[BCM] [e2i] [E2] [C7] Testing and Exercising

Chapter 7

 Testing and Exercising Phase for the Employment and Employability Institute

As part of the ISO 22301 Business Continuity Management System (BCMS) implementation, the Testing and Exercising Phase ensures that the Business Continuity Plan of the Employment and Employability Institute (e2i) is practical, functional, and effective.

This chapter focuses on the types of exercises that e2i can conduct to validate the readiness of its business continuity arrangements.

These exercises are grouped into Initial (basic) tests and Advanced tests, forming a progressive approach to building resilience.

e2i, which supports workers through career coaching, job placement services, and skills upgrading initiatives, operates in a dynamic and people-centric environment.

As such, its ability to continue providing these services in the face of disruption depends on how well-prepared its staff, systems, and processes are. Effective testing and exercising are critical to this preparedness.

Objectives of Testing and Exercising

The objectives of this phase include:

• Validating the effectiveness of the business continuity strategies and plans.
• Enhancing awareness among staff about their roles during a disruption.
• Identifying gaps and weaknesses in the plan for continuous improvement.
• Improving interdepartmental coordination in a crisis scenario.
• Fulfilling compliance requirements under ISO 22301.

Initial Tests

These tests focus on individual components and familiarisation with the plan and procedures. They are often conducted early in the BCM lifecycle to build a foundation for more complex exercises.

1. Component Tests

Purpose

To verify that individual components of the recovery plan are working as intended.

e2i Example

The IT team tests the failover capability of its cloud-based appointment booking system to ensure that it can continue functioning if the primary data centre is compromised.

This component test may involve redirecting traffic to a backup server and checking that user access is unaffected.

2. Call Notification Tests

Purpose

To confirm that emergency contact details are accurate and that staff can be reached promptly.

e2i Example

A scheduled test alert is sent out using the emergency mass notification system to all customer-facing and backend staff.

The test measures the response rate and the time taken for recipients to acknowledge the message, especially for front-line career coaches who must respond swiftly during operational disruptions.

3. Walkthrough Exercises

Purpose

To familiarise staff with the BCP by reviewing roles and procedures without activating any systems.

e2i Example

Departmental heads at e2i participate in a walkthrough of the pandemic response plan.

The session involves discussing the decision-making hierarchy, communication procedures, and staff rostering for hybrid work arrangements during movement restrictions.

No actual system changes are made during the walkthrough.

Advanced Tests

Once the initial tests have been successfully conducted and lessons learned have been incorporated into the plan, e2i can move on to more complex and realistic scenarios that challenge coordination, communication, and decision-making under pressure.

1. Integrated Tests

Purpose

To evaluate how multiple components and departments work together during a disruption.

e2i Example

e2i conducts an integrated test simulating a fire at its Devan Nair Institute for Employment and Employability premises.

The test involves the activation of evacuation procedures, remote access by career coaches, IT system switchover, and external communication with the public about service availability.

It assesses coordination among the facilities, HR, IT, and customer service teams.

2. Simulation Tests

Purpose

To simulate a realistic crisis scenario in a controlled setting, requiring participants to respond as if it were real.

e2i Example

A simulated cyberattack on the job portal backend system is carried out.

The exercise tests the incident response process, from the initial detection by IT to the escalation to senior management, internal and external communications, and data recovery efforts.

Participants act out their roles, including communication with affected job seekers and employers.

3. Live Tests

Purpose

To conduct an unannounced test that mimics an actual event, involving the activation of recovery strategies and full-scale deployment of response teams.

e2i Example

A surprise live test is initiated during off-peak hours, simulating a disruption of the SkillsFuture Credit verification system.

Staff must transition operations to a backup location, and career consultants must access client files via alternate channels.

The test measures the actual time to resume essential services and identifies any real-time issues with logistics or decision-making.

Key Considerations for e2i

When designing its BCM tests, e2i should consider:

• Test Objectives: Clear, measurable outcomes should be defined before the test.
• Scope and Scale: Exercises should reflect the criticality of the services being tested.
• Documentation: All test results must be documented for audit, review, and continual improvement.
• Stakeholder Involvement: Include external partners where relevant, such as WSG or SkillsFuture Singapore.
• Post-Test Review: Conduct a lessons-learned workshop to update plans and enhance training.

Summing Up ...

The Testing and Exercising Phase is critical for embedding resilience into e2i’s service delivery.

Through a structured progression from basic to advanced tests, e2i can ensure that its business continuity arrangements are both functional and responsive to the diverse risks it may face.

With rigorous and realistic testing, e2i can uphold its mission to support workers and employers, even during times of crisis.