[BCM] [ALPS] [E2] [C7] Testing and Exercising

Testing and Exercising Phase as Part of the BCM Planning Methodology for 

 

 

Introduction

 

The Testing and Exercising (TE) Phase is the sixth phase of the Business Continuity Management (BCM) Planning Methodology and is essential for validating the effectiveness of the Business Continuity Management System (BCMS).

While previous phases establish governance, assess risks, analyse business impacts, develop recovery strategies, and produce Business Continuity Plans, the Testing and Exercising Phase determines whether these plans are practical, complete, and capable of being executed successfully during an actual disruption.

For ALPS Healthcare (ALPS), testing and exercising are particularly important because the organisation supports Singapore's public healthcare system through the procurement, warehousing, inventory management, cold-chain logistics, and distribution of essential healthcare products. Business Continuity Plans that have not been exercised cannot provide assurance that personnel understand their roles, communication procedures function effectively, or recovery objectives can be achieved within the required timeframes.

Testing and exercising should not be viewed as compliance activities but as opportunities to improve organisational resilience. Each exercise provides valuable lessons regarding recovery procedures, resource availability, decision-making, communication effectiveness, and coordination with healthcare institutions, suppliers, logistics providers, and government agencies.

ISO 22301 emphasises that organisations should regularly test and exercise their business continuity arrangements to validate assumptions, identify gaps, improve recovery capabilities, and support continual improvement.

For ALPS Healthcare, exercises should progressively increase in complexity, beginning with simple validation activities before advancing to realistic operational simulations involving multiple stakeholders.

This chapter presents a structured testing and exercising programme tailored specifically to ALPS Healthcare, beginning with Initial (Basic) Tests and progressing to Advanced Tests that validate enterprise-wide business continuity capabilities.

 

Objectives of the Testing and Exercising Phase

The objectives of this phase are to:

• Validate the effectiveness of Business Continuity Plans.
• Confirm that recovery strategies are achievable.
• Verify Recovery Time Objectives (RTOs).
• Assess staff readiness and competence.
• Test communication and notification procedures.
• Evaluate coordination between business units.
• Confirm resource availability.
• Validate supplier and logistics continuity arrangements.
• Identify improvement opportunities.
• Support continual improvement of the BCMS.

 

Testing and Exercising Framework

ALPS Healthcare should adopt a progressive exercise programme consisting of two stages.

Exercise Category	Purpose	Complexity
Initial (Basic) Tests	Validate individual plan components and familiarise personnel	Low
Advanced Tests	Validate integrated organisational recovery capabilities	High

The gradual progression from basic to advanced exercises allows staff to build confidence while continuously improving organisational resilience.

 

Initial (Basic) Tests

Initial tests validate individual components of the Business Continuity Plans before conducting more complex exercises.

 

Component Tests

Objective

Component tests verify that individual elements of the Business Continuity Plan function correctly.

Typical components include:

• Generator operation.
• Backup power systems.
• Warehouse Management System recovery.
• Cold-chain monitoring systems.
• Backup communication systems.
• Data restoration procedures.
• Emergency equipment.
• Manual inventory procedures.

Example – ALPS Healthcare

The ICT department conducts a component test by restoring the Warehouse Management System (WMS) from backup to verify that inventory records, product locations, and transaction histories can be recovered within the required Recovery Time Objective.

Another component test involves validating the automatic transfer of refrigeration systems to emergency generators during a simulated power outage.

 

Call Notification Tests

Objective

Call notification tests verify that incident notification procedures operate effectively.

The tests validate:

• Contact lists.
• Escalation procedures.
• Notification timing.
• Communication methods.
• Staff availability.
• Emergency contact accuracy.

Example – ALPS Healthcare

The BCM team initiates an unannounced notification exercise requiring members of the Crisis Management Team, Procurement Division, Warehouse Operations, Logistics, ICT, and Quality Assurance to acknowledge receipt of emergency notifications within predefined response times.

The exercise identifies outdated contact information, delayed acknowledgements, and opportunities to improve notification procedures.

 

Walkthrough Exercises

Objective

Walkthrough exercises familiarise personnel with Business Continuity Plans by reviewing recovery procedures in a structured discussion.

Participants:

• Review recovery procedures.
• Clarify responsibilities.
• Discuss decision-making.
• Validate recovery assumptions.
• Identify documentation improvements.

Example – ALPS Healthcare

Representatives from Procurement, Cold-Chain Logistics, Warehouse Operations, ICT, Supplier Management, and Healthcare Distribution participate in a facilitated walkthrough examining the response to a prolonged warehouse closure resulting from a fire.

Participants review each recovery step, identify procedural improvements, and update recovery documentation accordingly.

 

Advanced Tests

Once personnel are familiar with Business Continuity Plans and initial testing has demonstrated satisfactory preparedness, ALPS Healthcare should conduct more comprehensive exercises.

 

Integrated Tests

Objective

Integrated tests validate coordination across multiple departments and supporting functions.

Integrated testing evaluates:

• Cross-functional communication.
• Decision-making.
• Resource coordination.
• Recovery sequencing.
• Supplier engagement.
• Technology recovery.

Example – ALPS Healthcare

A ransomware attack simultaneously disrupts Procurement Systems, Warehouse Management Systems, and Supplier Portals.

The integrated exercise requires Procurement, ICT, Warehouse Operations, Logistics, Finance, Cybersecurity, Supplier Management, and Corporate Communications to coordinate recovery while maintaining essential healthcare supply services.

The exercise validates enterprise-wide coordination rather than individual departmental responses.

 

Simulation Tests

Objective

Simulation exercises recreate realistic disruptive events requiring participants to make decisions under simulated operational conditions.

Simulation exercises test:

• Crisis leadership.
• Strategic decision-making.
• Operational recovery.
• Communications.
• External coordination.
• Escalation procedures.

Example – ALPS Healthcare

A simulation exercise assumes that a regional infectious disease outbreak significantly increases demand for vaccines and personal protective equipment while an overseas pharmaceutical supplier simultaneously suspends production.

Participants must:

• Activate Crisis Management.
• Implement emergency procurement.
• Prioritise healthcare deliveries.
• Coordinate with healthcare institutions.
• Activate alternative suppliers.
• Manage media enquiries.
• Monitor inventory levels.

The exercise evaluates ALPS' ability to sustain healthcare supply continuity under multiple concurrent disruptions.

 

Live Tests

Objective

Live tests involve actual deployment of recovery resources and operational procedures.

Typical live tests include:

• Generator activation.
• Warehouse relocation.
• Alternate office activation.
• ICT disaster recovery.
• Emergency logistics deployment.
• Cold-chain transfer.
• Manual procurement operations.

Example – ALPS Healthcare

A live exercise transfers selected pharmaceutical inventory from one warehouse to an alternate facility while activating emergency cold-chain transport, manual inventory procedures, and alternative distribution routes.

The exercise confirms that products remain within required temperature ranges while deliveries to selected healthcare institutions continue without interruption.

 

Exercise Planning

Each exercise should include:

• Exercise objectives.
• Scope.
• Participants.
• Exercise scenario.
• Assumptions.
• Success criteria.
• Safety considerations.
• Evaluation methodology.
• Debriefing process.

 

Example Annual Exercise Programme

Quarter	Exercise Type	Example
Q1	Component Test	Warehouse Management System recovery
Q1	Call Notification Test	Crisis Management Team notification
Q2	Walkthrough Exercise	Pharmaceutical supply disruption
Q2	Component Test	Generator and refrigeration systems
Q3	Integrated Test	Cyberattack affecting procurement and warehouse operations
Q3	Simulation Exercise	National healthcare supply shortage
Q4	Live Test	Alternate warehouse activation and emergency logistics deployment

 

Exercise Evaluation

Following every exercise, ALPS Healthcare should conduct a structured evaluation covering:

• Achievement of objectives.
• Recovery timing.
• Communication effectiveness.
• Decision-making.
• Resource adequacy.
• Technology performance.
• Supplier coordination.
• Logistics performance.
• Documentation accuracy.
• Improvement opportunities.

 

Lessons Learned and Continuous Improvement

Every exercise should conclude with a formal "Lessons Learned" review.

Typical outputs include:

• Improvement recommendations.
• Corrective actions.
• Updated Business Continuity Plans.
• Additional training requirements.
• Technology improvements.
• Supplier improvement actions.
• Revised recovery strategies.

Example – ALPS Healthcare

A simulation exercise identifies delays in activating alternative pharmaceutical suppliers due to outdated contract information. As a result, ALPS updates supplier contact databases, revises procurement procedures, and incorporates the improvements into future Business Continuity Plans.

 

ALPS Healthcare-Specific Testing Requirements

Given ALPS Healthcare's responsibilities within Singapore's healthcare supply chain, exercises should periodically include scenarios such as:

• Pharmaceutical shortages.
• Cold-chain failures.
• Warehouse fires.
• Cyberattacks affecting procurement systems.
• Ransomware attacks.
• National transportation disruptions.
• Pandemic response.
• Simultaneous supplier failures.
• Product recalls.
• Utility failures affecting warehouse operations.
• Data centre outages.
• Major logistics disruptions.
• Loss of critical personnel.
• Public health emergencies requiring rapid healthcare supply mobilisation.

Exercises should also involve key external stakeholders where appropriate, including healthcare institutions, logistics providers, strategic suppliers, technology vendors, and relevant government agencies to validate end-to-end continuity arrangements.

 

Regulatory Requirements

ISO 22301 Requirements

ISO 22301 requires organisations to establish, implement, and maintain procedures for exercising and testing their business continuity arrangements. Specifically, organisations should:

• Conduct exercises and tests at planned intervals.
• Validate that business continuity procedures remain effective.
• Confirm that recovery objectives can be achieved.
• Evaluate personnel competence and readiness.
• Record exercise results and lessons learned.
• Update plans based on identified improvements.
• Demonstrate continual improvement of the Business Continuity Management System (BCMS).

Testing and exercising should form part of the organisation's ongoing BCM lifecycle rather than being treated as isolated compliance activities.

Singapore Regulatory Expectations

Although Singapore does not prescribe a single testing methodology applicable to all organisations, business continuity expectations from regulators and recognised national standards consistently require organisations to:

• Regularly exercise Business Continuity Plans.
• Validate crisis management and emergency response arrangements.
• Test technology recovery capabilities.
• Review recovery objectives following organisational or technology changes.
• Document exercise outcomes and corrective actions.
• Report significant findings to senior management.
• Incorporate lessons learned into future planning.

For ALPS Healthcare, testing programmes should demonstrate that critical healthcare supply chain operations—including pharmaceutical procurement, warehouse operations, cold-chain logistics, healthcare distribution, and supporting ICT systems—can continue or recover within acceptable timeframes while supporting Singapore's public healthcare services.

 

Success Factors

A successful testing and exercising programme depends upon:

• Strong executive sponsorship.
• Clearly defined exercise objectives.
• Progressive exercise complexity.
• Active participation by all business units.
• Realistic healthcare supply chain scenarios.
• Inclusion of external stakeholders where appropriate.
• Thorough evaluation and documentation.
• Timely implementation of corrective actions.
• Regular review of exercise programmes.
• Commitment to continual improvement.