By Matt Hinton, Partner, Crisis and Security Consulting, Control Risks
The business continuity exercise – also known as simulations, tabletops, semi-lives, or drills – has always been a core component of crisis management and business continuity as a way to practice and perfect the plan before the real thing happens.
Historically, crisis and business continuity management exercises have been done for several different reasons:
- Regulatory mandate: Companies in regulated industries (e.g., financial services) must exercise to remain compliant.
- Standards: Commonly regarded crisis management and business continuity standards always include exercising as a “best practice,” compelling companies to follow suit if they want to align with those standards.
- Training: Exercises provide a forum for leaders to better understand their roles and responsibilities during a crisis/disruption and build “muscle memory” to aid in responding to future crises/disruptions.
Despite widespread adoption at companies of all sizes and in all industries, crisis and business continuity exercising has often been seen as something participants have to do rather than want to do. People must be compelled to participate, requiring nudges from senior leadership to get the exercise scheduled and executed.
The reason is often time. People have been forced to wear multiple hats at organizations and are expected to do more with less. They don’t have the time for what they consider to be an extra activity or purely as a compliance exercise. Or they don’t see any tangible outcomes to justify the time commitment. Whatever the reason, until a few years ago, exercises at many organizations were just another box to tick.
But things are changing. Crisis and business continuity exercises are getting new respect as they transform into a strategic tool that enables true business change.
Driven by an Onslaught of Disruption
Over the past few years, organizations have had to manage through an unprecedented number of crises, one after another – and sometimes simultaneously. COVID-19. Protests occurring in new places. Manufacturing and transportation issues stunting the global supply chain. Increases in cyberattacks. Workplace violence events increasing as workers transitioned back to offices. Russia/Ukraine. The Middle East. The list goes on.
This onslaught of disruption has changed the mindset of many business leaders who recognized that they can’t afford to respond poorly to crises. They have started asking questions like “what is the next big one we’re going to deal with?” and “how do we ensure we aren’t caught flat-footed next time?” The answer for many companies is the business continuity exercise.
A New Model of the Business Continuity Exercise
Organizations are increasingly using crisis and business continuity exercising to understand how well prepared they are for potential future crises. These aren’t like the old model of exercises, which focused on improvements to things like team composition, better plans, or more training.
These forward-looking exercises focus on identifying true gaps in an organization’s readiness for the next “big one.” This is an important difference because many of these scenarios – especially those involving geopolitical conflict – require careful, proactive planning to put a company in the best position to navigate complex circumstances. Forward-looking business continuity exercises also can create a competitive advantage when peers aren’t thinking ahead.
Recent organizational changes resulting from exercises include:
- Changing legal structures across an organization’s global footprint to provide better flexibility should the company need to exit a country in the future
- Sourcing and procurement changes to reduce concentration risk and/or near-shoring to minimize potential impacts of global supply-chain disruptions
- Reevaluating banking relationships and arrangements to ensure geopolitical tensions won’t get in the way of companies receiving or sending money
- Geo-diversifying hiring strategies to reduce overreliance on any one region in the world
The change in how crisis and business continuity management software implementation is perceived has helped increase participation at all levels in the organization, boost investment in resilience-related capabilities, and give resilience professionals a rightful seat at the table when key decisions are made.
Tips for Effective Business Continuity Exercises
Of course, this new attention makes it even more important to get exercising right. Here are five tips to consider:
- Look forward instead of backward. Use scenario analysis to understand what emerging risks could significantly impact the organization in the medium to long term and draw on those scenarios as the basis for your exercising.
- Lean on experts. Leverage internal or external expertise to highlight the true impacts these scenarios can have to make it real for participants.
- Make the exercise engaging. No more page turns or bland slides. Use simulated media – traditional and social – actors, and more to captivate your audience.
- Leverage your tools. Practice using the tools available to you, especially if you have technology solutions that enable a more efficient and effective response to crises and disruptions.
- Always do an after-action report. If you don’t capture the findings of an exercise in a formal document and agree on who owns key actions – and hold them accountable for completing them – you will never get the most value possible from an exercise.
The future for the business continuity exercise is bright thanks to the shifting views of business leaders. Resilience professionals now have an opportunity to make a real difference to their organizations by helping executives capitalize on this powerful tool going forward.
Control Risks is a specialist global risk consultancy that helps to create secure, compliant, and resilient organizations in an age of ever-changing risk. The organization joined Riskonnect’s PartnerKonnect program in 2023.
For more on effective exercises, watch our on-demand webinar, Business Resilience: Best Practices for Effective Crisis Management, and check out Riskonnect’s Business Continuity & Resilience software solution.
