Exercising Business Continuity or Disaster Recovery Plans

[deephsd]

I wanted to get an opinion from the forum on what qualifies as a business continuity test exercise. We are into providing mortgage services at St. Paul, MN have relocated one of our offices within the same city over the weekend. I'm part of the organization's BCP and compliance team and we are debating internally whether we can showcase the relocation as a DR test since we have not conducted one for some time now. Your opinions will be extremely helpful.

Thanks & Regards

 

[Jen Kirley]

Re: Question on Exercising Business Continuity or Disaster Recovery Plans

Good day Deephsd,

In order to perform as a test of continuity exercise, I would expect the relocation was performed in the same sort of manner as would be carried out in a manner in which it would for the purpose of maintaining continuity. That is: accessing, transporting and setting up the equipment and materials as you would in a situation where continuity called for the actions. Plans can, and should be made ahead of time to shorten the time and funds needed to set up this contingency site. Those plans should be the ones used for this site setup in order to accurately call it a drill.

 

[deephsd]

Re: Question on Exercising Business Continuity or Disaster Recovery Plans

Yes that's right. We have planned all the phases of the move like the transport, setting up of equipment's, Identifying roles, communication plan to the stake holders etc.

We were not sure if this can be showcased as a test exercise.

Thanks,
Deepak

 

[AndyN]

Re: Question on Exercising Business Continuity or Disaster Recovery Plans

Did you perform any internal audits while it was being performed? It's one thing to have a plan and to *think* the plan was being implemented in this (great opportunity) to test the plan, but it occurs to me that an internal audit could have also been performed at the same time to determine if the plan was being followed. Also, once the move was completed, the results, compared to the plan, plus the audit results could be offered up as discussion under management review.

Were those things done?

 

[Richard Regalado]

Re: Question on Exercising Business Continuity or Disaster Recovery Plans

I second Jennifer's reply.

To add to that a BCP test should have established objectives. Based from experience, objectives should be taken from the BCP that is to be tested. In your case, the BCP for the relocation to another site. Possible objectives would be measuring if the drill meets the RTO, MAO, resource requirements, budget, etc.

I would not do an internal audit (Cl 9.2 of ISO 22301) while you are doing the BCP testing. But, I would be nominating independent observers to provide useful feedback during the post-test briefing.

Now, to not put what you did to waste, you can do a post-test briefing and highlight what you need to have for the next test to make it more comprehensive and encompassing.

Regards,
Richard

 

[deephsd]

We did not do an internal audit, but we are assessing the planned activities against the Actual carried out activities to ensure we have met our RTO requirements.

Thanks,
Deepak