[BCM] [SAESL] [E2] [C7] Testing and Exercising Phase for Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited

Introduction

A business continuity plan that has never been exercised is a set of assumptions. Staff may not know their roles, contact details may be out of date, and a recovery time that looks sound on paper may be impossible in practice. The Testing and Exercising (TE) phase finds these weaknesses before a real disruption does.

Chapter 6 produced the business continuity (BC) plans for Singapore Aero Engine Services Private Limited (SAESL). This chapter covers the sixth phase of the planning methodology and the ISO 22301 requirement to run an exercise programme. It focuses on the types of exercises SAESL can conduct, grouped into initial (basic) tests and advanced tests, and the regulatory expectation for this phase. All SAESL examples are illustrative.

Why Exercise the Plans

Exercises have three purposes. They confirm that the plans work. They train the people who must use them. They provide evidence that the organisation is prepared, which matters to customers and aviation authorities alike. An exercise that exposes a problem is a success, not a failure, because the problem is fixed at low cost.

The programme should build up gradually. Teams start with simple tests, correct what they find, and then move to more demanding exercises. Moving too quickly to a large, realistic exercise before the basics are right wastes effort and can undermine confidence.

Initial (Basic) Tests

These basic tests suit the first year of the programme and any new or revised plan.

Component tests

A component test checks one element of a plan on its own. For example, SAESL might restore a sample of engineering records from backup and measure how long it takes, or confirm that a standby generator takes the load for a defined period. Component tests are quick, inexpensive and produce hard numbers that can be compared with the recovery time objectives (RTOs).

Call notification tests

A call notification test checks that people can be reached. The BCM coordinator sends an alert through the call tree or messaging tool and records how many people respond, and how fast. For example, SAESL might test whether all members of the crisis management team, and their alternates, can be contacted within a target time, including outside working hours. The test also exposes out-of-date phone numbers.

Walkthrough exercises

In a walkthrough, the plan owners and recovery team sit together and talk through the plan, step by step, against a simple scenario. For example, SAESL might walk through the loss of the engine test facility, asking at each step who acts, what they need and where a gap appears. Walkthroughs are cheap and teach participants the plan, which makes them the best place to start.

Advanced Tests

Once the initial tests have been mastered, SAESL can move to more demanding exercises.

Integrated tests

An integrated test brings several plans and teams together to check that they work as a whole. For example, SAESL might exercise the information technology recovery plan alongside the engine overhaul and quality plans to see whether engineering records are available in the order production needs them.

Simulation tests

A simulation test places participants in a realistic scenario and feeds them developing information, such as messages from customers or an authority. Participants make decisions in real time, and the exercise team records their responses. For example, SAESL might simulate a cyber incident that takes down production systems during a busy overhaul period, with a customer asking for status and a regulator asking for a report.

Live tests

A live test activates real resources, such as switching to an alternative site or system, or operating with a supplier replaced. Live tests carry the greatest value and the greatest risk. At SAESL, they must never compromise the safety of people, the airworthiness of engines or the integrity of customer property. They should be scheduled around production and approved in advance by the steering committee.

Planning and Running an Exercise

Every exercise, large or small, follows the same pattern.

Set the objectives: state what the exercise should prove, for example, that a CBF recovers within its RTO.
Define the scope and scenario: choose a realistic event that links to a risk in the register, such as R2 or R3 from Chapter 3.
Assign roles: name the participants, facilitators and observers, and agree rules to keep production safe.
Run the exercise: record what happens and the times achieved.
Debrief and report: hold a debrief the same day, then issue a written report with findings and actions.
Follow up: assign owners and dates for the actions, and check that they are done.

The steering committee reviews the reports so that weak points reach people who can resolve them.

Regulatory Requirement for This Phase

The Civil Aviation Authority of Singapore (CAAS) is SAESL's primary regulator. Its Advisory Circular AC 1-3 (Revision 9, effective 20 April 2026) on safety management systems (SMS) applies to approved maintenance organisations under the Singapore Airworthiness Requirements, Part 145, other than those in Subpart D. It expects emergency response plans to be easily accessible to key personnel and coordinating external organisations, to be regularly tested through exercises and to be reviewed so that they stay relevant (paragraph 3.13). It also expects the plans to be coordinated with external stakeholders, and it mentions public health emergencies among the foreseeable emergencies to be covered (paragraphs 3.11 and 3.12).

An advisory circular is guidance, so its wording is not a legal minimum, and CAAS does not set a fixed exercise frequency in the parts reviewed for this chapter [verify]. SAESL should confirm with CAAS how it applies this expectation to the organisation. The practical lesson is that SAESL's BCM exercise programme and its SMS emergency response exercises should be planned together, so that one exercise can serve both purposes and the evidence is kept in one place.

Summary Table

Table 7: Testing and Exercising Phase for Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited

Group	Exercise type	What it checks	Illustrative SAESL example
Initial	Component test	One element works	Restore engineering records from backup
Initial	Call notification test	People can be reached	Crisis team contacted within target time
Initial	Walkthrough	The plan is clear and complete	Talk through loss of the test facility
Advanced	Integrated test	Plans work together	IT, overhaul and quality plans together
Advanced	Simulation test	Decisions under pressure	Cyber incident with customer and regulator queries
Advanced	Live test	Real resources perform	Failover to an alternative system, scheduled around production

All SAESL-specific entries are illustrative and must be confirmed by SAESL.

Conclusion

Testing and exercising turns written plans into proven capability. SAESL should start with component tests, call notification tests and walkthroughs, then move to integrated, simulation and live tests once the basics work. Every exercise needs clear objectives, a report and tracked actions. The regulatory expectation in the CAAS safety management guidance gives a further reason to plan exercises carefully and keep records of them.

The next chapter explains how SAESL keeps the programme current through programme management.

Sources

Continue reading: Chapter 8, Program Management Phase for Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited, shows how SAESL maintains, reviews and improves its BCM programme.

Building Resilient Operations: Implementing Business Continuity Management at SAESL
eBook 2: Implementing Business Continuity Management
C1	C2	C3	C4	C5

C6	C7	C8	C9	C10