Validation that proves nothing
Bracken Foods employs 700 people at one production site and supplies three national supermarket chains. Continuity is validated by an annual desk-based tabletop with the same six managers. When the boiler failed last winter and stopped production for three days, the plan was not used; the call tree contained wrong numbers for 40% of the list; and the reciprocal production agreement with a neighbouring plant had lapsed in March and no one had noticed. The last exercise report raised 14 actions; 11 remain open after nine months and six have no named owner. Internal audit has asked for evidence that exercising is effective, and the operations director has described the tabletop as 'a good use of an afternoon'.
1. Critically assess the current validation approach. What does it fail to prove?
Read the worked answer
It proves that six managers can hold a conversation. That is not nothing - it validates team familiarity and surfaces some issues - but as the sole validation method it leaves almost everything untested.
What it fails to prove, evidenced by the boiler failure:
- That the plan is usable. The plan was not opened during a real three-day stoppage. A plan that is not consulted under pressure is either unknown, unusable or both, and the tabletop never asked anyone to actually use it.
- That contact routes work. 40% of the call tree was wrong and nobody knew, because calling people is not part of a desk exercise. This is the single most common failure and the cheapest to test.
- That external arrangements are current. The reciprocal agreement had lapsed five months earlier. Nothing in the annual cycle reviewed contract or agreement validity.
- That the wider organisation can respond. Six managers in a room is 0.9% of the workforce. The people who would actually stop production, isolate the boiler and reroute supply were never involved.
- That the corrective action loop works. 11 of 14 actions open after nine months, six unowned, is a governance failure that the exercise should have detected in itself. Exercising that generates actions nobody closes is worse than not exercising, because it manufactures false assurance.
- That objectives were met. There is no record of what the exercise was meant to achieve, so 'a good use of an afternoon' is the only available verdict.
2. Design a validation programme for the next 12 months. Justify the mix and the frequency.
Read the worked answer
Principle: match the method to what you need to learn, and escalate realism as confidence grows. A single annual tabletop cannot test communications, external dependencies and physical response at once.
Proposed cycle:
- Q1 - Communications and call-tree test (2 hours, no notice). Call every contact in the tree, out of hours, and record response rates and time to reach. Cheap, fast, and it addresses the confirmed failure. Success measure: 95% contacted within 60 minutes, with alternates reached.
- Q1 - Walkthrough of the boiler-failure scenario with the actual production team. Not the managers - the shift supervisors, engineers and maintenance lead. Objective: does the plan tell them what to do in the first hour?
- Q2 - Tabletop with the executive and commercial leads. Scenario: production down for five days in a peak supply week. Objective: test the customer-communication and allocation decisions, which are commercial judgements rather than operational ones. Retain the existing tabletop but give it a stated objective and a written outcome.
- Q3 - Simulation with the reciprocal partner. A joint session to confirm the agreement is live, test the trigger conditions and clarify who authorises transfer. Objective: evidence that the arrangement works, not that it exists.
- Q4 - Live partial exercise. Shut down one line or one system for four hours and invoke the plan for real. This is the only method that tests the plan under genuine operational pressure.
Cross-cutting: every exercise has written objectives and success criteria agreed in advance, an independent observer, a debrief within ten working days, and a report to management review. Include the 3PL/supplier and at least one supermarket customer in at least one activity per year.
Frequency rationale: communication testing quarterly (it degrades fastest), plan walkthroughs annually, full live exercise annually once the basics hold. If the first live exercise fails badly, repeat it before expanding scope.
3. How do you deal with the 11 open actions, and what does their existence tell you?
Read the worked answer
Their existence tells you the problem is not exercising - it is the corrective action process. Actions with no owner and no date do not get done, and no amount of additional exercising will fix that. Adding exercises to a broken closure loop simply generates more unowned actions and more false assurance.
Disposition of the 11, triaged by risk rather than by age:
- Close immediately (probably 3–4). Some will be trivial or already resolved by events. Clear them so the list reflects reality.
- Assign and date (the material ones). Every remaining action gets a named owner - a person, not a function - a due date and a stated acceptance criterion. Actions that protect the boiler-failure scenario go first, given it has already happened once.
- Escalate the ones nobody will fund. If an action needs capital, it becomes a risk-register entry with a stated consequence and an executive acceptance decision. That is not failure; it is correct routing.
- Retire the ones that no longer apply, with a recorded reason.
Then fix the loop: actions enter the corporate action tracker, not a separate continuity spreadsheet; monthly review by the programme owner; closure verified by evidence, not assertion; a standing corrective-action item in management review. Internal audit should be pointed at the closure rate, not the exercise count.
What to say to the operations director: the tabletop was a reasonable afternoon. The reason it produced nothing is that the organisation had no mechanism to absorb what it found. Fix the mechanism before buying more afternoons.