Test, test, test says ContinuitySA during Business Continuity Awareness Week 2015

We've all done it: we realise we need to get fit and rush out and buy the best trainers we can afford. That's when we come face-to-face with the obvious: we have to use those trainers to actually do the work that's required.

The same point is true when it comes to business continuity management (BCM). It's simply not enough to complete the business impact analysis and then define the BCM strategy and then the plans to implement it. Whether those plans were created by the in-house business continuity management team or a consulting house like ContinuitySA, all too often they just sit gathering dust. In fact, all plans are just theory - or wishful thinking, if you're feeling very cynical - until they have been tested and thus validated, says Tracey Linnell, General Manager: Consulting at ContinuitySA.

All of this means the greatest care needs to be taken to putting the right testing programme in place. It's also vital that the gaps that were identified in the BCM plans have been bridged. For example, if a single person is the only one who can implement a particular business process, has an alternative been trained? Or have alternative premises been identified in the event of the primary premises being inaccessible?

The organisation also has to assess how much risk it is prepared to incur in the testing process, and how mature its testing capability actually is. Based on that, it will then decide what outcomes it is looking for from the testing process.

Testing scenarios run from discussion-based exercises right through to live testing. The suitability of each one of these has to be weighed up against the costs the organisation is willing to incur and its maturity. Care should be taken to create scenarios that are realistic. ContinuitySA has found that involving the emergency services in the testing programme can also not only make it more realistic, but can help identify additional issues.

Once the test is complete, it is very important to ensure that post-test action plans are put in place. If this is not done, the same problems will surface when the tests are undertaken again.

One final point: circumstances change and people move jobs. It's thus essential that the organisation recognises that testing has to occur frequently, and that all the role-players commit to investing the necessary time for this to occur. By committing to frequent, scheduled testing, the organisation will in fact be improving its testing capability continuously - and thus improving its ability to survive business disruption.