Exercise programme
Run a planned programme of exercises and tests with stated aims and scenarios, cover every strategy over the cycle, report formally, act on the findings and review the programme itself.
01What applies
Put in place and keep up a programme of exercises and tests that shows, over time, that the continuity strategies and solutions work. The exercises must fit the continuity objectives, rest on carefully planned scenarios with clearly stated aims, build teamwork, competence, confidence and knowledge among those with response roles, together confirm the strategies and solutions over time, lead to formal reports with outcomes, recommendations and improvement actions, be reviewed with continual improvement in mind, and take place at planned intervals and whenever significant change happens. The organization must act on what they show.
02Why it matters
An exercise is the only evidence that a solution works. The clause makes the programme the unit, not the single drill, because one comfortable scenario proves very little. It also asks the programme to build people, not only test systems. The formal report and the action tracking are what turn an exercise into improvement rather than theatre.
03What good looks like
Write a two-year programme with one aim per exercise and a coverage map showing which strategy each exercise tests. Vary the scenario: people, premises, supplier, cyber, severe weather. Set the aim before the date. Write the report within a week, with actions that have owners. Track the actions to closure and test the closure in the next exercise.
04Evidence an auditor asks for
Ask what the last exercise was designed to prove. If the answer is that it was the annual exercise, there was no aim.
| Evidence | The record |
|---|---|
| Programme | A programme showing scenario, scope and interval coverage over time |
| Aims | Aims and objectives defined before each exercise |
| Reports | Formal post-exercise reports with outcomes, recommendations and actions |
| Closure | Action tracking to closure with evidence of the resulting change |
| Coverage | Coverage analysis showing every strategy and solution is validated in the cycle |
05Where it commonly fails
- The same comfortable scenario rehearsed annually
- Exercises run without defined aims, so they cannot pass or fail
- Post-exercise findings recorded and never actioned
- Programme covers ICT recovery only, leaving people, premises and suppliers untested
06What to do before the estimate
Draw the two-year coverage map. Mark every strategy against the exercise that will test it. Fill the empty rows.