How Business Continuity Testing Creates Organizational Resilience

Business continuity testing is critical to your organization's resilience. However, many organizations are still wondering why to test their business continuity plans. With the increasing number of natural disasters, the likelihood of your organization being affected is becoming higher every day.  So it isn't a matter of if a disruption does occur; it's about when it happens. That's why your organization needs to be fully prepared to withstand any potential disruption, and the best way to find any gaps is through business continuity testing. 

Hurricane Isaias made landfall in the Carolinas, with its 75 mph winds causing a storm surge as great as five feet. The storm spawned damaging winds and tornadoes, leaving more than 1.2 million people without power. The estimated damage from Isaias climbs up to $4.5 billion in the U.S., making Isaias the costliest tropical cyclone to affect the Northeastern United States since Hurricane Sandy in 2012. NOAA had predicted 2020 to bring an active hurricane season, and 2020 is on track to be one of the busiest ever. It adds to the three years of devastating hurricanes, beginning with Hurricane Harvey, Irma, and Maria in 2017, then Florence and Michael in 2018, and Dorian in 2019.

However, if you've never tested your plan, it's hard to be confident that it will meet your expectations. Regularly testing your business continuity plan (BCP) helps to continually improve your company's ability to withstand and recover from various disruption scenarios successfully. Let's look into some other arguments of why testing is integral to your organization's success.

The ROI of Business Continuity Testing

A well-orchestrated test strategy helps protect the brand, its promise, and its value proposition. Suppose your competitors had a poor test performance or made a critical mistake in a real-life situation with a client. In that case, your company can shine by demonstrating its reliability and advance its business forward.   

So, why test your BCP? 

• Identify interdependencies, gaps, and areas for improvement.  
• Demonstrate to your clients a higher degree of commitment.  
• If you are the supplier to a firm, you rise among competitors, taking on more projects, and winning new business.  
• Continually validate and improve plans.  
• Satisfy compliance requirements and regulators.  
• Reduce recovery time and cost.  

Reasons to Test Your BCP During COVID-19​

1. Test the “New Normal”​​

• Regional risk to work from anywhere​

• Isolated issues to staff​

• Solving for 1 building vs. many​ locations

2. Validate Recovery Plan / Gap Analysis​

• Confirm RTOs​

• Train your staff – instill confidence of employees + stakeholders​

• Update procedures ​

3. Compliance / Regulatory / Legal​

• Plan review​

• Tabletop exercises​

• Drills​

Ways Our Customers are Testing

• Verify the connection and performance of hosted data/backups from a different location​

• Rebuild critical applications on Preparis parent company Agility equipment​

• Establish a working partnership with Agility​

• Evaluate disaster readiness of lines of business​

Types of Business Continuity Tests

Every business continuity test in a company has very targeted and specific ways and types of tests used to ascertain information in different areas within the company. The list below gives you some but not all the information about BCP test types and reasons. 

1. Plan Review: Includes a BCP team with c-level management or department heads to see if their current BCP plan needs revisions. The plan review goes over recovery contract validity, business continuity management, and any disaster recovery scenarios that can be shared with other company teams.
2. Tabletop Test: Includes role-playing discussion exercises that are scenario-based. You usually have employees participate so they can practice their roles and responsibilities in case of any disruptive emergency from an active shooter to a hurricane tornado.

There’s also the BCP walk-through, which mimics the tabletop test discussions with planned details but takes those details and turns it into a simulation test that combines real recovery actions. The real scenario ranges from data loss backups and restoring to emergency notifications and physical recoveries.

However, consider deviating from the test script to interject unplanned events, such as the absence of key individuals or services. ​

Plan Review​

• It’s best practice to walk through your plans quarterly – does not have to be elaborate (an hour or less in a group session)​.

• Helps to identify gaps and areas for improvement​.

• Ensures everything is up-to-date with the latest information (employee contact info, regulations, etc.)​.

Tabletop Exercise​

• Facilitated discussion – 1½ - 2 hours​.

• Participants are seated around a table – all activity is “virtual”​.

• An incident “scenario” is presented to the team along with a series of “How Would You Respond” questions as the scenario unfolds​.

• Use the time to identify gaps and develop confidence​.

Drill / Simulation​

• Test individual components (wire transfers, notification system, etc.)​.

Full Test​

• Moving people and technology to an alternate location​.

• Partner with a company like Agility to go through a full-scale test​.

After a Business Continuity Test  ​

• Ensure you have actionable deliverables and commitments for those responsible for executing.

• Clearly define timetables and who is responsible for ensuring findings are resolved​.

• Regulators will want to review written documentation and will be checking to make sure issues were addressed​.

• Consider planning and testing as a continuous improvement process​.

Protecting Your Organization

Organizations face continuous threats that can put lives in danger and disrupt operations. However, implementing an incident management program that fits your organization is challenging. To help mitigate these threats, Preparis offers an integrated business continuity solution that helps businesses plan, test, train, alert, and recover—all in one. It enables organizations to eliminate business impacts and make sure their workforce is safe and informed. 

​