How do you use scenarios and simulations to validate your business continuity plan assumptions?

When you are writing a BC plan, it is hard to imagine "what" will happen and how you should respond in a vacuum. Realistic and feasible exercise narratives allow the exercise player to "see" themselves in the experience and then pull out their plans and see if they provide guidance and value in that situation. Creating well-designed exercises is the most important job of any BCM professional – it helps prepare the player to respond in a crisis.

You need scenarios since we have a hard time preparing for something without context. A scenario helps you to set the context. It also helps you to stress test your assumptions.

Developing scenarios and simulations allow the opportunity to validate plans and identify faulty assumptions in a more low stress learning environment. It is important to stress the importance of testing, and emphasize the importance rather than it becoming a compliance activity. For me specifically testing adds familiarity to teams in the context of the scenario/simulation for the team to work together and build familiarity. Confidence is the most important aspect in a successful disaster response. Focus on clear objectives so that measurement of success or areas of improvement is more clear.

Using scenarios and simulations is a valuable approach to validate business continuity plan assumptions. Begin by identifying potential risks and threats to your business, such as natural disasters, cyberattacks etc. Develop realistic scenarios based on these threats, incorporating various factors like the scale of the incident and its impact on different business functions. Simulate these scenarios with key stakeholders to test the effectiveness of the continuity plan. Evaluate how well the plan addresses challenges, maintains essential operations, and ensures data security. Use feedback from simulations to refine the plan, making it more resilient to different circumstances. Regularly update scenarios to reflect evolving risks.

Teach all the stakeholders how to do this... Define the (contingencies within the) system… 1 Define the system needs 2 Define the system 3 Decompose the system 4 Perturb system 5 Develop and define risk criteria 6 Design adverse progressions 7 Define risks with minimal controls 8 Design controls to enable acceptable levels of risk 9 Rank risks and address high to low risks 10 Develop and design system monitoring: early detection, isolation, correction, contingency and recovery 11 Continually validate and verify risk controls 12 Monitor the system and revise analyses due to system dynamics....

Scenarios are one important step which helps us stress testing our assumptions. We can even go further and use simulation tools (e.g. Agent Based Modelling) to stress test it, run statistical checks and many things more.

Scenarios and simulations play a vital role in business continuity planning by exposing vulnerabilities and testing response mechanisms. They allow organizations to stress-test their plans, assess their ability to adapt to changing circumstances, and validate the viability of recovery strategies. By experiencing potential disruptions in a simulated setting, teams can enhance their preparedness, foster collaboration among stakeholders, and ultimately increase the resilience of the business in the face of unexpected crises.

The objective is not to find mistakes, but to find gaps or opportunities for improvement (because no person, no plan, no organisation is perfect in the world!). Scenarios and simulations help us to move from theory towards practicals/ reality before we start touching, moving, feeling real things, or face a real incident.

Simulations and scenarios are key for business continuity, serving multiple purposes: They test and refine plans in a safe setting, revealing areas for enhancement. They prepare employees for their roles during crises, boosting response effectiveness. These exercises also spotlight critical internal and external dependencies, guiding risk mitigation strategies. Additionally, they improve communication channels, ensuring efficient information flow during disruptions. The insights gained drive the continuous advancement of resilience and recovery strategies. Regular practice with these tools significantly reduces the potential impact of disruptions on operations and financial health.

Siempre hay opciones a mejora y solo probando nuestros planes podremos descubrirlos. La practica hace al maestro, el equipo de recuperación se sentirá con más confianza en un evento real.

You first need to understand WHY you are doing this exercise; in other words – what are you trying to get out of this? Examples might be to orient a team to a new plan, expose vulnerabilities not yet planned for, or to see if the plan is complete. Answering the “whys” creates the exercise goal and objectives, points you towards the best narrative, and tells you who the players should be and what type of injects you will need. We then select the best narrative and work with a small group of in-house experts to fine-tune it. Finally, to develop the injects, we work with a small team of professionals in the organization who, along with my team, write highly specific injects. That makes the exercise come alive for the players!

Begin by pinpointing essential functions and assessing risks like cyber-attacks or natural disasters. Craft detailed narratives for various disruptions, setting clear objectives for each scenario. Engage all relevant stakeholders in scenario development and execution for comprehensive input. Prepare materials such as role-play instructions to facilitate simulations. Conduct these exercises, capturing feedback and observations. Post-simulation, analyze outcomes, discuss improvements, and update continuity strategies accordingly. Continuously repeat this process to keep plans current and staff adept at managing disruptions. This systematic approach bolsters organizational resilience and preparedness.

In addition to the points mentioned in the article, 'who' should write the scenario and who should be the facilitator - are important questions to be answered. And simply put, a person who knows the business of the business on top of knowing Business Continuity Management. A scenario may be designed, and developed by a team, but delivery (facilitaion) is generally one person. This person may be out of the design and development teams. A good trainer is a good candidate. The facilitator needs to be a good communicator, a good orrator. He/ she may be supported by someone taking the notes - the scribe.

To validate business continuity plan assumptions, scenario building, simulations, stress-testing and refinements are instrumental. Firstly, develop hypothetical but realistic scenarios that could disrupt normal business operations (e.g. natural disasters or cyberattacks). Then, incorporate these scenarios into comprehensive simulations that mimic real-life situations, involving relevant stakeholders & resources. During the simulations, observe how the business continuity plan is executed, identifying strengths and gaps/ weaknesses. Lastly, gather feedback from participants (stakeholders, leadership team, mid and senior level managers) to refine the plan, ensuring that it aligns with actual operational needs and is robust.

In my experience, the best scenarios are a result of knowing the players, processes, and documents intimately which allows one to create scenarios that push or challenge people/processes/docs that might appear to be OK on paper.

After we have done one basic tabletop, we move the teams to a more interactive format. We stop giving the narrative and injects using slides. The narrative is ideally presented by the in-house person who would really give the status and the injects are delivered via a paper form to just the intended person, by email or by phone – as it really would happen. This makes them recipients think, does anyone else need to know, who do I tell, etc? No one in a crisis stands before the audience and delivers it all in a clean, packaged format! Why exercise that way? We also create news videos that look like the real thing and allows us to push the rep and brand issues

The selection of an appropriate scenario is a good challenge. The current approach (after Covid-19 Pandemic and due to increasing Operational resilience demands) is to test 'rare but plausible' scenarios. And as I have always said, the exercises must be closed only after the report is written, approved, actions taken, and effectiveness checked (e.g. by running that portion of the scenario again). I am putting my experience of having gone across companies, countries, and industries in various roles (like auditor, assessor, tester, trainer, consultant etc.) in writing these recommendations.

There are a variety of definitions of an "effective" exercise. In my experience, some organizations define effective as (simply) conducting an exercise. Others want a time stamp on certain activities. Others want something else. If your program espouses certain attributes, then those should be measured and tracked.

Using scenarios and simulations effectively involves careful design to reflect realistic threats. Conduct simulations with clear objectives and guidelines in a controlled environment. Encourage active participation and collaboration between teams during the simulation. Debrief participants afterward to gather insights and identify areas for improvement. Regularly review and update scenarios to remain relevant. These practices enhance readiness and resilience in preparing for potential disruptions.

I often align my scenarios with the phases of a incident and sometimes we only use 60 or 90 minutes, but focus only on activation or notification. Too many objectives often lead to exercises that are too long.

One should test as often as feasible. This is the best way to discover flaws in your plans. Of course this is time consuming, but when we talk about business continuity management (dealing with critical processes), we should invest the time.

Exercises are great for validating plans, training new teams, showing vulnerabilities and seeing if you are ready for a crisis. If you only do an exercise once a year, your team or plans won’t be as good as you would like when “the bad thing happens.” Ideally, two well-designed exercises will help to improve team and plan performance. I also encourage what we call “ripped from the news exercises.” Reading the newspaper, you will find an exercise on every page. Without a lot of preparation, announce at a team meeting – what would we do if XXX happens? And then walk through in real-time from the moment “it” happens till a logical conclusion. What would you/we do? Develop the habit of creating an “always ready” culture.

The frequency of using scenarios and simulations depends on various factors such as organizational complexity, risk profile, and resources available. Generally, conducting simulations annually or biannually is recommended to ensure readiness and validate assumptions. However, organizations in dynamic environments or high-risk industries may opt for more frequent simulations. Regular reviews of the business continuity plan and risk assessments can help determine the appropriate frequency of simulations to maintain preparedness and effectiveness.

We found that mapping the number of exercises to the criticality of the plan is helpful. The more critical the plan the more frequent the exercise. For example we do quarterly cyber security exercises.

How frequent your organization allows for exercises is often a direct correlation to the value the exercises bring. If the value is low, enthusiasm and support can also be low. If the value is high the support is usually high. Next week I'll be facilitating our Q2 Cyber Response exercise. We do them quarterly and always have full support from key participants.

For organizations in the Bay Area, I have found using the USGS HayWired Scenario very effective at validating plans against a probable 7.0 magnitude earthquake on the Hayward Fault. USGS provides a toolkit for exercises complete with engineering implications, societal consequences, among other tools like movies. The credibility of the data has proven effective to help participants in the tabletop come to the reality of what the actual impact of an earthquake would be. I conducted an exercise at an engineering and scientifically oriented company, with the CEO and his direct reports using the HayWired scenario. It made many in the room come to terms with significant potential loss exposure faced due to how we operated in the Bay Area.

What do you do with the exercise findings? A well-crafted after-action report is essential. It should be written in a timely manner – we promise our clients the AAR in no more than 10 days. Why? If you take too long, the world has moved on and you have lost the moment. Ideally, your program has a solid governance plan and structure. That is essential. Your BCM steering committee should be providing oversight to the program AND review all exercise AARs. That way, they can provide the “carrot and the stick.” They hear reports at their meetings to close all gaps and can provide accolades for success (carrots) and strong encouragement (sticks) to resolve open issues—a great incentive for teams to move forward.

Designing, Developing, and Delivering an Effective BC Test is an art - which can be learnt and mastered over a period. Storywriting, and storytelling are two very important skills needed in scenarios and simulations. The selection of participants in a scenario and simulation is as important as that of the scenario itself. The expectation today is to test 'rare but plausible' scenarios. The success lies in recording the outcomes (report) and closing the gaps found through the silmulation.

Continuity plan assumptions telegraph where and how your plans will fail. Stressing plans with these assumptions will validate that the impacts are truly within the organization's risk appetite. For example, one assumption may be that flooding will be below a 500-year level. Exercise a 500-year plus flood. What are the impacts? Are those impacts really acceptable? If not, change your plan and assumptions. Of course, some will choose to deny a flood of that level could occur - until it happens.