Most organisations with a business continuity plan can say they have tested it. Far fewer can say what the test proved. The difference is not effort or good intent. It is that having a test is easy, and running one that tells you something is not.
What a test is for
ISO 22301 puts it plainly: an organisation exercises and tests its plans to validate, over time, that its continuity strategies and solutions work. Not to tick a box, not to familiarise people with a document, but to find out whether the arrangements would hold. The standard adds that every exercise has clearly defined aims and objectives, is based on an appropriate scenario, develops the people who would have to act, produces a report with outcomes and actions, and feeds continual improvement. Every one of those words is doing work, and most tests that disappoint have skipped one of them.
The word that matters most is effective. The management system standards all ask, at clause 9.1, whether planned activities were carried out and planned results achieved. A test that ran as planned but proved nothing was carried out. It was not effective.
The test that proves nothing
It is easy to recognise. A date goes in the diary. The continuity lead presents a scenario, usually a fire or a flood, to the people who wrote the plan. The plan is walked through page by page. Everyone agrees it would work. A short note records that the exercise took place and that no issues were found. The certificate is safe for another year.
Nothing in that is dishonest, and nothing in it is useful. Nobody decided anything under pressure. Nobody discovered that the supplier's out-of-hours number is a voicemail. Nobody found out that the manual workaround for invoicing depends on a spreadsheet only one person can open. The plan's own numbers, the recovery time objectives and the minimum resources, were never put against the clock.
Six marks of an effective test
- It sets out to prove something specific. Not that the plan works, but that one activity can run without its systems for the period the business impact analysis says it must, or that the incident team can be stood up and making decisions inside the first hour. Write the aim down before the scenario is chosen, because the scenario serves the aim and not the other way round.
- The scenario tests the assumption that matters. If the plan assumes staff can work from home, take the office away and see what else was in the office. If it assumes a supplier will respond in four hours, make the supplier unavailable. Generic scenarios produce generic reassurance. A good scenario is built from your own business impact analysis and risk assessment, and it is usually uncomfortable.
- The people who would actually decide are the people in the room. The exercise is for the incident team, the activity owners and the deputies who would step in, not for the person who wrote the plan. If the managing director would chair the real incident, the managing director chairs the exercise. Their absence is a finding in itself.
- It is measured against the plan's own numbers. The plan says payroll must be running again within two days with three people and a laptop. The test records whether that happened, how long it took, and what was missing. Met, not met, or not tested are the only honest results. A test with no measurable outcome cannot validate anything.
- It includes the awkward moments. The key person is on leave. The supplier does not answer. The backup restores but two days old. The communications template is found to name a director who left last year. These injects are where plans actually fail, and an exercise without them tests the plan as its author imagined it rather than as a disruption would find it.
- It ends in a report that changes something. Outcomes, recommendations, actions, owners and dates, as the standard requires. The actions go into the improvement log, the plan is updated, the next exercise in the programme is chosen because of what this one found, and anything serious is re-run once fixed. A report that records only that the exercise took place is the clearest sign of a test that proved nothing.
What the record should show afterwards
An auditor, a board member or a client's due-diligence team looking at the exercise record a year later should be able to see a programme, not a series of events: aims set and met or missed, scenarios that moved from simple to demanding as the plans matured, actions closed, plans changed as a result, and the exercise results feeding the management review. That trail is what validates the strategies over time, and it is what ISO 22301 means by an exercise programme rather than an annual test.
A first effective test in an afternoon
None of this needs a day-long simulation. A ninety-minute desktop exercise can be effective if it is built properly.
Ninety minutes, one activity, one aim
- Pick one critical activity and take its continuity plan, business impact analysis entry and recovery objectives into the room.
- Write the aim in one sentence: what this exercise must prove.
- Build a scenario from your own risk assessment that removes the thing the activity most depends on, and prepare three injects that make it worse at intervals.
- Invite the people who would act, including the deputy, and chair it as the incident would be chaired.
- Record decisions, times, what was missing and what was assumed, against the plan's numbers.
- Produce a one-page report within the week with findings, actions, owners and dates, and book the next exercise before the room empties.
What good looks like
The exercise programme is in the management system with a schedule that reflects risk and change, not just the calendar. Each exercise has an aim, a scenario chosen for a reason and a result that can be stated in one line. The people who would decide in a real disruption have decided in a rehearsed one. The plans read differently from a year ago because the exercises changed them. At the next surveillance visit the auditor reads the reports and sees a capability being validated, which is the clearest evidence a continuity system can offer that it is working.
Frequently asked questions
How often should business continuity plans be tested?
ISO 22301 requires exercises at planned intervals and whenever there is significant change in the organisation or its context. In practice most certified organisations run at least one exercise a year per critical area, with the programme as a whole validating every strategy and solution over a cycle, and an additional exercise after any major change such as a new system, supplier or site.
What is the difference between an exercise and a test?
A test checks that something works, such as a backup restore or a failover, and has a pass or fail result. An exercise rehearses people, decisions and procedures against a scenario and produces findings rather than a single result. An effective programme uses both: tests for the technical components, exercises for the response.
Does a desktop exercise count for ISO 22301?
Yes, provided it has defined aims and objectives, an appropriate scenario, the right participants, a post-exercise report with actions, and sits within a programme that validates the strategies over time. A desktop exercise with no measurable outcome and no report does not.
Not sure what your last test proved?
If the honest answer is not much, that is worth knowing before a disruption answers it for you. Thirty minutes with a practitioner will usually tell you what the next exercise should set out to prove, with no proposal at the end of the call. If you would rather start on your own, the free Readiness Check gives an indicative SSF Effectiveness Score in minutes, with no documents required.
Not sure what your last test proved?
Talk to a practitioner, thirty minutes with no proposal at the end, or start with the free Readiness Check.