The exercise that proves nothing
Cloverfield Foods produces chilled ready meals at one plant; 70% of output goes to three supermarket chains under contracts requiring 98% on-time delivery. The BCMS has one exercise per year: a two-hour desktop walkthrough of a power outage scenario, attended by the same eight managers. The exercise record is a sign-in sheet. The 2022 and 2023 exercises used identical slides. Two corrective actions from 2022, a missing alternate cold-storage agreement and an out-of-date supplier contact list, are still open. No exercise has covered loss of the plant, a cyber incident or a key supplier failure. The BC manager says the programme is adequate because 'we exercise every year and nothing has gone wrong'. An internal audit is due.
1. Evaluate the exercise programme against ISO 22301 clause 8.5. What is missing, and why does each gap matter?
Read the worked answer
Clause 8.5 requires an exercise programme with objectives, scope, type, scenario, schedule and criteria for success, exercises at planned intervals, review and evaluation, and documented information. Cloverfield has a date and a scenario but no stated objective and no criteria for success, so the exercise cannot produce a judgement about capability; a sign-in sheet proves attendance, not performance.
Repeating identical slides tests the same assumptions and the same people, and it does not cover the risks the risk assessment should have identified: loss of the single plant, cyber compromise, and supplier failure. The 98% on-time delivery obligation makes the absence of a loss-of-plant exercise particularly significant. The programme also lacks a feedback loop: without evaluation and tracked corrective actions, lessons cannot change plans, training or resources. The manager's claim that 'nothing has gone wrong' is not evidence of effectiveness; it is an untested assertion. A conforming programme rotates scenarios against prioritized risks, defines success in terms of MTPD and RTO, involves the people who would actually respond, and feeds results into 8.6 and clause 10.
2. How should the two open corrective actions be handled, and what does their status indicate about the BCMS?
Read the worked answer
They should be processed under clause 10.2: react to the nonconformity, evaluate the need for action to eliminate the cause, implement the action, review its effectiveness, and update the risk assessment if needed. The alternate cold-storage agreement is a strategy gap with direct product-safety and contractual consequences, so interim risk treatment and a named owner with a due date are needed now, not after the audit. The contact list should be corrected and a maintenance mechanism assigned.
The fact that both have been open for two years indicates a deeper problem: corrective actions are being recorded without ownership, escalation or verification, and management review is not tracking the status of previous actions as 9.3.2 requires. The audit should test the corrective-action process itself, not just the two items. Root cause is likely to include unclear accountability and no resource commitment, which are leadership and resource issues rather than clerical ones.
3. Design the next 12-month exercise cycle and explain how success would be judged.
Read the worked answer
The cycle should start from the BIA and risk assessment, not from last year's slides. Set two or three objectives, for example: validate activation of the incident team within 30 minutes; confirm that 70% of chilled output can be maintained for five days without the plant; and verify supplier contact data and escalation. Rotate scenarios across the year: loss of the plant, a ransomware incident affecting order processing, and failure of a key ingredient supplier. Mix exercise types so that decision-making and operational tasks are both tested, and include the commercial and operations directors, not only the same eight managers.
Criteria for success should be observable: activation time, decisions taken, accuracy of contact data, volume of output sustained, and whether the alternate cold-storage agreement can actually be invoked. Each exercise should produce a report with findings, corrective actions, owners and due dates, and the actions should be verified at the next exercise. Success is not a completed sign-in sheet; it is evidence that capability meets the MTPD and that identified weaknesses are being closed.