It’s a fact; business continuity management programs (BCM) that consistently perform well-planned exercises get better results when dealing with real crisis situations.
Practice Makes Perfect
Running BCM exercises is a key role for any business continuity program leader. Drafting BCM plans and making sure they work effectively in a crisis are two wildly different things. Plan testing is critical from a number of standpoints:
- Team Building: Unlike many teams, business continuity teams frequently consist of cross-functional representation including a variety of individuals who do not typically collaborate outside their BCM roles. Most of these team members do not have formal training in business continuity, and they are not accustomed to working with each other. Exercises help team members get to know each other better to build relationships and trust. The more you know and work with colleagues, the more likely you are to take your role on the team seriously.
- Team Training: As stated above, most BCM functional team members have little or no formal training. They are communications specialists, customer service managers, operations directors, IT program managers and more. These team members are selected for their functional expertise and need to be trained on the requirements of the business continuity role. Team training should cover the end-to-end incident management process, including; risk assessment, impact assessment, response planning, recovery and post event evaluation.
- Plan Validation: Exercises fulfill an important role in validating the effectiveness of the plan. Are the templates and task lists clear? Have all the critical steps been identified? Are the pre-populated messages valid? Have all the right team members been identified? What about their alternates, have they been identified and trained? BCM exercises frequently identify gaps that, once filled, make event resolution run more smoothly.
- Support Tool Configuration: Every BCM program uses some form of support tools. Whether these include fully integrated emergency notification and incident management systems or simply shared drives and conference bridges, the tools need to be trained and exercised so that when a real crisis occurs, technology will help speed resolution vs. hinder team effectiveness.
How to Run Successful BCM Exercises
Successful BCM programs have an ongoing exercise calendar. Each risk or threat that an organization prepares for is likely to have different team members, task lists and objectives. Every crisis team should do a minimum of one exercise per year and potentially more based on the complexity of the issue and outcome.
BCM team leadership typically orchestrates the overall exercise calendar and creates the objectives for each individual exercise based on approved planning documents. The simplified diagram below outlines the process for executing a successful exercise:
Creating a Plan: Once a risk assessment has been completed, and existing capabilities have been identified and remaining gaps filled, a plan to deliver those capabilities can be drafted, approved and trained. Over simplified, but we are here for exercises.
Design and Development: The BCM team needs to take exercises seriously – an exercise planning team will ensure exercises occur and the results are documented. When designing an exercise, they should be realistic and detailed as possible to best simulate an actual crisis situation. Identified objectives and a clear understanding of the expected responses that are based on the plan will guide the design and development.
Exercise Conduct: The Exercise Director will begin disclosing scenario facts so that the team can begin to execute the appropriate response plan. The exercise planning team can help with evaluation of the exercise and monitor for the expected response actions to take place.
Post Action Report: A critical part of each exercise is the post evaluation where team members review each step of the exercise to determine:
- How effective were you at executing the plan?
- Did the team get to an impact assessment – go/no go decision in an appropriate timeframe?
- Did each team member provide clear and appropriate response plans with identified task lists?
- Were the pre-populated templates and plans well aligned for the required response?
- Did we deliver the right communications to the right audiences at the right times?
- Were our recovery steps implemented quickly?
- Overall, what could we have done differently to address this incident more effectively?
Plan Updating: Based on the answers to the questions above, plan documents need to be updated to address the corrective actions highlighted in the after action report.
How to Use This Information
BCM Exercises are one of the largest drivers of business continuity management program success. Companies that do them on a consistent basis have stronger teams and better program results. If you are looking for ways to improve your business continuity program effectiveness, MissionMode can help with best practices tips and collaboration tools that speed communications and simplify incident management. Contact us today at 877-833-7763 to schedule a demonstration and learn more about our Situation Center™ Suite.