ISO 22301 business continuity exercises: from walk-through to full invocation, and the report that follows

What ISO 22301 requires of an exercise programme

A continuity plan that has never been exercised is a hypothesis. Clause 8.5 of ISO 22301:2019 exists to turn it into evidence. The organisation must exercise and test its strategies, solutions, plans and procedures, and the exercises must meet a few conditions that auditors check one by one:

• Consistent with your objectives. Each exercise relates to the business continuity objectives set under clause 6.2, such as a recovery time objective for a prioritised activity.
• Built on appropriate scenarios. The scenario is realistic for your context and each exercise has defined aims and objectives written before it starts.
• Run at planned intervals. There is a programme, not a one-off event arranged before the certification audit.
• Reported. Every exercise ends with a post-exercise report containing its outcomes, recommendations and actions for improvement.

Clauses 8.2 to 8.4 produce the BIA, the risk assessment, the solutions and the plans; clause 8.6 then requires them to be evaluated after exercises, incidents and significant change. An exercise puts the rest of clause 8 under load, and 8.6 records what the load revealed.

From walk-through to full invocation: the exercise formats

The standard does not prescribe formats. The five below are Sterling's recommended progression, ordered by how much of the real capability each one puts to work.

How to build an exercise programme that covers everything over time

Start from a coverage list, not a calendar: every plan, response team, site and solution selected under clause 8.3. Decide which format will exercise each item this year, and schedule harder formats only once easier ones are passed and their actions closed.

Add triggers to the fixed dates: a new site, a new outsourcing partner or a major system migration should prompt an exercise of the plans they affect.

A worked example: the first year for a two-site service operation

Consider a customer-service operation with two delivery sites, a prioritised activity with a four-hour recovery time objective and an alternate workspace agreed with a provider. A realistic first year looks like this:

The actions from each row feed the next, so the auditor sees a capability stretched, found wanting in places and improved.

Designing a scenario with aims, objectives and injects

Take the scenario from your own risk assessment under clause 8.2.3, not from the news. If the assessment rates a regional flood, a ransomware attack or the failure of a single-source supplier as the threats that matter, those are the scenarios that deserve rehearsal. Then write, before the day:

• The aim, in one sentence: what the exercise is for.
• Measurable objectives tied to the BIA: invoke within a stated time, resume the prioritised activity at its minimum level, reach named clients with an agreed message.
• Injects: timed pieces of new information (a key person unavailable, a supplier not answering, media enquiries) that stop the team following the script too comfortably.
• Evaluation criteria for observers, and control rules: who can stop the exercise and the limits that protect live operations.

Running the exercise day

Four roles keep an exercise rigorous. The facilitator runs the scenario and releases injects. The players respond as they would in a real disruption, using the plan. The observers record decisions, times and gaps against the evaluation criteria and do not intervene. The controller, often the same person as the facilitator in smaller exercises, protects live operations and can stop the exercise.

Close with a short, blame-free debrief while memories are fresh; people who fear judgement hide the weaknesses the exercise is meant to find.

The post-exercise report and what happens next

The report is the record clause 8.5 requires and the first thing an auditor samples. It states the scenario, aims and objectives; who took part; the outcome against each objective, with times measured; what went well; the weaknesses found; recommendations; and actions with owners and dates.

The actions then travel through the system. Changes to plans, contact lists and procedures are made under document control. Weaknesses in the BIA or the chosen solutions trigger the evaluation clause 8.6 requires. Failures against a requirement are handled as nonconformities under clause 10.1, with correction and corrective action. Exercise results are also an input to management review under clause 9.3, where resources that are still missing get a decision. The internal audit then checks that this chain was followed; our ISO 22301 internal audit guide covers how.

Where exercise programmes go wrong

• Only the IT recovery is tested. A data restore proves the RPO, not that people can deliver the service. Business teams need exercises of their own.
• The scenario is written to be passed. An exercise with no weaknesses found teaches nothing and persuades no auditor.
• Actions are recorded and forgotten. Open actions from last year's report are a finding waiting to happen.
• Suppliers stay outside. Where a prioritised activity depends on a provider, its role belongs in at least one exercise.
• Results never reach the BIA. When an exercise shows a recovery objective cannot be met, either the solution or the objective must change; our business impact analysis guide explains how to revisit it.

ISO 22301 business continuity exercises: questions buyers ask