Business Continuity Management

8. Business Continuity Management: Testing

The purpose of testing (stage 3 of the business continuity management process) is to:

• Raise the level of confidence in the ability to recover from a systems failure
• Raise awareness and implement training processes within the organisation as early as possible

An initial technical test can usually be completed without the need to involve the business.

However, for subsequent tests it is prudent to involve the business as a whole. This will help to improve capability, and aid mutual understanding of the activities and resources needed to achieve the common goal of business recovery.

A full technical test will replicate as far as possible the stand-by arrangements, including the recovery of business processes and the involvement of external parties. This should test completeness of the plans and confirm:

• Time objectives. For example, time taken to recover key server applications
• Staff preparation and awareness
• Staff duplication and potential over-commitment of key resources. For example, a systems administrator being required to support a number of modular plans (help desk, operations, networks and communications)
• Responsiveness, effectiveness and awareness of third parties and service providers

It is also necessary to ensure that the business recovery teams are tested. This can include familiarisation with the recovery site, and the provision of examples that will test the team response to a relevant scenario.

All tests, whether technical or non-technical, must have clearly defined objectives and critical success factors which will be used to determine the success or otherwise of each exercise.