Business Continuity Testing

Your BC plans are approved.
But have they been tested?

Boards increasingly want practical assurance, not further policy approval. Plans that have never been tested as a single coordinated response may contain gaps that only become visible under pressure. Our two-session model produces evidence of improvement, not just a list of recommendations.

The Problem With Untested Plans

Approved documentation is not the same as operational assurance.

Plans written for a centralised structure rarely translate to the operational reality of multi-site organisations. Escalation criteria that are clear on paper become ambiguous under pressure. Roles that are assigned in documentation may not be understood by the people holding them.

Escalation gaps

The most common finding in our exercises is unclear escalation criteria. Who decides to invoke the plan? At what threshold? Which approval is required before communications go external?

Coordination blind spots

In multi-directorate organisations, the gap between how individual teams respond and how a coordinated enterprise response works is almost never visible from documentation alone.

Role clarity under pressure

Staff who understand their role in normal operations may not know what they are expected to do when the plan is invoked. Exercises surface this before an actual incident does.

Our Approach

The two-session model.

A single exercise produces a list of findings. Our two-session model produces evidence that those findings have been acted on. That is the difference between a board that has seen a report and a board that has operational assurance.

Every exercise is built directly around your existing BC artefacts and Business Impact Analyses, not adapted from a generic template. The scenarios test your actual plans under realistic conditions.

How it works

Session 1

Surface the gaps

Facilitated integrated tabletop exercise designed to test your actual plans and surface specific gaps in governance clarity, cross-team coordination, and escalation decision-making.

Session 2

Validate the improvements

Re-test the same scenarios to validate that the improvements implemented between sessions have taken effect. Produces evidence of progress, not just observations.

Between sessions: targeted improvements to role definitions, decision flow, and communication pathways

What You Receive

Evidence your board can act on.

The output of our testing programme is not a document. It is a demonstrable shift in your organisation's ability to respond as a single coordinated entity under realistic conditions.

RAG-rated improvement plan

Prioritised, actionable findings with clear ownership and timelines. Not a generic observation list.

Validated improvement evidence

Session 2 demonstrates that identified gaps have been closed. Board-reportable evidence of operational assurance.

Clearer escalation and decision structures

Defined communication pathways and role clarity that staff can act on under pressure, not just on paper.

Client Evidence

From Approved Plans to Proven Assurance.

Acas is the UK's national workplace relations service, operating across multiple offices and directorates and supporting around 1,000 staff. They had 17 approved Business Continuity Plans covering both office and directorate-level operations. The documentation existed and had board approval. The question was whether those 17 plans would hold together as a single, integrated response when it mattered.

The Acas Board wanted practical assurance, not further policy approval. We designed a structured two-session exercise model built directly around their existing BC artefacts, ensuring the exercise tested their actual plans rather than a generic scenario.

17
BC Plans tested as a single integrated response
2
Sessions: surface gaps, then validate improvements
RAG
Rated improvement plan delivered to the Board

By Session 2, Acas had achieved measurably clearer enterprise-level escalation and decision structures, stronger coordination between offices and directorates, and defined communication pathways for critical decisions. The engagement moved Acas from holding approved documentation to being able to demonstrate operational assurance.

Read the full case study

Common Questions

Business continuity testing: what organisations ask us.

What is a business continuity tabletop exercise?

A tabletop exercise is a facilitated discussion-based session in which key staff walk through a realistic scenario to test how their BC plans would operate in practice. It surfaces gaps in decision-making, escalation pathways, and cross-team coordination that cannot be identified from reviewing documentation alone. A well-designed tabletop produces specific, actionable findings rather than a generic list of observations.

How is the two-session model different from a standard exercise?

A single exercise produces findings. Our two-session model produces evidence of improvement. Session 1 surfaces the specific gaps in your plans and governance. Between sessions, we work with you to implement targeted improvements. Session 2 re-tests the same scenarios to validate that the improvements have taken effect. The output demonstrates operational assurance to your board.

Our BC plans have board approval. Why do we still need to test them?

Approved documentation demonstrates that plans exist. Testing demonstrates that they work. Plans that have never been tested as a coordinated enterprise-level response may contain gaps in decision-making, escalation clarity, and cross-team coordination that only become visible under realistic conditions. The organisations that discover these gaps in an exercise are in a far better position than those that discover them during an actual incident.

Can you design exercises for multi-site or multi-directorate organisations?

Yes. We have designed and facilitated exercises for organisations operating across multiple campuses, directorates, and business divisions. Multi-site exercises require specific attention to escalation pathways between local and central teams. Our exercise design is always built around your actual BC artefacts rather than generic templates.

We have an IT disaster recovery exercise scheduled. Can you help us prepare?

Yes. IT DR exercises have specific requirements around decision-making authority, communication protocols, and the relationship between technical recovery and business continuity operations. We can design the exercise, facilitate it, and produce a validated improvement plan in advance of the exercise date.

Ready to test whether your plans would actually hold?

A 30-minute conversation will tell us both what you have and whether a structured testing programme makes sense for your organisation right now.

Book a Conversation Download our BC Testing approach

Free Download

The SSF Business Continuity Testing Approach

How we design and facilitate the two-session model that produces board-reportable evidence of improvement, not just a list of recommendations.

We will not share your details with third parties. See our privacy policy.