Maintaining the program and plan:
Testing, exercising, updating and reviewing

This section of the guide provides guidance for entities on how to maintain the business continuity plan. This involves:

• testing the plan;
• exercising the plan; and
• updating the plan.

It also discusses assurance through reviewing the business continuity program.

Maintaining the business continuity plan is essential to ensure it reflects the entity’s objectives, critical processes and resources, and an agreed priority for recovery. Testing, exercising, and updating the recovery process documented in the business continuity plan will provide management assurance that the plan is effective - that is, it will ensure continuity of business if critical processes are lost.

Realistic and robust testing and exercising will often reveal areas requiring attention. If test results do not reveal opportunities for improvement, entities need to examine the adequacy and realism of their tests.

Testing the plan

The terms ‘test’ and ‘exercise’ are sometimes used interchangeably in a business continuity context. However, the term ‘test’ can have negative connotations, as it implies a ‘pass’ or ‘fail’ aspect. Subsequently, the term ‘testing’ is often used when a technological feature is being trialled. For example, testing the rebuilding of a server from back-up tapes. Testing can be one outcome of an exercise.

Exercising the plan

In better practice entities, an exercise program is developed so that over time, the entity gains assurance that the business continuity plan will operate effectively if and when required. This forward-looking exercise program is sometimes called a ‘universe’. The major components of the business continuity plan should be exercised annually and updated based on the results of each exercise. It is important each component be individually exercised. Also, where an entity has critical interdependent processes or has outsourced any activity, the exercise needs to involve the relevant external party or outsourced provider. Exercising can be disruptive - it therefore requires commitment from management to allocate sufficient resources.

Caution must be applied if exercising the business continuity plan as a whole. This type of exercising is resource intensive and may itself cause a business disruption event. It is normally only conducted by entities with a mature business continuity approach that has been exercised and developed over time.

_{The Workbook contains a checklist for maintaining the business continuity program. Click Here}