← University
Testing and Exercising Your Continuity Plan
0 of 4

A business continuity plan dated 18 months earlier sits in a 3-ring binder on a shelf in the operations manager's office at a regional food processing facility in southern Alberta. The document runs to 47 pages and includes emergency contact trees, supplier backup arrangements, IT recovery procedures, and protocols for relocating production to a secondary site if the main facility becomes unusable. The plan was developed over 6 months by a cross-functional team that included the operations manager, the plant supervisor, the IT coordinator, and a consultant retained for the project. When completed, the chief executive signed off on it and the board of directors received a summary at their quarterly meeting. Since then, the plan has remained untouched.

The facility processes and packages agricultural products for distribution to grocery chains across western Canada. It employs 83 full-time staff and operates 2 production shifts, 5 days per week. The organization's primary risks include equipment failure, supply chain disruption, food safety incidents requiring product recall, and loss of access to the facility due to fire, flood, or severe weather. The continuity plan addresses each of these scenarios in varying levels of detail, with the most comprehensive section devoted to IT system recovery and the least developed section covering manual workarounds for production equipment failure.

In the months since the plan was finalized, several changes have occurred that the document does not reflect. The IT coordinator who helped develop the plan left the organization 8 months ago and was replaced by a new hire who has never seen the continuity documentation. 3 of the 12 suppliers listed in the backup arrangements have changed their terms or ceased operations. The secondary production site identified in the plan, a partner facility 140 kilometres away, underwent a change in ownership and the informal agreement that underpinned the relocation protocol was never formalized in writing. The emergency contact tree includes direct phone numbers for 4 employees who have since departed.

The operations manager has begun raising concerns with senior leadership about the plan's reliability. A near-miss incident 2 weeks ago, when a power surge caused a 4-hour production stoppage, revealed that staff were uncertain about escalation procedures and that the documented backup generator startup sequence did not match the actual equipment configuration. No formal exercise or test of the continuity plan has ever been conducted. The chief executive has asked the operations manager to propose a testing approach that can be completed within the current fiscal quarter without disrupting production schedules or requiring significant additional budget allocation.

Designing an Exercise That Reveals Real Gaps

Every business continuity plan represents a set of assumptions about how your organization will respond when normal operations become impossible. These assumptions cover everything from which staff members will be available to whether your backup systems will function as documented. The uncomfortable truth that many Canadian organizations discover only during an actual crisis is that assumptions rarely survive contact with reality. A continuity plan that has never been tested is not a plan at all but rather a collection of hopeful predictions about organizational behaviour under stress. The purpose of designing exercises that reveal real gaps is not to confirm that your plan works perfectly but to discover exactly where it fails before those failures occur during an actual emergency when the stakes are highest.

The practice of testing continuity plans through structured exercises has its foundation in several Canadian standards and international frameworks that Canadian organizations commonly adopt. CSA Z1600, titled Emergency and Continuity Management Program, published by the Canadian Standards Association, provides guidance on exercise design and evaluation. This standard, as of the date of authorship, emphasizes that exercises should progressively increase in complexity and that organizations should move from discussion-based exercises toward operations-based exercises as their programs mature. The Business Continuity Institute's Good Practice Guidelines, widely referenced by Canadian practitioners, similarly stress that exercises must be designed to validate assumptions rather than simply demonstrate compliance. The key insight embedded in these standards is that an exercise designed merely to succeed teaches nothing, while an exercise designed to expose weaknesses provides the information needed to strengthen organizational resilience.

That’s the free preview

You’ve reached the end of what’s open to read. The rest of this lesson is part of a $79 course — purchasing unlocks it, or sign in if you already have access.