Notification: Notification: Visit our COVID-19 resource center - Learn More >

Business Continuity Plan Exercise, Audit & Maintenance

DRI International (DRII) has developed an overview of professional practices designed to “assist the entity in the development and implementation of a BCM program.” In addition to being sound resiliency methods, these practices serve as a foundation for various DRII business continuity professional certifications.

With this resource as a guide, we at Send Word Now are briefly examining each professional practice, tying in relevant concepts surrounding emergency communications. Our eighth article in a series highlights DRII’s Professional Practice Eight: Business Continuity Plan Exercise, Audit and Maintenance.

In our business continuity professional practices blog post series, we’ve discussed valuable topics such as initiating a BCM program, risk evaluation and control and business impact analysis.

In this article, we’ll take a brief look at DRI’s Professional Practice Eight: Business Continuity Plan Exercise, Audit, and Maintenance. This practice includes several key steps designed to help ensure your company’s business continuity program is effective and up-to-date.

Business Continuity Plan Exercise, Audit and Maintenance

According to DRI International, the Business Continuity Manager’s roles in this phase are:
• Establish an exercise/testing program
• Establish a plan maintenance program
• Identify or establish appropriate industry and/or organizational standards
• Establish a business continuity program audit process
• Communicate exercise/test/audit results and recommendations

Once you build your business continuity plan, it is critical to keep the plan up to date. To do this, you should regularly exercise, audit and maintain your plan.

Exercise your plan. Your company has taken the required steps to have a business continuity plan in place. But if you do not regularly test that plan, you could be at risk during an actual emergency. Create a calendar of exercises (some announced, some unannounced), and implement accordingly.

Audit your plan. Set aside time to review your plan. You should examine any disaster recovery actions taken, and ensure the results from all scheduled tests have been addressed. Communicate those test results to appropriate stake holders and then compare your plan to other organizations to determine if your company meets industry standards.

Maintain your plan. Once your business continuity plan is in place, take care to keep it current. All key players should be properly educated and able to confidently execute the plan at any moment.

Emergency Communications Program Exercise, Audit and Maintenance

While emergency communications is only a slice of the overall business continuity process, many of the same exercise, audit and maintenance principles apply.

Exercise your emergency communications program. Notification services should be exercised regularly to ensure they are producing expected results and users are comfortable with system interactions. Notification services should definitely be exercised in conjunction with broad business continuity plan tests, but due to the infrequency of these events, managers should develop exercise plans to augment these large-scale tests. “Small” notification exercises can be implemented daily to a handful of administrators (you can automate this), while “larger” notification exercises should be conducted twice a year (quarterly is even better).

Audit your emergency communications program. Following the exercises, be sure to analyze the results of your notification efforts. Identify and build on patterns of success, and detect and close any gaps in communication practices. Communicate the results and follow-up steps to appropriate stakeholders.

Maintain your emergency communications program. Like other critical systems, emergency notification services need care and feeding. If employee contact data is out of date, or groups and scenarios do not accurately reflect the organization’s current structure, communication attempts will fail. Have your employees update their own contact information through the Send Word Now Self Registration Portal to ensure their latest contact information is available. Meet with senior management and human resources regularly to affirm scenarios and groups are still complete and valid.

Building both your business continuity plan and your notification program is important, but is only the first step. Exercising, auditing, and maintaining these business resiliency components are critical to ensuring overall success.

If you’re interested in learning more about DRI International’s BCM certifications, you can find additional information here. Watch for future installments in this series.

It should be noted DRI International is not listing these professional practices in order of importance, and suggests some of these may be undertaken in parallel with one another. _