What are the keys to a successful business continuity exercise? Jim Burtles explains.
The delivery of, and the feedback from, any test, exercise or rehearsal is, perhaps, the most interesting and fruitful part of any business continuity programme. However, its success depends almost entirely on the way in which it is approached and developed. Good solid preparation ensures a sound delivery and so everybody benefits from the exercise. Poor preparation leads to a poor exercise and the whole programme suffers. One unsatisfactory experience in an ill conceived exercise will cause most participants to want to distance themselves from the whole concept of business continuity.
On the other hand, a well prepared exercise will provide all of the participants with a profitable experience. They will be fully engaged in the opportunity to learn from practical experiences. Thus they will become more competent whilst gaining confidence in themselves as well as the plans and procedures.
There are three key elements or areas of concern when preparing for a test or developing a business continuity exercise or rehearsal. They are:
* Getting the background or context right which is mainly about setting the appropriate objectives and agreeing the purpose behind the event
* The build up which is mostly about scripts and scenarios for an exercise or a rehearsal, whereas with a test the focus is more on thorough preparation.
* Making sure of the quality of the learning experience which means setting the scope correctly and retaining the right degree of realism throughout the development and delivery process.
Right from the start we need to bear in mind why we are being asked, or allowed, to run this type of event. The purpose behind such practical sessions is normally threefold. The required outcomes are:
- that the plans and practices are sound
- of the value of business continuity plans
- of the capability for business continuity
- of compliance with regulations and recommendations
- certainty that the business can always continue
Whilst these outcomes are fairly obvious and are common to all types of business continuity test or exercise, they should nevertheless be explored and agreed with the senior executive and modified or amended as required. After all we do need them to be fully involved with the BCM programme, especially at this crucial stage where their active participation is an essential element of any successful emergency response or crisis management strategy. If they are consulted at this early stage they will feel that their needs are likely to be met. They will also regard their input as a contributory factor to the eventual success of the enterprise. It is also a subtle means of mentally preparing them for the performance to come.
A typical set of objectives might comprise:
1. To develop business continuity or emergency response skills
2. To evaluate business continuity plans
3. To instil confidence in the business continuity team or teams
4. To identify areas for improvement in the plan, strategy, procedures and resources
5. To establish accurate timings for activities outlined in the business continuity plans
Again, we do need to discuss and debate these objectives with those managers who have responsibility for business continuity activities and modify or extend them accordingly. We should try to engage as wide an audience as possible in this debate as it will help to raise the level of awareness and support for the whole BCM programme.
The build up stage is largely about defining what will be required and then getting the tools and resources ready for the event itself. There are two principal aspects to this stage of the work; creating the script as well as organising the venue and facilities.
Scripting is all about developing the exercise scenario, generating the story or plot and creating the texts. It turns the objectives and purpose into a set of deliverables for use in the event. The scripting process involves getting ready in the technical sense; gathering and working with information, ideas, concepts, language and expertise.
The first step is to choose a basic plot. In other words you need to think of a credible incident that will explore the objectives. Typical trigger events are such common hazards as fires, floods, power failures or equipment failure. They don’t need to be particularly imaginative but they do need to be credible.
Once you have an outline plot you can start to build an outline script and a timetable showing how and when the plot unfolds. Obviously the duration of the test or exercise will depend on a number of factors such as the scale of the event, what you are trying to achieve and the capabilities of the participants.
However in my experience a half day exercise is generally sufficient to meet the needs without straining the budget or the normal business operation.
The next stage is to add more detail, such as messages or instructions from various internal or external sources. These could be from the media, the emergency services, suppliers, customers or other interested parties. If the participants are fairly experienced in this type of thing then a few spurious messages will force them to think more clearly about how they deal with the information that is available to them and how they select or process it.
You may also need to develop checklists and reference material to support the script. Checklists come in all forms and shapes but they are a convenient way of collecting data without relying too much on memory to cover the full span of the subject.
Reference material may be required wherever you introduce any aspect of a scenario that may be challenged. For example, if you say that damage has been caused by a letter bomb then you had better know how the bomb would have been prepared and delivered and the extent of the damage it would have caused.
If anyone should challenge what you say, you must be ready with an authoritative response; otherwise you will lose the attention and support of everyone. There is no substitute for thorough research prior to the event. Another reason for thorough research is the need to use the appropriate language and terminology for the various messages, new items and instructions you might wish to insert into the script.
There are two categories of plot which can be used as the starting point for an exercise. The ‘case study’ approach is based on a situation outside of their normal experience or expectations. This is a form of indirect learning through a parallel example and has the advantage of being easier to research and develop because you can base your work on real life examples and the same case study can be used more than once.
The alternative is the ‘line of business’ approach, based on a situation they might encounter during normal business related activities. This is a form of direct learning from a relevant experience and has the advantage of being directly related to realistic expectations. On the other hand you do need to be rather more pragmatic in the way in which the events unfold because they will be on familiar territory with an eye for detail.
Preparation for the event is all about the process of managing the logistics, organising the facilities and setting up the equipment. You need to ensure the exercise can be run at the right time and place with the right people. It means getting ready in the practical sense by arranging and managing the location, people, transport, equipment and timings. One key element of preparation is access control. You need to ensure everyone has access to the right things at the right time on the day. At the same time you must make sure they are denied access in accordance with the plot and other factors such as isolation and security from normal business routines.
The final consideration is to maintain consistency and quality throughout the process of developing your test, exercise or rehearsal. By sticking to a thorough approach and working at suitable gradient you should be able to deliver high quality exercises. It is very important to work at the right gradient both for yourself and the participants. Start with something short and sweet that everybody can handle and gradually increase the complexity and pressure.
Jim Burtles is head of training Automata Ltd
Automata offers a detailed two day training course covering all aspects of business continuity exercising. More details of ‘Mastering Exercise Delivery and Development’ can be found at www.automataservices.com
•Date: 22nd March 2005 •Region: UK/World •Type:
Article •Topic: BC exercising
this article or make a comment - click