Testing and Exercising
Example BoK 6 TE #2
1. What was performed?
- As required by both Head Office and local regulations, we are required to perform different tests and exercises on the effectiveness of our BC and DR plans. Throughout the year, we conducted tabletop exercises, call tree exercises and drills and business continuity and disaster recovery (BCDR) drills every year to ensure readiness. Any change that affects the plans, e.g. introduction of a new critical process or system, will be revised and test after completion. During the past three years, it was my responsibility to arrange the test and exercise and coordinate between departments to ensure these tasks could be performed smoothly.
2. When was it done?
- As the appointed financial institution's Organizational BCM coordinator, I have performed this role for the past three years to arrange the drill exercises and coordinate between business units to ensure these tasks can be performed smoothly.
3. How was it carried out?
- For tabletop exercises, two exercises related to terrorism and pandemic are required every year to let the staff understand the latest plans, including the incident response and evacuation procedures and split operations arrangement. The materials are tailor-made and uploaded to eLearning, and all staff are required to complete them.
- As directed by management, all telephone call drills were conducted on a surprise basis for the past three years to test the procedures and response time from staff. The branch called out tree consists of three levels, including management, division (team leader) and business unit (BU heads and deputy) and it is maintained by our team. The message would be delivered to them via WhatsApp. Once completed, we would consolidate the result and report to the management. We are considering using the vendor’s automated notification tool to enhance the emergency notification to increase reliability and efficiency.
- The BCDR drill must be conducted annually to test the alternate site and backup data centre's readiness and enable the staff (especially the new joiner) to get more familiar with the BCDR plan.
