Spring World 2015

Conference & Exhibit

Attend The #1 BC/DR Event!

Fall Journal

Volume 27, Issue 4

Full Contents Now Available!

Effective Preparedness through Strategic Exercise Programs

Written by  Robert Burton & Thomas Chiginsky Wednesday, 21 November 2012 18:19
  • Timing: have a plan, but don’t wait for it to be ‘perfect’ before beginning an exercise strategy

    • Successful drills and exercises are built from functional crisis, emergency and business continuity management plans. What does that mean? An effective exercise is the result of plans that are usable, in-progress, and somewhat up to date. So if the last person to touch the plan retired five years ago, it’s best to put a hold on any drills or exercises. Go back to the basics, re-draft the plan, and then think of an exercise strategy.

  • Clear objectives based on the business continuity plan

    • No plan is perfect, but it should at least reflect the critical elements of your company and industry. It needs to account for those areas susceptible to crisis in order to mitigate vulnerability. Also, objectives need to be clear when deciding on exercises and drills: does our company have critical assets in a particular location? How does the plan mitigate risks there? Maybe it is time to test the supply chain to see whether employees and the plan can handle a blow to key assets.

  • Find the right venue and partner to fill weaknesses in expertise

    • Sometimes it’s hard to know when in-house crisis management planning needs to make room for outside experts. In order to get a clear action plan for improvement, it’s best to have a dedicated resource to run company exercises. Yet some crisis management consultants will perform no better than in-house talent. An expert , however, will understand what to ask and how to build scenarios that test your enterprise the right way. And if you have clear objectives, you can more quickly weed out internal and external ‘non-experts’ from your team.

  • Scenario planning to actually challenge participants

    • The term ‘powerpointless’ didn’t come from nothing. Every industry has training sessions built from static slides—we’ve all sat through them. Beyond one or two catch phrases, most employees walk away little actionable improvement. While good scenario planning builds upon clear test objectives, excellent scenario planning takes objectives and creates believable, timely simulations to bring out the worst and best in teams and plans. We’ve seen firsthand how companies run drills and completely miss a key scenario element—such as the growing influence of social media—or botch the exercise by excluding individuals.

  • Evaluation standards for transparent results

    • Clear objectives create clearly measurable results. It’s that simple. Benchmarks provide a clear-cut way to analyze critical components of the plan and its participants, both during and after the exercise. A thorough analysis will not just look at the scorecard of performance versus metrics; it will also bring in outside expertise to suggest best practices and next steps for improvements.

There’s a common misperception in the crisis management & business continuity world about drills and exercises. Many businesses look at exercises as a sprint—holding one-day sessions and checking boxes on yearly prevention planning to-do lists.  But corporations don’t operate in sprints.  They don’t start up and die off quickly, even in today’s economy. Enterprises build themselves to run for the long haul: they are marathoners.  Like a marathon athlete, they need to plan far in advance, practice strategic training, and set milestones.  Of course, training for a race is different than training for a crisis, but the point to consider is preparedness. As such, it’s time to challenge the “sprinter” approach to crisis management and begin thinking about strategic exercise programs that are based upon a long-term, holistic perspective for corporations.

Because industries face uncertainty in today’s economy, business continuity professionals—now more than ever—argue for creative and unique approaches to planning for resiliency. After managing hundreds of corporate war games (and earning the buy-in of senior leadership), we’ve developed five pointers for strategic exercise programs.

1. It’s not enough to simply exercise. It’s a matter of what is exercised.

The value derived from testing a company’s emergency and business continuity plan is tied to the clarity and quality of the testing. In other words: garbage in is garbage out. A mere checklist of exercise “to-do’s” will probably not elevate preparedness, nor highlight areas of improvement. As William Gouveia shared in the DRJ Summer 2012 edition, organizations can have plans without true resiliency because their processes are unexamined. We understand this is difficult to do for those close to the plan. However, it is imperative to develop a critical and objective eye. Step back from the plan, and review it.

Be prepared, though, to accept that the plan is imperfect. Don’t wait to cross every t before initiating your strategic exercise plan. Also, create a list of clear objectives by considering the value that should be derived from a singular exercise, as well as from the overall exercise program.

Once there is a clearly defined list of objectives, it’s time to be honest: can these exercises, drills, or scenarios be created in-house? Can they provide results to meet the objectives? Knowing strengths and weaknesses is essential to success. Seek outside consultants if necessary; they can effectively lobby for an exercise plan and even help create a realistic set of scenarios. Of course, there’s the old joke that consultants “take your watches, tell you what time it is, and then charge you for it.” In no way should that be the case! Do the necessary research to find the experts who will work in partnership with you to reach your goals.

Whether outside help is brought in or the work is performed from within, scenario development should be the next important consideration. Besides the specific objectives, a realistic set of scenarios must take into account the company’s culture, region, organization, environment, and team. Another necessary key to creating an effective exercise is the format of the exercise, which in turn impacts likely scenario choices.

2. The type of exercise impacts what participants learn.

Determining the right exercise format is a key part of effective exercise planning. There are three general exercise categories: tabletop, functional, and full. The predetermined objectives, geographic location of participants and observers, and the demands of daily business all contribute to the format choice. Below, we developed an Exercise Format Grid to gauge exercises based on enterprise needs.

Exercise-Grid1

Figure 1: Exercise Format Grid

3. Choose exercise participants wisely.

This requires more than picking people with titles—it means looking across the entire enterprise. Systems theory, born out of Industrial and Organizational (I/O) Psychology, says the total health of an organization gets impacted when even one small area is weak. Thinking about how an enterprise functions means considering the whole rather than just the parts. Where are the potentially costly gaps in capabilities? Is it due to certain employees, or the plan? Both? Testing employees across divisions and studying the aggregate result will reveal the true health of a company.

It’s important to note here that senior leadership provides critical influence when it comes to employee participation. The exercise program will more quickly gain acceptance from the employee base if senior leadership communicates enthusiasm and support for the program. Researchers from I/O Psychology, business, and technology fields often note that for enterprise programs or cultural shifts to be effective, the drive must come from organizational leadership. Thus, senior management participation is ideal. If they cannot attend due to schedule demands, leaders should—at minimum—indicate support for the exercise program.

Recognized exercise expert Kathleen Lucy, noted in her recent DRJ article the importance of “bench depth” in an exercise, which comes from having as many employees as possible participate. Also, to achieve an overall representation of your actual company, attention must be paid to the mix of employees involved in the exercise. This can be accomplished many ways: divide and conquer department by department, or set up exercises by partitioning teams from across the enterprise. Critical areas that should always be involved in exercise programs include:

  1. Operations

  2. Communication

  3. Management (Mid to Senior)

  4. Critical Vendors

  5. Supply Chain

  6. Technology

Put simply, consider the entire organization when setting up a strategic exercise plan. Think horizontal as well as vertical.

4. Practice with the right frequency for optimal results.

The question of when to have an exercise depends on objectives, of course. Quite frankly, a one-time exercise will accomplish little. However, this doesn’t mean companies should do a blast of training in one fell swoop, either. It’s about setting an exercise program strategy—with the right mix of exercises and drills—at the right intervals. To go back to our initial analogy, this is marathon training. Elite marathon athletes run a variety of distances and speeds; they also integrate cross training with weight lifting, cycling, swimming, etc.

Of course, exercise programs are an investment. And like any good investment, some of the expense must be paid up front before any value can be derived. We’re conscious that exercise programs can seem costly to an enterprise. However, we’ve all seen the price companies pay when a crisis finds them unprepared. Exercise programs should be the right balance of capital and time. With clearly defined objectives at the start, companies can more comfortably measure the investment against the results. This can’t be easily quantified with a one-off training session, or a predictable annual exercise.

After considering the investment and the objectives, it becomes easier to determine when certain exercises should take place and with what frequency. Let’s pretend Company X needs to focus on four key areas: supply chain, communication, senior leadership, and operations.  To do this effectively, it will involve 150 employees in three different locations. The geographic spread and specific objectives of Company X guide the plan for three tabletop exercises, one functional exercise, and one full-scale exercise. This mix gives economic and geographic flexibility while accomplishing long-term learning objectives. Though it is hypothetical, this scenario shows it is possible to balance time and budget costs in planning.

5. Where you practice impacts your experience and results.

When planning an exercise program, environment plays an important part because location impacts the effectiveness for attendees. It can also affect evaluation and future recommendations. For example, if an international company wants to run a realistic scenario for 100 of its employees, should they all gather in the large auditorium at company headquarters? A virtual solution would allow teams to be geographically spread out, just as they would be during a real-life event. More and more, global corporations are incorporating virtual solutions as part of their exercise program strategy. A real-life environment is key—crises don’t occur on PowerPoint slides! Note the Exercise Format Grid again, with Virtual Tabletop highlighted.

Exercise-Grid2

Figure 2: Virtual Tabletop solutions provide cost effective exercise value

To summarize, organizational resiliency depends on not only a plan, but on a strategic process, which tests, measures, and evaluates preparedness across the entire enterprise. Just as a marathoner strategically trains to prepare for a race, an enterprise needs to implement training, drills, and exercises as part of its business continuity strategy. With the proper goals, scenarios, attendees, locations, and frequency, an enterprise can be prepared for what comes. That’s the value in strategic exercise programs.

RobBurtonRob Burton has been leading groups and teams since his early days in the United Kingdom Special Forces; he is currently a co-founder and director of risk management at BWP Global. Burton has been featured on FOX News and has authored several articles for industry publications including the Disaster Recovery Journal. He can be reached: rob.burton@bwpglobal.com


TomChiginskyTom Chiginsky is an internationally recognized expert in internet computing, content delivery and collaboration. He is a co-founder of BWP Global, where he also serves as chief technology officer. Tom has also participated in international exercises focused on turning global data into knowledge to interdict and reduce the threat of WMD. He can be reached: tom.chiginsky@bwpglobal.com