Exercising is perhaps the most important part of a Business Continuity Program. Once all of the plans have been developed, exercising helps validate that they are actionable and helps identify gaps in recovery and/or sustainment of critical services. Traditional tabletop exercises have a script that the facilitator follows and the Business Continuity Team determines that best course of action.
But not all tabletop exercises have to be created equal. The tabletop exercise can be used as much as an information gathering tool as a scenario-based test.
Here are 4 additional uses to conduct Tabletop Exercises often for reasons other than testing and drilling.
At some point you are going to have to develop a recovery and sustainment strategy. Tabletop exercises are the best place to get this conversation started with each division and department. Now that Critical Services, Critical Staff and Critical Support Requirements have been defined, it’s time to figure out the best way to reach the final goal of sustainability. In this tabletop you would meet with the Department Recovery Coordinators (DRC) individually to discuss how they go about sustaining or recovering the services in their division or department, alternate relocation site activation, vital records management and staff notification. Once the strategy is defined, another tabletop exercise is scheduled with the DRC and Emergency Relocation Group to validate the procedure through a scenario-based exercise.
The only way for a Business Continuity Program to work is if all the moving part work together to achieve the same objectives. Using the first tabletop exercise to build consensus across the teams is a very useful way to get them to agree on what needs to happen and when. Instead of trying to figure it out all on your own, let the organization determine what is best for them and then get the teams to agree on what needs to happen
Review and Audit
Using selected Business Continuity Team members (Program Lead, DRCs, Recovery Teams, etc.) as the Program Review and Audit Team not only meets the requirements of BS IOS 22301, it places accountability on the teams that will be responsible for executing the plans in the event of a disaster or crisis and requires that they update them accordingly. Furthermore, you also need someone outside of the continuity teams to be on the review and audit team who can be an objective voice.
Despite what we think of ourselves, we don’t know it all. Business Continuity is a group effort and good discussions bring to light things that were no considered. This doesn’t need to be a fluff exercise, but it should be a way for everyone to express their ideas. There are never any bad ideas. Only better ones. It’s the better ones you want to use in your planning development process.
The other way to achieve this result is to form a working group for Business Continuity and charter it. Having a forum to share ideas is really the only way to make Business Continuity actionable.
What other uses for tabletop exercises other than traditional scenario-based testing do you see or use?
Mike Minzes is the Founder and CEO of INEVOLVE SB, a Business Continuity and Disaster Recovery Planning and Implementation company located in Kennesaw, Georgia. Mike has over 20 year of experience on the Business Continuity and Disaster Recovery Industry. For more information on INEVOLVE SB, please visit them at GOBCP.NET . ______________________________________________________