy is an objective or a compromise.
  • Confirm the observer. Someone who is not responding and whose only job is to record what happened against the objectives.
  • Check the plan is current. If the contact list is out of date or the response team has changed, fix the plan first or accept that the exercise’s first finding will be the stale plan.
  • Decide who writes the report, who approves it, and by when. Set the date before the exercise. Three working days is realistic for a tabletop; a report three weeks later records impressions, not facts.

Four weeks before: prepare

  • Brief the participants once. Date, time, duration, and the one line that matters: the exercise tests the plan, not individuals. Nothing about the scenario.
  • Protect the time. The full exercise window, typically 60 to 120 minutes, with no competing meetings. Ask participants to hand their work to someone else for that window, as they would in a real incident.
  • Prepare the room. A space where the team can talk, see the plan, and not be overheard. The plan, the contact list and a notepad per person on the table. Nothing more elaborate is needed for a tabletop.
  • Tell the people who are not invited. Security, reception, the IT service desk and the communications team should know an exercise is happening, so a stray call or a test message does not start a real alert.
  • Confirm any external party. If a supplier or a landlord is to take part, or to be “played” by the facilitator, confirm it now and record it; NCEMA 7000:2021 (8.6.1 c) expects the design to cover the involvement needed from external providers.

The day

  • Start on time and state the ground rules: this is an exercise, the plan is being tested, decisions are to be made and said out loud, and the clock is real.
  • Let the facilitator run the clock. The team decides; the facilitator moves the scenario on. If the team wants more time, they ask for it and the request is recorded, because asking for more time is itself a finding.
  • Make the observer’s record the record. Decisions, times, who made the call, what the plan said at that moment, what was missing.
  • Finish with a short debrief, while everyone is in the room. Three questions: what went well, what did not, what would you change in the plan tomorrow. Write the answers down in front of the team.
  • Thank the team, and mean it. The ones who found the most gaps did the most useful work.

Three days after: report

  • Report within three working days, against the objectives set before the exercise. Each finding tied to the clause it bears on and to the inject that exposed it.
  • Score it, if you use a score, with the method written down and the untested areas excluded, so that next year’s score can be compared with this one.
  • Turn every finding into an action with one owner and one date. Three well-owned actions are worth more than fifteen without owners.
  • Get the sponsor’s approval in writing. NCEMA 7000:2021 tracks whether post-exercise reports are produced and approved (9.1.2), and a signature is the cheapest evidence there is.

The rest of the year: close the loop

  • Track the actions monthly. Not at the next exercise — monthly. A plan change takes an afternoon; a new supplier contract takes six months, and six months is how long you have.
  • Feed the findings into the management review. Both standards require a regular management review (NCEMA: at least annually) and timely corrective action on nonconformities. Take the findings there, and let the minutes show it.
  • Watch for significant change. A new site, a new core system, a restructure, a change of a critical supplier, or a real event that showed a gap. Any of those moves the next exercise forward, regardless of the calendar. Write down what counts as significant change and who decides, so the question is not argued in the moment.
  • Keep the evidence pack together. The exercise plan for the cycle, the objectives, the attendance list, the observer’s record, the report, the approval, the action log with closures, and the test records for each recovery promise. One folder. The auditor will ask for exactly this, and an afternoon spent assembling it from emails is an afternoon the auditor notices.

The one-line version

If the whole list is too much, keep this: close last year’s actions, pick one risk, set objectives you can measure, get the real decision-makers in a room for 90 minutes with an observer, report in three days, give every finding an owner, and put next year’s date in the calendar before you leave the room. Do that every year, on a different risk each time, and the evidence pack is ready before the auditor asks for it.

Sources