ISO 22301

What should an ISO 22301 exercise programme contain?

· 5 min read · PlanProof

Short answer

ISO 22301:2019 (clause 8.5) asks for a programme of exercises and tests that is consistent with your scope and objectives, uses well-planned scenarios with clear aims, builds the team’s competence, validates the whole of your business continuity arrangements over time, produces formal post-exercise reports with actions, feeds continual improvement, and runs at planned intervals and after significant change. The word that matters is programme: a planned series that, taken together, covers all of your arrangements over time, rather than a single event.

There is a small but important difference between what most organizations do and what ISO 22301 asks for. Most organizations run an exercise. The standard asks for an exercise programme. A certification auditor who has read clause 8.5 carefully will look for the programme first and the individual exercise second, and that is where otherwise well-prepared teams pick up a finding they did not expect.

Where exercising sits in the standard

ISO 22301:2019 is the international standard for business continuity management systems, published by ISO and used by many UAE organizations, often alongside NCEMA 7000:2021. Clause 8 is where the operational requirements sit: business impact analysis and risk assessment (8.2), strategies and solutions (8.3), plans and procedures (8.4), and then the exercise programme (8.5), followed by the evaluation of your documentation and capabilities (8.6).

The placing is deliberate. Exercising is how you find out whether 8.2 to 8.4 produced something that works. Everything after 8.5 — monitoring, internal audit, management review, corrective action — feeds on what the exercises reveal.

What clause 8.5 actually asks for

In our words rather than the standard’s, the exercise programme has to do seven things.

Fit your scope and objectives. If your BCMS scope covers three sites and a payments platform, the programme over time has to reach all of them. An exercise that only ever touches head office does not cover the scope.

Use appropriate scenarios that are well planned, with clearly defined aims and objectives. This is almost word for word what NCEMA 7000:2021 asks for too. A scenario is appropriate when it reflects a risk you have actually assessed, and the aims are defined when you can say, before the exercise starts, what you will be able to conclude afterwards.

Develop teamwork, competence, confidence and knowledge among the people who will have to respond. An exercise is partly a training event. A team that has never sat together under a clock will behave very differently from one that has done it twice.

Taken together, validate the whole of your business continuity arrangements over time. This is the programme requirement in one sentence. No single exercise can validate everything. A series of them, planned so that each covers something the last one did not, can.

Produce formalized post-exercise reports containing outcomes, recommendations and actions. Meeting notes or a “went well” email will not do. A report, with the gaps written down and the actions assigned.

Be reviewed in the context of promoting continual improvement. The findings have to go somewhere: into the management review, into the corrective-action log, and back into the plans.

Run at planned intervals and when there are significant changes. The same two triggers as the UAE standard, which adds that exercises must not adversely affect normal operations. You set the interval; a significant change resets the clock.

The standard does not say how long an exercise should be, how many people should attend, or which format to use. ISO publishes separate guidance on exercising, ISO 22398, for anyone who wants a method, but it is guidance, not a requirement.

How this differs from NCEMA 7000:2021

If you are certifying to ISO 22301 and also need to satisfy NCEMA 7000:2021, you will find the two are close. Both want realistic scenarios, defined objectives, a post-exercise report and exercises at planned intervals and after significant change. NCEMA adds an explicit point about the involvement of external providers, and it lists the exercise plan and post-exercise reports among the minimum documented information. ISO is more explicit that the exercises, taken together, must validate the whole arrangement over time, and it ties the programme to the BCMS scope.

In practice one programme satisfies both, provided the plan for it shows coverage across sites and risks over a two- or three-year cycle and each exercise ends with an approved report. The clause numbers differ (NCEMA’s exercising clause is 8.6; ISO’s is 8.5), so a report that cites both saves an argument later.

What a workable programme looks like

For a mid-sized UAE organization — a few hundred people, two or three sites, half a dozen critical activities — a programme we would be comfortable defending looks something like this.

A three-year plan on one page: which activities and sites are covered in which year, and which scenario family each exercise will use. Year one might take a cyber or IT outage, if that is where your risk assessment puts the highest rating. Year two takes a site-loss or severe-weather scenario. Year three takes a supplier or people-availability scenario. By the end of the cycle every critical activity has been exercised at least once, and the plan shows it.

Each year, one facilitated scenario exercise of 90 to 120 minutes with the people who would actually make the decisions, plus a technical test where a plan makes a recovery promise: restore the core system from backup, switch to the alternate site, run payroll manually. The exercise builds the team; the test shows the recovery actually works. Auditors want to see both.

A report within days, while memories are fresh, with every finding tied to the clause it bears on, and a short list of actions with named owners and dates. Then, and this is the part that separates a programme from a ritual, evidence at the next exercise that those actions were closed. A re-test of the same scenario a year on, scored against the first, is one of the most convincing documents you can put in front of an auditor or a board.

Finally, a line in the programme saying what counts as a significant change and who decides. A new building, a new core platform, a restructure of the response team, a change of a critical supplier, or a real disruption that showed a gap. When one of those happens, the next exercise moves forward, and the plan records why.

A common misreading

We sometimes hear “we have to do a full-scale exercise to be compliant.” The standard says nothing of the sort. A well-planned tabletop exercise with defined objectives and a formal report is a legitimate part of an 8.5 programme. What it cannot do on its own is prove that a system actually recovers in the promised time, which is why the programme pairs it with a test. The format is a choice; the programme, the objectives and the report are the requirements.

Sources