[BCM] [Damanat] [E2] [C7] Testing and Exercising

Testing and Exercising Phase as Part of the BCM Planning Methodology for 

 

 

Introduction

The Testing and Exercising (TE) phase is the stage of the Business Continuity Management (BCM) Planning Methodology in which the Saudi Mortgage Guarantees Services Company (Damanat) validates whether its Business Continuity Plans, recovery strategies, personnel, technology, facilities and external dependencies can operate effectively during a disruptive incident.

The preceding Plan Development phase establishes what Damanat intends to do when normal operations are disrupted. Testing and Exercising determines whether those documented arrangements can actually be executed.

This distinction is fundamental.

A Business Continuity Plan may state that employees will relocate, work remotely, switch to alternative communication channels, implement manual workarounds, or recover critical technology in a disaster recovery environment.

Until those arrangements are exercised, however, Damanat cannot be sufficiently assured that they will meet the recovery requirements established in the Business Impact Analysis (BIA).

Testing and Exercising therefore moves BCM from:

“We have documented our recovery arrangements.”

to:

“We have demonstrated that our recovery arrangements can work.”

For Damanat, exercises should progressively validate the continuity of Critical Business Functions, such as Mortgage Guarantee Origination, and their supporting people, processes, technology, information, premises, participating financial institutions, and third-party service providers.

The exercise programme should be progressive. It should begin with relatively simple activities designed to validate individual components and familiarise personnel with their responsibilities.

As organisational capability matures, Damanat should progress toward increasingly complex exercises involving multiple Business Units, technology recovery, external dependencies, senior management and realistic disruption scenarios.

For the purpose of this methodology, the exercise programme is divided into two broad groups:

Initial Tests

• Component Tests
• Call Notification Tests
• Walkthrough Exercises

Advanced Tests

• Integrated Tests
• Simulation Tests
• Live Tests

The progression can therefore be represented as:

Component → Call Notification → Walkthrough → Integrated → Simulation → Live

This progressive approach allows Damanat to build capability before exposing the organisation to increasingly demanding and operationally complex exercises.

 

Purpose of Testing and Exercising

The purpose of Testing and Exercising is not simply to demonstrate regulatory compliance.

An effective exercise programme should determine whether Damanat can:

• activate Business Continuity Plans;
• mobilise recovery teams;
• communicate effectively during disruption;
• continue Critical Business Functions;
• achieve approved recovery objectives;
• recover critical technology;
• operate from alternate workplaces;
• use manual or alternative procedures;
• coordinate across Business Units;
• work with participating financial institutions;
• coordinate critical suppliers;
• make decisions under pressure;
• manage escalating incidents;
• recover critical data;
• maintain minimum service levels; and
• return safely to normal operations.

Testing should also identify weaknesses before those weaknesses are exposed during a real incident.

The principle should therefore be:

An exercise is successful when it provides reliable evidence about capability and identifies opportunities for improvement—not simply when participants complete the scenario without difficulty.

Relationship Between Plan Development and Testing

The Plan Development and Testing and Exercising phases are closely connected.

The Plan Development phase establishes:

What should happen.

Testing and Exercising determines:

Whether it can happen.

For example, Damanat's BCP may state:

Mortgage Guarantee Origination will continue through remote working if the primary workplace becomes unavailable.

An exercise should determine whether:

• employees can receive the activation notification;
• designated personnel know their roles;
• remote connectivity is available;
• authentication works;
• critical applications can be accessed;
• required information is available;
• approval authorities remain operational;
• participating financial institutions can communicate with Damanat; and
• the required MBCO can be achieved.

Exercise findings then feed back into the BCP.

The improvement cycle becomes:

Plan → Exercise → Observe → Identify Gaps → Correct → Update Plan → Re-test

 

Establishing the Damanat Testing and Exercising Programme

Damanat should establish an annual or multi-year exercise programme covering its Critical Business Functions and supporting resources.

The programme should identify:

• plans to be exercised;
• Critical Business Functions covered;
• exercise type;
• exercise objectives;
• disruption scenarios;
• participating Business Units;
• supporting technology;
• third-party involvement;
• exercise frequency;
• exercise dates;
• observers;
• evaluation methodology; and
• reporting requirements.

Not every exercise needs to test everything simultaneously.

A progressive programme allows Damanat to validate individual capabilities before combining them into more complex exercises.

 

Progressive Exercise Maturity

Damanat's exercise programme can be structured as follows:

 

Level	Exercise Type	Primary Purpose	Complexity
Initial	Component Test	Validate individual recovery components	Low
Initial	Call Notification Test	Validate communications and mobilisation	Low
Initial	Walkthrough Exercise	Review plans and procedures collectively	Low–Moderate
Advanced	Integrated Test	Validate multiple interconnected capabilities	Moderate–High
Advanced	Simulation Test	Validate decision-making under realistic conditions	High
Advanced	Live Test	Demonstrate operational recovery capability	Very High

The progression should not be interpreted as meaning that initial exercises become unnecessary once advanced exercises begin.

Component, notification and walkthrough exercises should continue to be used whenever appropriate.

 

Initial Tests

Initial tests provide the foundation for Damanat's exercise programme.

They are designed to verify individual components of the continuity arrangements, familiarise employees with their responsibilities and identify basic weaknesses before more complex exercises are attempted.

The three initial tests are:

1. Component Tests
2. Call Notification Tests
3. Walkthrough Exercises

 

Component Tests

A Component Test validates a specific element of a Business Continuity or recovery arrangement rather than testing the entire plan.

Components may include:

• backup restoration;
• remote-access capability;
• alternative workplace equipment;
• emergency communications;
• application recovery;
• data restoration;
• power backup;
• manual processing procedures;
• emergency contact information;
• alternate approval procedures; or
• supplier escalation arrangements.

Component testing allows weaknesses to be isolated and corrected before the component is incorporated into a broader exercise.

 

Example of a Damanat Component Test

Consider Damanat's Mortgage Guarantee Origination function.

A component test could validate whether selected employees can access the mortgage guarantee processing environment remotely.

Objective

Confirm that designated recovery personnel can securely access the required application from an approved remote location.

Test Activities

Participants:

1. receive instructions to activate remote access;
2. authenticate using the approved security mechanism;
3. connect to the required environment;
4. access the guarantee-processing application;
5. retrieve a designated test record;
6. perform an approved test transaction; and
7. confirm successful completion.

Success Criteria

The component test may be considered successful if:

• designated employees can authenticate;
• required systems are accessible;
• application performance is acceptable;
• required information is available; and
• the activity can be completed within the predetermined recovery requirement.

If ten designated employees are expected to operate remotely but only six can successfully access the application, the test has identified a continuity capability gap requiring remediation.

 

Technology Component Tests

Technology component tests are particularly important because many Damanat Critical Business Functions may depend upon electronic processing.

Examples include:

• restoring a database from backup;
• validating application failover;
• testing network redundancy;
• validating alternative telecommunications;
• testing backup power;
• restoring selected servers;
• testing identity and authentication services;
• verifying data replication; and
• testing interfaces with external systems.

Technology tests should be coordinated with Business Unit representatives whenever the recovered technology must ultimately support business operations.

A technically successful system recovery does not necessarily mean that the business service has recovered.

 

Call Notification Tests

A Call Notification Test validates whether Damanat can contact and mobilise designated personnel during a disruption.

The test should determine whether:

• contact information is accurate;
• notification mechanisms work;
• employees receive the notification;
• employees acknowledge receipt;
• alternates can be contacted;
• escalation occurs where personnel cannot be reached; and
• notification can be completed within the required timeframe.

The test may use:

• telephone calls;
• SMS;
• emergency notification systems;
• approved messaging platforms;
• email; or
• a combination of channels.

 

Example of a Damanat Call Notification Test

Suppose the Mortgage Guarantee Origination recovery team contains 20 designated employees.

The BCM Coordinator initiates a notification test.

The exercise records:

Measure	Result
Personnel to be contacted	20
Successfully contacted	18
Contact details incorrect	1
No response	1
Target notification time	30 minutes
Actual completion time	24 minutes

The test has therefore identified two issues requiring follow-up even though the overall notification time was achieved.

The objective is not simply to establish that a telephone number exists in the BCP. It is to confirm that the recovery team can actually be mobilised.

 

Walkthrough Exercises

A Walkthrough Exercise brings relevant plan owners and recovery personnel together to systematically review the BCP and discuss how they would respond to a specified disruption.

Unlike a simple document review, participants actively work through the plan.

The facilitator may present a scenario such as:

“Damanat's primary office will remain inaccessible for the next 48 hours. Critical technology services remain available.”

Participants then explain:

• whether the BCP should be activated;
• who has activation authority;
• who must be contacted;
• which Critical Business Functions require priority attention;
• where employees will work;
• what resources are required;
• which suppliers must be contacted;
• how participating financial institutions will be informed; and
• how management will receive situation reports.

 

Example of a Damanat Walkthrough

Consider the following scenario:

At 8:00 a.m., employees are informed that Damanat's primary workplace cannot be occupied because of a major building infrastructure failure. Access will not be possible for at least three working days.

Participants could be asked:

Activation

Who determines whether the BCP should be activated?

People

Which employees must become operational first?

Workplace

Can priority employees work remotely?

Technology

Can employees access all required applications remotely?

Business Functions

Which mortgage guarantee activities must continue first?

External Parties

Which participating financial institutions need to be informed?

Suppliers

Which suppliers need to support the alternate operating arrangements?

Communications

How will employees receive instructions?

Management

How will recovery status be reported?

The walkthrough can reveal gaps without interrupting live operations.

 

Moving from Initial to Advanced Tests

Once Damanat has demonstrated reasonable competence in component, notification and walkthrough exercises, the organisation should progress to more advanced exercises.

The objective changes from validating isolated components to validating interconnected organisational capability.

Advanced tests include:

1. Integrated Tests
2. Simulation Tests
3. Live Tests

These exercises require greater involvement in planning, coordination, control, and management.

 

Integrated Tests

An Integrated Test validates the interaction between multiple Business Units, plans, technologies, recovery teams and external dependencies.

This is particularly important because Critical Business Functions rarely operate independently.

For example, Mortgage Guarantee Origination may depend on:

**Business Operations

• Technology
• Risk
• Records
• Communications
• Participating Financial Institutions
• External Service Providers**

An integrated exercise determines whether these dependencies can recover together.

 

Example of a Damanat Integrated Test

Damanat could conduct an integrated test in response to the loss of its primary technology environment.

Participants could include:

• Mortgage Guarantee Origination;
• IT;
• Risk Management;
• Finance;
• Customer or Financial Institution Support;
• BCM;
• Crisis Management;
• Communications; and
• selected technology providers.

The test might require:

1. detection of technology failure;
2. incident escalation;
3. BCP activation;
4. technology DR activation;
5. recovery of critical applications;
6. business-user validation;
7. activation of alternative communications;
8. processing of selected test transactions;
9. verification of external interfaces; and
10. management reporting.

The objective is to determine whether the entire recovery chain works, not merely whether the server can be restarted.

 

Testing Interdependencies

Integrated tests are particularly useful for identifying conflicting recovery assumptions.

For example:

Mortgage Guarantee Origination RTO: 4 hours

Required Technology Recovery: 4 hours

Required External Interface Recovery: 6 hours

Required Data Service Recovery: 8 hours

The business function cannot realistically recover within four hours if essential dependencies require six or eight hours.

An integrated exercise exposes such inconsistencies.

The findings should then be returned to the BIA, BCS or BCP for corrective action.

 

Simulation Tests

A Simulation Test creates a realistic but controlled disruption scenario in which participants must respond to evolving events.

Unlike a walkthrough, where participants primarily discuss actions, a simulation requires them to make decisions and perform selected response activities as though the event were actually occurring.

Simulations can include:

• timed scenario injects;
• changing incident conditions;
• simulated media enquiries;
• simulated regulator communications;
• supplier failures;
• employee issues;
• technology complications;
• customer enquiries;
• conflicting information; and
• management decision points.

The objective is to evaluate behaviour, coordination, decision-making and plan effectiveness under pressure.

 

Example: Damanat Cyber Disruption Simulation

A Damanat simulation could begin with:

9:00 a.m. – Employees report that the mortgage guarantee processing platform is unavailable.

The exercise then evolves.

Inject 1 — 9:15 a.m.

IT identifies unusual activity and suspects a cyber incident.

Inject 2 — 9:30 a.m.

Remote access to several critical applications is suspended as a precaution.

Inject 3 — 10:00 a.m.

Participating financial institutions begin requesting information about delayed guarantee applications.

Inject 4 — 10:30 a.m.

Technology teams advise that normal recovery may take more than eight hours.

Inject 5 — 11:00 a.m.

Senior management requests an assessment of business impact and recovery options.

Inject 6 — 12:00 p.m.

A critical third-party technology provider reports that one of its services is also affected.

Participants must determine:

• whether to activate BCPs;
• whether to escalate to crisis management;
• what activities should be prioritised;
• whether alternative procedures should be activated;
• how financial institutions should be informed;
• how technology recovery should proceed;
• what information should be escalated to management; and
• what regulatory notifications may be required.

This creates a realistic decision-making environment without deliberately disrupting production operations.

 

Testing Crisis Management Integration

SAMA specifically expects BCP testing scenarios to cover activation and involvement of the crisis management team.

Damanat's advanced exercises should therefore validate the interface between:

Incident Management → Business Continuity → Technology Recovery → Crisis Management

The exercise should test:

• escalation criteria;
• decision authority;
• situation reporting;
• strategic decision-making;
• resource prioritisation;
• stakeholder communications;
• coordination between business and technology recovery; and
• return-to-normal decisions.

This prevents BCM and crisis management from operating as separate structures during a major disruption.

 

Live Tests

A Live Test is the most advanced form of exercise in this methodology.

It requires selected continuity or recovery arrangements to be physically activated rather than merely discussed or simulated.

Examples may include:

• relocating employees to an alternate workplace;
• operating Critical Business Functions from the recovery location;
• processing controlled transactions through recovery infrastructure;
• switching selected services to an alternate environment;
• using alternative telecommunications;
• operating under minimum staffing levels; or
• conducting business operations through approved continuity arrangements for a defined period.

Live tests provide strong evidence of actual recovery capability but also create greater operational risk.

They must therefore be carefully planned and controlled.

 

Example of a Damanat Live Test

Damanat could conduct a controlled live exercise involving selected Mortgage Guarantee Origination personnel.

The exercise could require participants to:

1. receive a BCP activation notification;
2. leave the normal operating arrangement;
3. activate the designated recovery environment;
4. connect to critical applications;
5. establish communications;
6. access required records;
7. process controlled test transactions;
8. demonstrate approval capability;
9. maintain the minimum required service level; and
10. return to normal operations.

The test should have safeguards to prevent unintended effects on live customer or financial institution transactions.

 

Live Test Risk Assessment

Before conducting a live exercise, Damanat should perform an exercise risk assessment.

Potential risks include:

• unintended service interruption;
• data corruption;
• duplicate transactions;
• customer impact;
• external stakeholder confusion;
• employee safety;
• production system instability;
• cybersecurity exposure; and
• inability to return to normal operations.

Controls may include:

• test-data segregation;
• controlled participant groups;
• rollback procedures;
• technical monitoring;
• management approval;
• exercise stop criteria; and
• dedicated exercise controllers.

The objective of exercising BCM should never be to create an unacceptable operational risk.

 

Comparison of Initial and Advanced Tests

 

Exercise Type	Level	Primary Focus	Damanat Example
Component Test	Initial	Individual recovery capability	Restore selected guarantee-processing data
Call Notification Test	Initial	Recovery-team mobilisation	Contact Mortgage Guarantee Origination recovery personnel
Walkthrough Exercise	Initial	Plan understanding	Discuss response to three-day office loss
Integrated Test	Advanced	Cross-functional recovery	Business + IT + suppliers recover mortgage guarantee processing
Simulation Test	Advanced	Decision-making under pressure	Cyberattack affecting guarantee operations
Live Test	Advanced	Actual operational capability	Operate selected activities through recovery arrangements

Each exercise provides a different form of assurance.

A mature Damanat exercise programme should use a combination of these approaches.

 

Developing Exercise Scenarios

Exercise scenarios should be selected from credible threats identified through the Risk Analysis and Review.

Examples relevant to Damanat could include:

• primary workplace unavailable;
• mortgage guarantee processing platform failure;
• cyberattack or ransomware;
• telecommunications outage;
• critical data corruption;
• widespread personnel unavailability;
• third-party technology provider failure;
• external interface disruption;
• prolonged power failure;
• simultaneous technology and workplace disruption; and
• disruption affecting a participating financial institution interface.

Scenarios should become progressively more complex as exercise maturity increases.

 

Scenario Selection Based on RAR and BIA

Exercise selection should not be arbitrary.

The scenario should connect:

RAR → BIA → BCS → PD → Exercise

For example:

RAR

Identifies cyberattack as a significant threat.

BIA

Identifies Mortgage Guarantee Origination as requiring recovery within a predetermined RTO.

BCS

Establishes technology DR and temporary processing arrangements.

PD

Documents activation and recovery procedures.

Exercise

Simulates a cyberattack and tests whether those arrangements can achieve the recovery requirement.

This traceability demonstrates that the exercise programme validates risks and capabilities relevant to Damanat.

 

Exercise Objectives

Every exercise should have clearly defined objectives.

Examples include:

• validate BCP activation;
• verify employee notification;
• validate recovery-team roles;
• confirm remote-working capability;
• validate alternate workplace readiness;
• demonstrate technology recovery;
• achieve a specified RTO;
• validate RPO;
• demonstrate MBCO;
• verify supplier response;
• test crisis escalation;
• validate external communication;
• identify plan weaknesses; and
• test return-to-normal procedures.

An exercise should not simply have the objective:

“Test the Business Continuity Plan.”

That is too broad to provide meaningful evaluation.

 

Exercise Success Criteria

Objectives should have measurable success criteria.

For example:

Objective

Validate notification of the Mortgage Guarantee Origination recovery team.

Success Criteria

95 percent of designated personnel acknowledge notification within 30 minutes.

Objective

Validate technology recovery.

Success Criteria

Critical processing capability becomes available within the approved RTO.

Objective

Validate minimum operating capability.

Success Criteria

The recovery environment demonstrates the ability to support the approved MBCO.

Clear criteria make exercise evaluation evidence-based.

 

Exercise Participants and Roles

A structured exercise may involve several roles.

Participants

Individuals expected to respond to the scenario.

Facilitators

Guide the exercise.

Exercise Controllers

Manage scenario progression and injects.

Observers

Observe performance without directing participants.

Evaluators

Assess performance against objectives.

Technical Support

Ensures safe operation of exercise technology.

Senior Management

Participates where escalation and crisis management are being tested.

Clear separation of these roles improves the objectivity of the exercise.

 

Third-Party Participation

Damanat should progressively include critical third parties in exercises in which those organisations are part of the recovery strategy.

Participants may include:

• technology providers;
• telecommunications providers;
• critical outsourced service providers;
• facilities providers; and
• other parties supporting Critical Business Functions.

SAMA's BCM Framework also requires key service providers supporting critical activities to have continuity plans and to test them at least yearly.

For Damanat, supplier participation can reveal whether contractual recovery commitments can actually support its BIA-derived recovery requirements.

 

Testing RTO, RPO and MBCO

Exercises should progressively validate the recovery objectives established during the BIA.

Recovery Time Objective

Did the activity recover within the required time?

Recovery Point Objective

Was data recovered to the required point?

Minimum Business Continuity Objective

Could the required minimum level of activity be sustained?

For example:

RTO: 4 hours

Actual Recovery: 5 hours 20 minutes

The exercise has identified a recovery gap of 1 hour 20 minutes.

The appropriate response is not to redefine the exercise as successful. Damanat should determine why the recovery requirement was missed and establish corrective action.

 

Exercise Evaluation

Immediately after an exercise, participants should conduct a structured debrief.

The evaluation should identify:

What Worked?

Capabilities demonstrated successfully.

What Did Not Work?

Failures or difficulties.

What Was Missing?

Resources, information, procedures or capabilities that were unavailable.

What Was Unclear?

Roles, responsibilities, escalation or procedures that caused confusion.

What Must Improve?

Corrective actions required before the next exercise.

This information should be documented in an exercise report.

 

Exercise Report

The exercise report should include:

• exercise title;
• date;
• scope;
• scenario;
• participants;
• objectives;
• success criteria;
• timeline;
• observations;
• achievements;
• deficiencies;
• lessons learned;
• corrective actions;
• responsible owners;
• target dates; and
• requirement for re-testing.

The report should provide an evidence trail demonstrating that the exercise was performed and that findings were addressed.

 

Corrective Action Management

The value of an exercise depends heavily on what Damanat does with the findings.

Each significant finding should be tracked as a corrective action.

For example:

 

Finding	Required Action	Owner	Target
Recovery-team contacts outdated	Update notification directory	BCM Coordinator	2 weeks
Remote capacity insufficient	Increase concurrent-user capacity	IT	2 months
Supplier recovery exceeds required RTO	Review supplier recovery arrangement	Procurement	3 months
Approval authority unclear	Update delegation procedure	Business Unit Head	1 month
BCP missing reconciliation procedure	Update BCP	BCM Coordinator	1 month

Actions should remain open until satisfactory evidence confirms completion.

 

Re-Testing

Where an exercise identifies a significant failure, Damanat should re-test the affected capability after corrective actions have been implemented.

This establishes the cycle:

Test → Failure Identified → Root Cause → Corrective Action → Re-test → Validate

A failed test is therefore not the end of the exercise process.

It triggers improvement and subsequent validation.

 

SAMA Regulatory Requirements for Testing and Exercising

The Saudi Central Bank (SAMA) Business Continuity Management Framework contains explicit requirements for testing.

The framework is currently identified by SAMA as In-Force, and its stated scope includes the banking sector, finance sector, payment systems/payment service providers and credit bureaus.

Section 2.9 – Testing establishes the principle that applicable Member Organisations should define, approve, implement, execute and monitor regular BCP and DRP tests.

The stated objective is both to verify that the plans operate as defined and to train employees and relevant third parties to execute them.

For BCP testing specifically, SAMA requires periodic simulation exercises at least annually. Scenarios should be appropriately planned, have clearly defined objectives, cover relevant functions, services, processes, locations or severe scenarios, and take cybersecurity scenarios into consideration.

Scenarios should also involve activation of the crisis management team. After individual tests have been completed, organisations should consider an integrated BCM test covering critical services, business processes and functions.

SAMA separately requires DR testing combined with BCP testing at least annually.

The test should evaluate the readiness and capability of the disaster recovery infrastructure supporting critical systems and generate recommendations for improvement.

Crisis management involvement is also expected.

 

SAMA Requirements Following an Exercise

SAMA's requirements extend beyond conducting the exercise itself.

Detailed results should be documented and should confirm whether exercise objectives were achieved and recovery resources were capable and ready.

Lessons learned and required improvements should be documented. Where a test fails, the root cause and remediation actions should be identified and tracked.

Importantly, when re-testing is required following a failure, the SAMA framework specifies that the defined re-test timeline should not exceed 3 months.

The framework also expects Internal Audit or a qualified external auditor to observe business continuity and disaster recovery testing as an independent participant, providing assurance over execution and results.

BCP and DRP test results should be reported to the BCM Committee, senior management and board.

For Damanat, these expectations should be built directly into the exercise methodology rather than treated as post-exercise administrative activities.

 

Translating SAMA Requirements into Damanat's Exercise Programme

For practical implementation, Damanat should establish the following minimum controls:

 

SAMA Testing Expectation	Damanat Implementation
Regular BCP and DRP testing	Maintain an approved annual exercise programme
BCP simulation at least annually	Conduct at least one suitable annual BCP simulation
Clearly defined scenarios and objectives	Maintain an approved exercise plan
Cybersecurity scenarios	Include cyber disruption in the exercise programme
Crisis Management Team involvement	Include escalation and crisis activation in advanced exercises
Integrated BCM testing	Progressively test multiple CBFs and dependencies together
DR combined with BCP at least annually	Validate technology recovery with business participation
Document results	Produce formal exercise reports
Validate recovery resources	Test people, technology, facilities and dependencies
Lessons learned	Conduct post-exercise review
Root-cause analysis for failure	Document causes rather than symptoms
Corrective-action tracking	Maintain an improvement register
Re-test following failure	Re-test within the applicable timeframe, not exceeding three months under the framework
Independent observation	Involve Internal Audit or qualified external assurance
Management reporting	Report results through BCM governance and senior management

This creates traceability between Damanat's exercise programme and the relevant regulatory testing expectations.

 

Testing and Exercising Deliverables

At the conclusion of the TE phase, Damanat should maintain, at minimum:

 

Ref	Deliverable	Purpose
TE-01	Testing and Exercising Methodology	Defines exercise approach
TE-02	Annual Exercise Programme	Establishes planned exercises
TE-03	Exercise Scenario Catalogue	Provides credible disruption scenarios
TE-04	Exercise Plan	Defines scope, objectives and participants
TE-05	Exercise Risk Assessment	Controls exercise-related operational risk
TE-06	Exercise Scripts / Injects	Supports simulations
TE-07	Observation Records	Captures performance
TE-08	Exercise Report	Documents results
TE-09	Lessons Learned Register	Records improvement opportunities
TE-10	Corrective Action Register	Tracks remediation
TE-11	Re-Testing Records	Demonstrates remediation effectiveness
TE-12	Management Reporting	Provides governance oversight
TE-13	Exercise Evidence	Demonstrates execution and participation

 

Completion Criteria for the Testing and Exercising Phase

Damanat should consider the TE phase effective when:

• an approved exercise methodology exists;
• an exercise programme has been established;
• Critical Business Functions are progressively covered;
• initial tests are conducted;
• advanced exercises are introduced as maturity increases;
• scenarios reflect RAR findings;
• BIA recovery objectives are tested;
• BCP activation is validated;
• Crisis Management involvement is tested where appropriate;
• technology recovery is integrated with business recovery;
• critical suppliers are included where relevant;
• RTO, RPO and MBCO are validated where practical;
• results are formally documented;
• lessons learned are identified;
• failures undergo root-cause analysis;
• corrective actions have accountable owners;
• re-testing is performed where required;
• results are reported through appropriate governance; and
• plans and strategies are updated based on findings.

 

Building Exercise Maturity at Damanat

Testing and Exercising should evolve as Damanat's BCM capability matures.

An illustrative maturity progression is:

Year / Stage 1 — Validate Components

Component tests and call notification exercises.

Year / Stage 2 — Validate Plans

Walkthrough exercises for individual Business Units.

Year / Stage 3 — Validate Interdependencies

Integrated tests involving multiple functions.

Year / Stage 4 — Validate Decision-Making

Complex simulation exercises.

Year / Stage 5 — Demonstrate Operational Capability

Controlled live exercises.

This does not mean Damanat must wait several years before conducting advanced exercises. The progression should reflect actual capability, risk and regulatory requirements.

The key principle is to avoid moving directly into highly complex exercises before fundamental recovery capabilities have been validated.

 

Testing as Evidence of Organisational Resilience

Testing and exercising provide evidence that Damanat's BCM arrangements extend beyond documentation.

A mature BCM capability should be able to demonstrate:

Plan Exists

→ Personnel Understand It

→ Resources Are Available

→ Procedures Can Be Executed

→ Recovery Objectives Can Be Achieved

→ Weaknesses Are Corrected

→ Capability Is Re-tested

This evidence is valuable not only for BCM management but also for senior management, internal audit, regulators and other assurance stakeholders.