---
title: [ISACA] [BCM] [A] [C3] Auditing Testing and Exercising Programmes
description: [ISACA] [BCM] [A] [C3] Auditing Testing and Exercising Programmes
---

[eBook Audit](https://blog.bcm-institute.org/ebook-audit)

# [\[ISACA\] \[BCM\] \[A\] \[C3\] Auditing Testing and Exercising Programmes](https://blog.bcm-institute.org/ebook-audit/isaca-bcm-a-c3-auditing-testing-and-exercising-programmes)

 Written by [Moh Heng Goh](https://blog.bcm-institute.org/ebook-audit/author/moh-heng-goh) | Jun 21, 2026, 5:55:26 AM

#### Chapter 3

### Auditing, Testing, and Exercising Programmes

#### Intoduction

One of the most common weaknesses identified during Business Continuity Management (BCM) audits is the assumption that the existence of plans equates to preparedness.

Organisations may invest significant effort in developing Business Continuity Plans, Crisis Management Plans, Disaster Recovery Plans, and Emergency Response Procedures; however, without effective testing and exercising, there is no assurance that these plans will function as intended during an actual disruption.

Testing and exercising represent the validation phase of the BCM lifecycle.

They provide organisations with the opportunity to assess preparedness, evaluate recovery capabilities, identify weaknesses, verify assumptions, and improve resilience before a real crisis occurs.

From an auditor's perspective, testing and exercising activities provide the strongest evidence of BCM effectiveness. Unlike policies and plans, which demonstrate intent, exercises demonstrate capability.

This chapter provides auditors with a structured framework for evaluating BCM testing and exercising programmes, aligned with ISO 22301:2019, Bank Negara Malaysia (BNM) BCM requirements, BNM Risk Management in Technology (RMiT), and Operational Resilience expectations.

 

#### **Why Testing and Exercising Matter**

The ultimate objective of BCM is not to produce documentation but to ensure that critical business functions and services can continue or recover during disruption.

Testing and exercising help organisations answer critical questions:

- Can recovery objectives be achieved?
- Do personnel understand their roles?
- Are recovery procedures practical?
- Are recovery resources available?
- Will communication channels function effectively?
- Are technology recovery arrangements capable of supporting business operations?

Without exercising, organisations operate based on assumptions rather than evidence.

 

##### **The Difference Between Testing and Exercising**

Although often used interchangeably, testing and exercising serve different purposes.

**Testing**

Testing focuses on validating specific components of continuity arrangements.

Examples:

- Call tree testing
- Backup restoration testing
- System failover testing
- Emergency notification testing
- Data recovery testing

**Exercising**

Exercising evaluates the coordinated response of people, processes, and technology.

Examples:

- Tabletop exercises
- Simulation exercises
- Crisis management exercises
- Integrated recovery exercises
- Live exercises

##### **Auditor's Perspective**

The key audit question is:

**Has management demonstrated that continuity arrangements can support recovery requirements?**

 

#### **Regulatory and Standards Requirements**

##### **ISO 22301:2019 Requirements**

**Clause 8.5 – Exercise Programme**

ISO 22301 requires organisations to:

- Establish an exercise programme
- Validate continuity strategies and solutions
- Verify continuity procedures
- Evaluate competencies
- Identify improvement opportunities

Exercises must be planned, conducted, reviewed, and documented.

##### **Bank Negara Malaysia Expectations**

BNM expects regulated entities to:

- Conduct regular BCM exercises
- Validate recovery capabilities
- Test technology recovery arrangements
- Verify alternate site readiness
- Assess crisis management effectiveness
- Address deficiencies identified during exercises

Auditors should evaluate whether exercises satisfy regulatory expectations and provide meaningful assurance.

 

#### **BCM Exercise Maturity Model**

Auditors should recognise that organisations progress through different levels of exercise maturity.

| Level | Description |
| --- | --- |
| Level 1 | No formal testing programme |
| Level 2 | Compliance-driven testing |
| Level 3 | Structured exercise programme |
| Level 4 | Integrated enterprise exercises |
| Level 5 | Resilience-focused scenario testing |

The audit objective is to determine whether the exercise programme is sufficiently mature for the organisation's risk profile.

 

#### **Types of BCM Tests and Exercises**

##### **3.5.1 Call Tree Testing**

**Purpose**

Validate communication procedures and contact information.

**Audit Focus**

Review:

- Notification procedures
- Escalation mechanisms
- Contact accuracy
- Response tracking

**Audit Questions**

- How long does the notification take?
- Were all personnel contacted successfully?
- Are contact lists current?

**Common Findings**

- Outdated contact information
- Delayed response times
- Incomplete escalation procedures

 

##### **3.5.2 Walkthrough Exercises**

**Purpose**

Validate understanding of recovery procedures.

Participants review plans and discuss actions.

**Audit Focus**

Assess:

- Familiarity with plans
- Recovery process understanding
- Coordination effectiveness

**Audit Questions**

- Can participants explain their responsibilities?
- Are recovery procedures understood?

**Common Findings**

- Inconsistent interpretation of procedures
- Unclear responsibilities
- Missing recovery actions

 

##### **3.5.3 Tabletop Exercises**

**Purpose**

Validate decision-making and coordination.

Participants discuss their response to a simulated scenario.

**Audit Focus**

Review:

- Decision-making processes
- Crisis management effectiveness
- Escalation procedures
- Communication protocols

**Common Findings**

- Delayed decision-making
- Poor communication coordination
- Unclear authority structures

 

##### **3.5.4 Simulation Exercises**

**Purpose**

Replicate realistic disruption scenarios.

Examples:

- Cyberattack
- Data centre outage
- Pandemic event
- Supply chain disruption

**Audit Focus**

Assess:

- Recovery capability
- Cross-functional coordination
- Recovery objective achievement

**Common Findings**

- Recovery objectives not achieved
- Resource constraints
- Technology dependencies overlooked

 

##### **3.5.5 Technical Recovery Testing**

**Purpose**

Validate disaster recovery capabilities.

Examples:

- Server recovery
- Application recovery
- Database restoration
- Cloud failover

**Audit Focus**

Review:

- Recovery performance
- Data integrity
- System functionality
- Recovery timing

**Audit Questions**

- Were RTOs achieved?
- Were RPOs achieved?
- Was the data restored successfully?

**Common Findings**

- Recovery times exceed targets
- Incomplete restoration
- Undocumented recovery procedures

 

##### **3.5.6 Integrated Recovery Exercises**

**Purpose**

Validate end-to-end organisational recovery.

Includes:

- Crisis Management Team
- Business units
- Technology teams
- Third parties

**Audit Focus**

Evaluate:

- Enterprise-wide coordination
- Recovery effectiveness
- Service restoration capability

**Why Auditors Prefer These Exercises**

Integrated exercises provide the strongest evidence that the organisation can recover from a disruption.

 

#### **Auditing the Exercise Programme**

##### **Governance Review**

Auditors should evaluate:

- Exercise policy
- Exercise schedule
- Exercise ownership
- Executive participation
- Reporting mechanisms

##### **Audit Questions**

- Is there an approved exercise programme?
- Are exercises conducted according to the schedule?
- Is management actively involved?

##### **Exercise Coverage Review**

Assess whether exercises cover:

**Critical Business Functions**

Are all critical functions exercised?

**Critical Business Services**

Are customer-facing services tested?

**Technology Recovery**

Are critical systems included?

**Third Parties**

Are key suppliers involved?

**Crisis Management**

Has leadership been tested?

 

##### **Exercise Frequency Review**

Examples:

| Exercise Type | Recommended Frequency |
| --- | --- |
| Call Tree Test | Quarterly |
| Walkthrough | Annual |
| Tabletop Exercise | Annual |
| Technical Recovery Test | Annual |
| Integrated Exercise | Annual |
| Severe Scenario Exercise | Every 1–2 years |

Auditors should assess whether frequency aligns with organisational risk.

 

#### **Evaluating Exercise Effectiveness**

Merely conducting an exercise is insufficient.

Auditors should evaluate:

**Objectives**

Were exercise objectives clearly defined?

**Realism**

Was the scenario realistic?

**Participation**

Were appropriate stakeholders involved?

**Performance**

Were recovery objectives achieved?

**Learning Outcomes**

Were weaknesses identified?

**Improvement Actions**

Were corrective actions implemented?

 

#### **Auditing Exercise Evidence**

Auditors should collect evidence, including:

##### **Exercise Plans**

- Objectives
- Scope
- Participants
- Success criteria

##### **Exercise Reports**

- Results
- Findings
- Lessons learned

##### **Attendance Records**

- Participant involvement
- Executive participation

##### **Corrective Action Logs**

- Identified issues
- Action owners
- Completion status

##### **Recovery Metrics**

- Actual recovery times
- Service restoration results

 

#### **Common Audit Findings**

##### **Finding 1: Exercise Programme Focuses on Compliance**

Exercises are conducted solely to satisfy audit requirements rather than to validate recovery capabilities.

**Risk**

False confidence in organisational preparedness.

 

##### **Finding 2: Limited Executive Participation**

Senior management does not participate in crisis exercises.

**Risk**

Leadership may be unprepared during actual disruptions.

 

##### **Finding 3: Repetitive Scenarios**

The same scenarios are repeated annually.

**Risk**

Emerging threats remain untested.

 

##### **Finding 4: No Validation of Recovery Objectives**

Recovery times are assumed rather than measured.

**Risk**

RTOs may be unachievable.

 

##### **Finding 5: Corrective Actions Not Implemented**

Exercise findings remain unresolved.

**Risk**

Known weaknesses persist.

 

#### **Operational Resilience Scenario Testing**

The emergence of Operational Resilience introduces a new dimension to BCM auditing.

Traditional BCM exercises focus on plan validation.

Operational Resilience scenario testing focuses on:

- Critical Business Services
- Customer outcomes
- Impact tolerances
- Dependency failures
- Severe but plausible scenarios

 

**Auditor Review Areas**

**Critical Business Services**

Have all services been tested?

**Dependency Mapping**

Have critical dependencies been challenged?

**Impact Tolerance**

Were tolerance levels exceeded?

**Severe but Plausible Scenarios**

Examples:

- Simultaneous cyberattack and data centre failure
- Cloud service provider outage
- Third-party service disruption
- Nation-state cyberattack
- AI platform failure

 

#### **Audit Metrics for Testing and Exercising**

Auditors should evaluate performance indicators such as:

**Exercise Completion Rate**

Target: 100%

**Recovery Objective Achievement**

Percentage of exercises meeting RTO/RPO targets.

**Corrective Action Closure Rate**

Target: Greater than 90%

**Executive Participation Rate**

Target: 100% for major exercises.

**Scenario Coverage**

Coverage of key risks and critical services.

 

 

Testing and exercising programmes provide the most reliable evidence of BCM effectiveness. While policies, strategies, and plans establish the framework for continuity, exercises demonstrate whether recovery capabilities can be executed successfully under realistic conditions.

Auditors must therefore move beyond simply verifying that exercises occur and instead evaluate the quality, realism, effectiveness, and outcomes of testing activities.

Particular attention should be given to recovery performance, leadership involvement, corrective action management, and alignment with organisational risks.

In today's environment of increasing digital dependence, cyber threats, and operational complexity, effective testing and exercising are no longer optional.

They are essential mechanisms for validating resilience capabilities and providing assurance that organisations can continue delivering critical products and services when disruption occurs.

The fundamental audit question remains:

**"Has the organisation demonstrated its ability to recover, or has it merely rehearsed the existence of its plans?"**

 

| **Introductory** | **C1** | **C2** | **C3** |
| --- | --- | --- | --- |
|  |  |  |  |
| **eBook Cover** | **C4** | **C5** | **C6** |
|  |  |  |  |

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.

#### More Information About Auditing BCMS Courses

BCM Institute offers two levels of BCM auditing courses: A-3 BCM-8030 ISO22301 BCMS Auditor \[A-3\] and the ISO22301 BCMS Lead Auditor \[A-5\].

|  |  |  |
| --- | --- | --- |
|  |  |  |
|   |   |   |

|  |  | Please feel free to send us a note if you have any questions. |  |  |
| --- | --- | --- | --- | --- |

|  | **Click to View 5000-Level or 300-Level Catalogue.  What Expert- and Intermediate-level Learning Courses are Available?** |  |
| --- | --- | --- |

[View full post](https://blog.bcm-institute.org/ebook-audit/isaca-bcm-a-c3-auditing-testing-and-exercising-programmes)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Moh Heng Goh"
  },
  "dateModified" : "2026-08-03T08:31:32.008Z",
  "datePublished" : "2026-06-21T05:55:26Z",
  "headline" : "[ISACA] [BCM] [A] [C3] Auditing Testing and Exercising Programmes",
  "image" : {
    "@type" : "ImageObject",
    "height" : 400,
    "url" : "https://3893111.fs1.hubspotusercontent-na1.net/hubfs/3893111/Dr%20Goh%20Conference%20Graphic%20Folder/ISACA%20Conference%20Morepost/ISACA%20Audit%20Morepost/%5BISACA%5D%20%5BBCM%5D%20%5BA%5D%20%5BC3%5D%20Auditing%20Testing%20and%20Exercising%20Programmes.jpg",
    "width" : 400
  },
  "mainEntityOfPage" : "https://blog.bcm-institute.org/ebook-audit/isaca-bcm-a-c3-auditing-testing-and-exercising-programmes",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "eBook Audit"
  }
}
```