Business Continuity Exercise Record

This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.

Exercising is required indirectly through management-system clauses requiring emergency arrangements to be established and periodically evaluated, and directly through ISO 22301 for organisations certified to it. Almost nothing prescribes the exercise format itself, which is why the record's value sits in what was actually tested rather than in the fact that a test happened.

No jurisdiction generally compels a private business to exercise a continuity plan by law. The duty comes instead from certification standards, sector regulators and customer contracts, which is why the practical driver varies more by relationship than by statute.

Most exercises are written to the scenario and scored to the form. The parts that decide whether the exercise actually tested anything are the ones the template does not force.

The continuity exercise record almost always exists and almost always scores well. The findings concern whether the scenario, the timing and the follow-through were real.

A cold-chain distribution site ran its annual continuity exercise as a desktop walkthrough: loss of the primary chiller unit, contact the backup refrigeration contractor, relocate stock to the secondary cold store. The facilitator, who also owned the continuity plan, marked contact details current, external support reachable, and the recovery time objective achievable. Findings Raised was recorded as zero, and the next exercise was scheduled twelve months out.

Four months later the chiller failed for real. The backup contractor named in the plan had stopped trading eight months earlier, a fact nobody had checked, because the desktop exercise had tested whether the plan named a contractor, not whether the number still connected to one. The site lost two days of cold storage capacity finding an alternative. The corrective action that followed was not a better contact list; it was treating every 'contact details current' answer as a claim to be tested by actually dialling the number during the exercise, not a box completed from memory.

The exercise is the easy part to schedule. What slips is whether findings actually change the plan, and whether the contacts and equipment tested this year are still the ones the plan names next year.

KnowEnviro

Holds the exercise record against the continuity plan it tested, flags when the plan's suppliers, layout or key contacts have changed since the last exercise, and routes each record to its owner.

KnowSafe

Cross-checks the exercise programme against the site's other drill and emergency records, so a continuity exercise and a fire or evacuation drill are not silently substituting for each other.

KnowComply

Tracks the CAPA references raised from Findings and Outcome through to closure and verification, rather than letting Action Required default to No because nothing was chased.

Ella

Watches management-of-change records for events that should bring the next exercise forward, and raises it rather than waiting for the calendar date.

Exercise

A planned activation of part or all of a continuity plan against a scenario, to test whether the arrangements work, distinct from a drill rehearsing a single physical action such as evacuation.

Recovery Time Objective

The maximum tolerable duration between a disruption and the resumption of the affected activity, against which the exercise's actual elapsed time should be judged, not assumed.

Desktop exercise

A discussion-based walkthrough of a scenario, testing decisions and communication without deploying people or equipment.

Full-scale exercise

An exercise that deploys the actual people, equipment and facilities the plan names, the only format that tests whether physical recovery works as described.

Debrief

The structured review immediately after an exercise, where findings are captured while the detail of what actually happened is still accurate.