Validation
Assurance through exercising
Validation provides assurance that policy, analysis, design and implementation work in practice. Methods include review, audit, testing and exercising. Testing verifies a component or control; exercising develops and assesses capability, decision-making and coordination. Exercise types range from discussion-based seminars, tabletop exercises and walkthroughs to operations-based drills, simulations and full-scale exercises. Build an annual programme based on risk, criticality, maturity, regulatory obligations and previous findings.
Running an exercise
Each exercise needs objectives, scope, scenario, participants, safety arrangements, observers, evaluation criteria, a debrief, a report, corrective actions with owners and deadlines, and retesting. Validate plans, strategies, technology, people, suppliers and communications. Involve senior leaders and external partners where appropriate.
Traps
Questions often confuse testing with exercising, or assume a “pass” is the goal. A frequent weakness is running an exercise without objectives, so no learning can be assessed. Another is failing to follow up actions. Do not equate validation with an IT disaster recovery test only.
Worked example
A tabletop for loss of headquarters sets objectives for activation, decision-making and communications. Participants include executives, facilities, HR and IT. After two hours, a debrief produces owned actions and a retest date in six months.
Rule of thumb: every exercise must produce owned, dated actions and a retest.