Additionally, testing and training help identify where there may be misalignment of objectives. For example, executives may have deprioritized the importance of restoring certain IT systems only to realize during a drill that those are essential for supporting critical processes.
Types and timing of tests
Many organizations test a business continuity plan two to four times a year. Experts say the frequency of tests, as well as reviews and updates, depends on the organization — its industry, its speed of innovation and transformation, the amount of turnover of key personnel, the number of business processes, and so on.
Common tests include tabletop exercises, structured walk-throughs, and simulations. Test teams are usually composed of the recovery coordinator and members from each functional unit.
A tabletop exercise usually occurs in a conference room with the team poring over the plan, looking for gaps and ensuring business units are represented.
In a structured walk-through, team members walk through their components of the plan in detail to identify weaknesses. Often, the team works through the test with a specific disaster in mind. Some organizations incorporate drills and disaster role-playing into the structured walk-through. Any weaknesses should be corrected and an updated plan distributed to all pertinent staff.
Some experts advise a full emergency evacuation drill at least once a year.
Disaster simulation testing — which can be quite involved — should also be performed annually. For this test, create an environment that simulates an actual disaster, with all the equipment, supplies, and personnel (including business partners and vendors) who would be needed. The simulation helps determine whether the organization can carry out critical business functions during an actual event.
During each phase of business continuity plan testing, include some new employees on the test team. A pair of fresh eyes might detect gaps or lapses of information that experienced team members could overlook.
Reviewing and updating the business continuity plan should be an ongoing process. Otherwise, plans go stale and are of no use when needed.
“How often it needs to be updated should be driven by the business,” Tisnovsky says.
Bring key personnel together at least annually to review the plan and discuss areas that require modification.
Prior to the review, solicit feedback from staff to incorporate into the plan. Ask all departments or business units to review the plan, including branch locations or other remote units.
Furthermore, a strong business continuity function calls for reviewing the organization’s response in the event of an actual event. This allows executives and their teams to identify what the organization did well and where it needs to improve.
Additional best practices
According to management advisers and experienced executives, the following best practices can help organizations with their business continuity planning:
Use AI to help build and maintain the plan: Zach Rossmiller, associate vice president and CIO of the University of Montana, uses a customized generative AI tool to analyze the organization’s processes, procedures, infrastructure, and architecture as well as its business continuity plan to identify potential gaps, such as the need to test generators for the university’s data center. Given the tool’s performance, Rossmiller advises others to use AI for business continuity planning and testing. Chevraux says AI can also be used for data discovery, mapping, and conducting business impact assessments.
Meanwhile, Bilker stresses the importance of including communications plans as part of the business continuity plan.
“It’s difficult during an incident to remember who gets what information when and who distributes information, so the business continuity plan should outline that information,” he says.
Similarly, the plan should identify who owns what roles and responsibilities during and after an incident to speed response and reduce confusion.
Bilker also advises organizations to revisit their continuity plans any time there is a major change to the business. Entering new markets or switching from a key cloud provider to another should trigger an update to business continuity plan.
How to ensure business continuity plan support and awareness
Every business continuity plan must be supported from the top down. That means senior management must be represented when creating and updating the plan; no one can delegate that responsibility to subordinates. In addition, the plan is likely to remain fresh and viable if senior management makes it a priority by dedicating time for adequate review and testing.
Management is also key to promoting user awareness. If employees don’t know about the plan, how will they be able to react appropriately when every minute counts?
Although plan distribution and training can be conducted by business unit managers or HR staff, have someone from the top kick off training and punctuate its significance. It’ll have a greater impact on all employees, giving the plan more credibility and urgency.