Exercise

No executive wants to discover during a real crisis that the plan assumes people, systems or suppliers that no longer exist. Exercises exist to make that discovery cheap: a controlled rehearsal that shows whether plans, teams and decisions actually work against a scenario. The leadership decision that depends on them is one of confidence — whether the board can rely on the continuity capability it has paid for, or is holding a hypothesis. An unexercised plan gives assurance on paper and surprises in practice.

In practice an organisation runs an annual exercise programme of growing difficulty: discussion-based tabletops, functional tests of specific arrangements — switching to the backup site, restoring systems from backups — and full simulations. Each exercise has objectives, a scenario such as a warehouse fire, a ransomware outbreak or a supplier failure, an independent observer, and injects that force real decisions under time pressure. A common annual minimum is one tabletop for the crisis team plus one technical test of critical recovery, with results reported to executive management. Regulators in the Gulf increasingly ask for evidence of the programme, not just for the plan.

The typical failure is the comfortable exercise: the same gentle scenario every year, announced in advance, with the outcome agreed before it starts. It produces attendance records, not capability. In the ERGP programme, the exercise programme and its reporting are covered in module M4, Crisis management and decision making.