Successful business continuity exercises and creating exercise scripts

A business continuity exercise takes team members through different disaster recovery scenarios to test if they are fully prepared for an emergency. This tip describes how to set up a successful BC exercise.

What you will learn in this tip: Exercising business continuity (BC) and disaster recovery (DR) plans is probably...

one of the more challenging activities in the business continuity process. While it's a simple matter of collecting team members around a conference table and walking through a plan to see if it makes sense, it's a different matter to test it in a potential emergency situation. When creating a business continuity exercise based on a real-world scenario, such as a fire, earthquake, hurricane, or hostage situation, you must think in terms of what might really happen, then translate that into a storyboard, similar to the process used in developing movies and animated cartoons.

Occasionally there is confusion about the difference between a "business continuity exercise" and a "business continuity test." The terms might be used interchangeably, but they can differ in terms of activities. For example, a test can be a series of actions to verify that a system functions properly when subject to a load. Conversely, an exercise could mean a sort of "dry run" that validates procedures and team responsibilities prior to a formal operational test.

In a business continuity exercise, you must outline a "story" with a logical sequence of events. These events include the following: event occurs, initial impact, initial response, continuing impact, continuing response, resolution launch, resolution response, closure and final resolution. Once the exercise is outlined, you can begin creating a script to flesh out the storyboard.

Building the business continuity exercise script

Depending on how much realism you want to build into the business continuity exercise, you can prepare a basic script that will be presented to the exercise team at the start of the exercise. You may also want to prepare some "injects" that suddenly change the nature of the scenario, forcing the team to adjust its response and maybe even modify the plan.

As with any story, there is a beginning, middle and an ending. Build your storyboard along the same principles. In this example scenario, we will focus on the impact of a major hurricane.

Impact of a major hurricane




1. Activities leading up to incident e.g., weather reports


1. Impact on staff, e.g., people getting injured from falling debris or high winds


1. Staff injuries are minimal but two key techs are injured


2. Hurricane moving toward the area

2. Damage to buildings and other assets


2. Winds decreasing


3. Local preparations being made


3. Sudden loss of power to site


3. Roof on a storage building blew off, damaging supplies


4. Initial reports of damage from high winds and rain


4. Windows burst from high winds


4. Heavy rains persist but winds decreasing


5. Hurricane strikes area with 120 mph winds



5. Less wind and rain; staff can go outside to assess damage


Once you have agreed on the storyboard, begin expanding the basic structure to include additional events for added realism. Portray how the event affects people of all ages, including children, the elderly, and people with special needs. Describe nearby medical facilities, such as hospitals and nursing homes. Address the technology, buildings, surrounding neighborhoods and transportation systems. And be sure to note transportation systems, area land forms such as rivers, hills and forests, critical infrastructures such as utilities and food supplies, and general business processes.

Get creative with injects, so that the exercise team can learn to think quickly and respond intelligently to rapidly changing situations. Design the exercise so that the unpredictability of disasters is perhaps their most predictable thing.

The following script is from a hurricane exercise.

Hurricane BC exercise script

Time Situation Action

Thursday 1558

Inside the plant

Local commercial power disappears from damage to a transformer caused by Hurricane Kate; facilities initiate the diesel generator; water pours into the plant area; employees use cell phones to communicate status.

Thursday 1600

Outside the plant

Kate continues creating havoc in the region; all sorts of debris have been deposited in the parking lot and around the building site.

Thursday 1610

Plant parking lot

A large tree uproots and falls across the plant's entrance, blocking access to the site.

Thursday 1623

Plant manager and staff

Communicate regularly via cell phone on status of plant; there is a lot of water in the manufacturing area, raw materials storage area, and in the offices.

Thursday 1630

Local TV and radio

National Hurricane Center reports that Kate has been downgraded to a Category 1 storm; the storm's path has shifted to a northerly heading which means the eye will not pass over the region where Springfield is located.

Thursday 1645

Outside the plant

Winds have reduced to about 40-45 mph; the worst of the storm appears to be over.

Thursday 1700

Inside the plant

Emergency diesel generator operates normally, maintaining power to the plant; plant manager advises senior staff to be ready to start damage assessment.

Thursday 1715

Outside the plant

Winds have reduced to about 30-35 mph; clouds are beginning to break in the distance.

Thursday 1715

Facilities manager

Sets up makeshift command center in parking lot using his SUV to provide meeting area to start assessing physical and structural damage; contacts portable office firm to ship a temp office to site.

Key players in the BC exercise

If your BC exercise budget is large enough, you may be able to invite emergency response and law enforcement professionals to the exercise. Major national and regional exercises, such as the top officials (TOP-OFF) series, typically have hundreds of volunteers, many serving as victims in exercises depicting events such as earthquakes.

For those with minimal budgets, feel free to enlist other employees from within the company. If the exercise addresses a technology failure, only a few people may be needed. By contrast, if the exercise simulates the aftermath of a severe natural disaster, it may be useful to expand the number of exercise participants to add more realism. For example, exercise participants role-play as company executives, department managers, technical staff, and other functions. If the test is to be made more realistic, soliciting participation from actual company leaders is worthwhile and ensures that management is fully engaged in the BC program. It may also be worthwhile to invite members of the first responder community (e.g., police, fire, EMT, office of emergency management) to participate in the exercise. If you are concerned about possible media presence and inquiries, invite someone from a local network TV or radio station to participate.

Exercise participants will usually be in the same room but, depending on how rigorous and realistic you want the exercise, you may schedule participants to join the exercise at specific time points in the script. It's easy to speculate about the outcome of an event. It's much better to exercise the scenario in greater detail to see what might really happen.

Additional considerations for a business continuity exercise

Building a realistic business continuity exercise is very important. It must be as close to a real situation as possible. With that in mind, be sure to consider various collateral influences that can affect how the exercise (and the situation, in real life) progresses.

Other disaster recovery scenarios you might want to consider in your script include terrorist actions, lightning strikes, robberies, hostage takeover, kidnapping, union strike, product contamination, rail/aircraft accident and chemical spill.

You may also want to consider one or more locations for the scenario. If your organization occupies more than one building on a campus, for example, or has several buildings within a two-mile radius of each other, it may make sense to have a multi-site event instead of a single-site incident.

When preparing a business continuity exercise script, imagination and reality work hand-in-hand. Start with a storyboard, expand it to add more situations, build a script around the events, create some "bumps" that challenge the exercise team, and have other experts review the script before conducting the exercise.

About this author: Paul Kirvan, CISA, CSSP, FBCI, CBCP, has more than 20 years experience in business continuity management as a consultant, author and educator. He has been directly involved with dozens of IT/telecom consulting and audit engagements ranging from governance program development, program exercising, execution and maintenance, and RFP preparation and response. Kirvan currently works as an independent business continuity consultant/auditor and is the secretary of the Business Continuity Institute USA chapter and can be reached at [email protected].

Dig Deeper on Disaster recovery planning - management