One of the most common weaknesses identified during Business Continuity Management (BCM) audits is the assumption that the existence of plans equates to preparedness.
Organisations may invest significant effort in developing Business Continuity Plans, Crisis Management Plans, Disaster Recovery Plans, and Emergency Response Procedures; however, without effective testing and exercising, there is no assurance that these plans will function as intended during an actual disruption.
Testing and exercising represent the validation phase of the BCM lifecycle.
They provide organisations with the opportunity to assess preparedness, evaluate recovery capabilities, identify weaknesses, verify assumptions, and improve resilience before a real crisis occurs.
From an auditor's perspective, testing and exercising activities provide the strongest evidence of BCM effectiveness. Unlike policies and plans, which demonstrate intent, exercises demonstrate capability.
This chapter provides auditors with a structured framework for evaluating BCM testing and exercising programmes, aligned with ISO 22301:2019, Bank Negara Malaysia (BNM) BCM requirements, BNM Risk Management in Technology (RMiT), and Operational Resilience expectations.
The ultimate objective of BCM is not to produce documentation but to ensure that critical business functions and services can continue or recover during disruption.
Testing and exercising help organisations answer critical questions:
Without exercising, organisations operate based on assumptions rather than evidence.
Although often used interchangeably, testing and exercising serve different purposes.
Testing
Testing focuses on validating specific components of continuity arrangements.
Examples:
Exercising
Exercising evaluates the coordinated response of people, processes, and technology.
Examples:
The key audit question is:
Has management demonstrated that continuity arrangements can support recovery requirements?
Clause 8.5 – Exercise Programme
ISO 22301 requires organisations to:
Exercises must be planned, conducted, reviewed, and documented.
BNM expects regulated entities to:
Auditors should evaluate whether exercises satisfy regulatory expectations and provide meaningful assurance.
Auditors should recognise that organisations progress through different levels of exercise maturity.
|
Level |
Description |
|
Level 1 |
No formal testing programme |
|
Level 2 |
Compliance-driven testing |
|
Level 3 |
Structured exercise programme |
|
Level 4 |
Integrated enterprise exercises |
|
Level 5 |
Resilience-focused scenario testing |
The audit objective is to determine whether the exercise programme is sufficiently mature for the organisation's risk profile.
Purpose
Validate communication procedures and contact information.
Audit Focus
Review:
Audit Questions
Common Findings
Purpose
Validate understanding of recovery procedures.
Participants review plans and discuss actions.
Audit Focus
Assess:
Audit Questions
Common Findings
Purpose
Validate decision-making and coordination.
Participants discuss their response to a simulated scenario.
Audit Focus
Review:
Common Findings
Purpose
Replicate realistic disruption scenarios.
Examples:
Audit Focus
Assess:
Common Findings
Purpose
Validate disaster recovery capabilities.
Examples:
Audit Focus
Review:
Audit Questions
Common Findings
Purpose
Validate end-to-end organisational recovery.
Includes:
Audit Focus
Evaluate:
Why Auditors Prefer These Exercises
Integrated exercises provide the strongest evidence that the organisation can recover from a disruption.
Auditors should evaluate:
Assess whether exercises cover:
Critical Business Functions
Are all critical functions exercised?
Critical Business Services
Are customer-facing services tested?
Technology Recovery
Are critical systems included?
Third Parties
Are key suppliers involved?
Crisis Management
Has leadership been tested?
Examples:
|
Exercise Type |
Recommended Frequency |
|
Call Tree Test |
Quarterly |
|
Walkthrough |
Annual |
|
Tabletop Exercise |
Annual |
|
Technical Recovery Test |
Annual |
|
Integrated Exercise |
Annual |
|
Severe Scenario Exercise |
Every 1–2 years |
Auditors should assess whether frequency aligns with organisational risk.
Merely conducting an exercise is insufficient.
Auditors should evaluate:
Objectives
Were exercise objectives clearly defined?
Realism
Was the scenario realistic?
Participation
Were appropriate stakeholders involved?
Performance
Were recovery objectives achieved?
Learning Outcomes
Were weaknesses identified?
Improvement Actions
Were corrective actions implemented?
Auditors should collect evidence, including:
Exercises are conducted solely to satisfy audit requirements rather than to validate recovery capabilities.
Risk
False confidence in organisational preparedness.
Senior management does not participate in crisis exercises.
Risk
Leadership may be unprepared during actual disruptions.
The same scenarios are repeated annually.
Risk
Emerging threats remain untested.
Recovery times are assumed rather than measured.
Risk
RTOs may be unachievable.
Exercise findings remain unresolved.
Risk
Known weaknesses persist.
The emergence of Operational Resilience introduces a new dimension to BCM auditing.
Traditional BCM exercises focus on plan validation.
Operational Resilience scenario testing focuses on:
Auditor Review Areas
Critical Business Services
Have all services been tested?
Dependency Mapping
Have critical dependencies been challenged?
Impact Tolerance
Were tolerance levels exceeded?
Severe but Plausible Scenarios
Examples:
Auditors should evaluate performance indicators such as:
Exercise Completion Rate
Target: 100%
Recovery Objective Achievement
Percentage of exercises meeting RTO/RPO targets.
Corrective Action Closure Rate
Target: Greater than 90%
Executive Participation Rate
Target: 100% for major exercises.
Scenario Coverage
Coverage of key risks and critical services.
Testing and exercising programmes provide the most reliable evidence of BCM effectiveness. While policies, strategies, and plans establish the framework for continuity, exercises demonstrate whether recovery capabilities can be executed successfully under realistic conditions.
Auditors must therefore move beyond simply verifying that exercises occur and instead evaluate the quality, realism, effectiveness, and outcomes of testing activities.
Particular attention should be given to recovery performance, leadership involvement, corrective action management, and alignment with organisational risks.
In today's environment of increasing digital dependence, cyber threats, and operational complexity, effective testing and exercising are no longer optional.
They are essential mechanisms for validating resilience capabilities and providing assurance that organisations can continue delivering critical products and services when disruption occurs.
The fundamental audit question remains:
"Has the organisation demonstrated its ability to recover, or has it merely rehearsed the existence of its plans?"
| Introductory | C1 | C2 | C3 |
| eBook Cover | C4 | C5 | C6 |
BCM Institute offers two levels of BCM auditing courses: A-3 BCM-8030 ISO22301 BCMS Auditor [A-3] and the ISO22301 BCMS Lead Auditor [A-5].
| Please feel free to send us a note if you have any questions. |
| Click to View 5000-Level or 300-Level Catalogue. What Expert- and Intermediate-level Learning Courses are Available? |