In many organisations, business continuity plans are written, reviewed, approved and carefully stored for compliance purposes. That may demonstrate that a planning process has taken place, but business continuity compliance is not the same as response capability.

A plan describes roles, processes, dependencies and recovery priorities. It does not prove that the organisation can apply them during a fast-moving disruption.

That proof comes through business continuity and crisis simulation exercises. Exercising allows an organisation to challenge its assumptions, practise its response and establish whether its plans provide useful guidance when people are working with incomplete information and under pressure.

What is the difference between compliance and capability?

Compliance typically establishes whether required plans, policies and governance arrangements exist. Capability concerns whether the organisation and its people can use those arrangements to achieve an effective response.

Both elements matter. Compliance can provide a useful framework and evidence of governance, while exercising gives the organisation confidence that its arrangements are usable and effective.

The limitations of paper resilience

Without exercising, the assumptions underpinning a business continuity plan remain largely unchallenged. Those assumptions may have been reasonable when the plan was written, but organisations, technologies, suppliers and risks change continually.

An untested plan may depend on:

• outdated contact details or unavailable personnel;
• recovery timescales that cannot be achieved;
• systems or facilities that are affected by the same incident;
• suppliers whose continuity arrangements have not been verified;
• communication channels that are unavailable or overloaded;
• levels of authority that are unclear or impractical; or
• information that cannot be accessed away from the normal workplace.

Plans can also fail for simpler reasons. A document may be too long, too generic or too difficult to navigate. If response teams do not know where to find it, are unfamiliar with its contents or cannot quickly identify the relevant guidance, they will default to memory, instinct and personal experience.

This is why Needhams designs business continuity plans as practical handrails rather than scripts. The plan should support structured thinking and adaptive problem-solving without attempting to predict every possible detail of an incident.

What happens when plans are not exercised?

The weaknesses created by a lack of exercising are often visible in the behaviour of the response team. Meetings become unstructured, priorities remain unclear and participants become drawn into solving whichever problem appears most urgent at that moment.

Exercising tests more than the written plan

A useful exercise does not simply ask participants to read through a document and confirm that they agree with it. It examines how the plan, people and supporting resources operate together.

The plan

Participants should be able to find the plan, navigate it quickly and identify the guidance relevant to the developing situation. Exercising often reveals duplicated content, missing prompts and procedures that are too complicated to follow during an incident.

The people

Exercises establish whether participants understand their roles, responsibilities and authority. They also help deputies and alternates develop the competence to respond when primary role holders are unavailable.

Decision-making

Exercises allow teams to practise setting objectives, assessing incomplete information, making time-sensitive decisions and recording the reasoning behind them.

Command and coordination

Strategic leaders can become drawn into operational detail during a crisis. This is sometimes described as the “long screwdriver” effect, where senior leaders reach down into operational activity rather than maintaining strategic oversight.

Exercising helps clarify which decisions belong at strategic, tactical and operational levels. Senior leaders can then focus on setting intent, defining priorities, allocating resources and managing important stakeholders while operational teams retain the freedom to implement the response.

Information management

A response team needs a shared understanding of what has happened, what is known, what remains uncertain and which actions are underway. Exercises test whether decision logs, action trackers, meeting agendas and situation reports support that understanding.

Dependencies and recovery strategies

A plan may assume that alternative premises, technology, suppliers or staff will be available. An exercise or operational test can expose conflicting demands, unavailable capacity and dependencies shared across several recovery strategies.

Why should teams use the plan during an exercise?

One of the most revealing exercise findings is that teams sometimes fail to consult their plan at all. Needhams has explored this problem further in Why do we never consult the plan during a crisis?

If the plan is intended to support the response, participants should be encouraged to use it during exercises. This allows the organisation to establish:

• whether participants know where the plan is stored;
• whether it remains accessible when normal systems are unavailable;
• how quickly relevant information can be found;
• whether checklists and prompts are useful;
• which parts of the plan participants ignore or work around; and
• where the plan requires clarification or simplification.

Repeated use also builds familiarity. Consulting the plan becomes part of the team’s normal response discipline rather than an additional task they are expected to remember during a real emergency.

What is the difference between an exercise and a test?

The terms are often used interchangeably, but they can describe different activities.

A test usually examines whether a specific component works. This might involve confirming that an emergency notification system reaches employees, starting a backup generator or recovering data from a backup.

An exercise normally presents participants with a simulated situation and examines how they apply plans, make decisions, communicate and coordinate their response. An exercise may include individual tests, but its purpose is usually broader.

Both are necessary. Technical tests can prove that individual resources function, while exercises explore whether those resources can be brought together as part of a coordinated organisational response.

Building a progressive exercise programme

A single annual tabletop exercise may satisfy a basic compliance requirement, but meaningful capability develops through repeated and progressively challenging activity.

The exercise programme should reflect the organisation’s risks, recovery priorities, staff competence and previous findings. It can then build from familiarisation towards more demanding scenarios involving multiple teams and external dependencies.

A progressive programme does not need every exercise to be large or expensive. Short, focused exercises can be used throughout the year to practise particular responsibilities, explore emerging risks or confirm that improvements have been embedded.

Needhams’ guide to the importance of a progressive exercise programme examines this approach in greater detail.

What makes a business continuity exercise effective?

An exercise should be designed around specific objectives rather than a dramatic scenario alone. The scenario provides the conditions, but the objectives determine what the organisation is trying to learn or demonstrate.

Effective exercises generally include:

• Clear objectives: the capabilities, plans, decisions or relationships being examined are defined in advance.
• Appropriate scope: the exercise is ambitious enough to be useful without becoming too broad to evaluate properly.
• A credible scenario: the disruption is relevant to the organisation and sufficiently challenging to expose weaknesses.
• Realistic participation: the people who would hold response responsibilities take part wherever possible.
• Structured exercise control: scenario information is introduced in a way that keeps activity aligned with the objectives.
• Independent observation: evaluators record decisions, behaviours, strengths and areas for improvement.
• A safe learning environment: participants can challenge assumptions and make decisions without fear that every mistake will be treated as personal failure.
• Formal follow-through: findings are converted into owned and measurable improvements.

ISO 22398 provides international guidance for planning, conducting and improving exercise projects and wider exercise programmes. It recommends adapting exercises to the organisation’s objectives, resources, needs and constraints.

How realistic should the scenario be?

A useful exercise should be credible enough for participants to engage with it, but demanding enough to expose meaningful weaknesses. If every resource remains available and every decision works as expected, the exercise may create reassurance without providing much evidence of resilience.

Scenarios should challenge important assumptions without becoming implausible or overloaded with unrelated problems. The aim is to create a severe but plausible disruption that gives participants meaningful choices and consequences.

Realism can be increased progressively through:

• time pressure and incomplete information;
• conflicting stakeholder priorities;
• loss of expected people, systems or facilities;
• simulated customer, regulator or media enquiries;
• unexpected consequences caused by earlier decisions; and
• participation from suppliers, emergency services or other external organisations.

How often should plans be exercised?

There is no single frequency appropriate for every organisation. Exercising should be risk-based and form part of the organisation’s Business Continuity Management System.

Many organisations use annual exercising as a baseline, but critical plans, newly formed teams or high-risk activities may require more frequent attention. Additional exercises should also be considered following:

• significant organisational or leadership changes;
• changes to critical services, systems, premises or suppliers;
• the introduction of a new or substantially revised plan;
• a real incident or near miss;
• the emergence of a significant new threat;
• regulatory or contractual changes; or
• previous exercise findings requiring validation.

For more detail, see How often should a business continuity plan be tested?

Turning exercise findings into capability

An exercise does not improve resilience simply because it took place. Its value depends on what the organisation learns and what it changes afterwards.

Exercise findings should distinguish between:

• problems with the written plan;
• gaps in training or participant competence;
• unclear governance or authority;
• weaknesses in recovery strategies or resources;
• failures in communication and coordination; and
• decisions that were reasonable but produced unexpected consequences.

Each agreed improvement should have an owner, target date and method of validation. Senior leadership should receive an appropriate summary and provide support where findings require investment, changes in responsibility or acceptance of residual risk.

The organisation should then test significant improvements again. This closes the learning cycle and establishes whether the action has genuinely addressed the weakness rather than merely changing the wording of the plan.

From passive assurance to active readiness

The real value of a business continuity plan lies in its ability to guide a structured, coordinated and confident response when disruption occurs.

Regular exercising challenges assumptions, strengthens teams and embeds effective ways of working. It gives leaders evidence that plans are usable, responsibilities are understood and response structures can operate under pressure.

This is how an organisation moves beyond evidence of compliance and develops genuine confidence in its continuity capability.