We have previously mentioned a lot on this blog about the importance of exercising emergency preparedness. What we haven’t addressed, however, is how to develop this type of programme. Obviously, every programme or plan will be influenced by the industry or nature of its business, but there are a few good practice guidelines you should consider. Don’t run before you can walk
Developing emergency preparedness exercises are a lot like starting a new fitness routine. The best way to succeed in the long term is to start gently and then build complexity as you go. To improve the business continuity of your organisation, it’s vital that you carry out exercises on a regular basis and stay consistent. Running random tests every so often won’t result in any improvement or change. Start off by making an achievable plan; the value isn’t in the document, but in the execution.
Exactly how you should plan and manage your exercise program will depend on your organisation and, of course, your business continuity policy, but from a general standpoint, the program should include training within the following areas:
- Risks: All scenarios identified as high risk.
- Response Plans: Make sure all plans and action cards are readily available.
- Facilities: The dedicated crisis room should be set up properly.
- Technical: Test all required technical systems and equipment.
- Procedures: Make sure the procedures and plans being used have been updated.
- Logical: Check that the procedures work together in a logical manner.
- Tools and equipment: Have a printed copy of the plan in case of system failure.
- Timeliness: Can the procedures achieve the required recovery time objective for each activity?
- Administrative: Are the procedures manageable?
- Personnel: Make sure the most suitable individuals are involved and that they have the required competencies, skills, authority, and experience.
- Resources: Identify the right resources in appropriate quantities.
- Information: Check that all necessary information is available in order to implement the plan.
The programme should involve opportunities for it to be reviewed throughout, but remember to think pragmatically and keep the exercise routines realistic for your business’ size, scale and nature. Try to make sure you cover all of the above points, but remember to not solely focus on just them.
Make the exercises realistic
The whole idea of emergency preparedness exercises is to train the employees to do their tasks under pressure. Although training must be conducted in a safe environment, it should by no means be a stress-free situation. To accurately assess your organisation's crisis management skills the exercises must be realistic and be taken seriously by the participants.
Look in getting support from people high up in the organisation who can devote themselves to the cause and spread the message so employees at all levels feel the responsibility to participate. Also consider including third parties like the police, the fire department, the government or suppliers.
The process of developing an exercise programme
According to the BCI-good practice guidelines, your process for developing an exercise programme should look something similar to this:
- Define the exercise programme goals, objectives and scope.
- Review past exercises (plans resources and activities) to identify areas excluded from previous exercises.
- Discuss with top management any perceived areas of weakness and exercising priorities.
- Review and assess current risks and threats.
- Decide on the types of exercise to be undertaken.
- Determine a budget for the exercise programme.
- Check the availability of required personnel, facilities and other resources.
- Create an exercise schedule that includes validating the business continuity arrangements of relevant interested parties.
- Submit to top management for approval.
- Identify any training requirements for exercise participants or planners, and integrate them into the exercise programme.
Sources: BCI: Good Practice Guidelines (2018).