The Exercise That Passed on Paper
A financial services firm has implemented its BCMS and is six months from its certification audit. It has run one tabletop exercise for its priority service (online account access) and recorded it as successful. On reading the exercise report, the BCMS manager notices: the scenario was a building evacuation; the participants were all from facilities and HR; no one from IT or the payments team attended; the recovery time objective for online account access is four hours but the exercise never tested recovery of the platform; and the report concludes 'arrangements confirmed effective' with no observations or actions. Separately, the firm's alternate processing site contract was signed eighteen months ago and has never been invoked or verified. The Head of Operations says: 'We've done our exercise, it's documented, let's not over-engineer this before the audit.'
1. Evaluate whether the exercise programme provides valid evidence that the continuity arrangements will work.
Read the worked answer
It does not. The exercise is documented, but documentation of an exercise is not the same as evidence of capability.
Problems, in order of severity:
- The exercise did not test the thing that matters. The priority service is online account access with a four-hour RTO. The scenario (building evacuation) and participants (facilities, HR) do not touch platform recovery. An exercise that cannot fail the arrangement tells you nothing about it.
- Wrong participants. Testing recovery of online account access requires IT and the payments team. Their absence means the people who would actually execute recovery have never rehearsed it.
- No observations, no actions. A genuinely useful exercise almost always surfaces gaps. A report with zero findings is more likely a sign of a poorly designed exercise than of flawless arrangements.
- The alternate site is unverified. A contract signed eighteen months ago is an assumption, not a control. It has never been invoked, so its actual capability, capacity, and activation time are unknown - and the four-hour RTO depends on it.
Conclusion: the firm has evidence that it can run a tabletop about evacuation. It has no evidence that it can recover its priority service within its RTO. The Head of Operations' 'don't over-engineer' position confuses effort with rigour - a well-designed exercise is not more bureaucratic, it is more targeted.
2. What should the BCMS manager recommend, and how should the results feed the rest of the system?
Read the worked answer
Recommendations:
- Redesign the exercise around the RTO. Build a scenario that forces recovery of online account access within four hours, with IT and payments in the room, and ideally a technical component (failover test or walkthrough against the alternate site) rather than discussion alone.
- Verify the alternate site. Invoke or partially invoke it, or at minimum conduct a verification visit and a documented activation walkthrough with measured timings against the four-hour RTO.
- Set an exercise programme, not an event. A cycle covering different scenarios and different priority services over the year, with increasing realism.
- Capture observations and actions as a matter of course, even in a 'successful' exercise.
Feeding the system:
- Exercise results are an input to performance evaluation and management review.
- Gaps become corrective actions with owners and dates, tracked to closure.
- If the alternate site cannot meet the RTO, the continuity strategy for that service must be reconsidered - a strategy decision, not just a plan fix.
- Updated risk assessment where new vulnerabilities surface.
The exam point: exercises are a control whose value lies in their design and their follow-through. A weak exercise, recorded as effective, actively misleads management and will not withstand scrutiny at audit.