Practice makes perfect
We are all familiar with the expression “practice makes perfect” and never has a truer word been spoken. Practising is all about rehearsing again and again until you have mastered the role you’ve been assigned; but, it is also about improving your behaviour.
Today’s BCAW 2013 webinar of my choice was the one on exercising, or rather scenario-based exercising, which was presented by Andy Osborne MBCI, Associate Consultant at Clearview-Continuity.
The first question Andy raised was, why bother with exercises?
Well, the short answer is that it takes a lot of time, effort, resources and money to write a Business Continuity Plan (BCP) and if you want to see a return on this investment, you need to make sure it works. Simply having a BCP in place will not save your business; what will save it is having the right people with the right capability to deliver that plan, and the only way to develop that capability is through practising or as Business Continuity professionals prefer to say, through exercising.
So should a BCP be based on particular scenarios?
Well according to Andy, “scenario-based plans are a waste of time”. What Andy was essentially saying with this somewhat controversial statement (at least at first glance) is that there is no way that we can think of every possible scenario nor can we plan for every conceivable type of incident that we may be faced with at some point in the future. More often than not, old Murphy’s Law will kick in and you will find yourself either faced with the one scenario you hadn’t thought of or the scenario you had in your head pans out quite differently in reality. What is critical here is not to plan for every scenario, but to plan for any scenario and the way you do this is to build the capability within your organization to respond to any incident by getting the people involved to rehearse again and again until they know their lines off by heart (speaking in theatrical terms of course)!
What about scenario-based exercises?
Scenario-based exercises, on the other hand are not a waste of time but can be very valuable in terms of emphasising issues that no one had thought of; highlighting your strengths and your weaknesses (remember, you are only as strong as the weakest link); clarifying responsibilities; testing your communications and ultimately, helping you to improve and enhance your response capability.
Which scenarios should you select?
It doesn’t really matter what type of scenario you select, but what it does need to be is credible, engaging and realistic and it needs to meet and reflect your objectives and the key issues you are hoping to address through the exercise. So when planning an exercise, don’t start the process by trying to think of some great theatrical spectacular, focus in the first instance on your objectives and issues. You can make up the most exciting, mind-blowingly creative and fictitious incident, but if it doesn’t meet your objectives then it will have little value and will really be a complete waste of time!
When it comes to facilitation of a scenario-based exercise, there are many approaches that can be taken. It could be as simple as a desk-top exercise where you gather everyone around the table to talk them through the plan or even walk them through it; or it could be a bigger event involving role play and fake journalists, doctored photos and staged radio broadcasts.
The key observation made by Andy based on his extensive experience in the field, is that what you do will and should be decided by the people you need to involve inasmuch as some people will feel comfortable with role play; others will feel totally out of their comfort zone; some will react well and others badly. You need to understand the composition of your Incident Management Team, the intricacies of their personalities as well as having (if possible) some insight into past history and previous experiences and traumas so that you can at least make some kind of pre-judgement as to how they might react to certain scenarios and whether they are the right men or women for the job.
You also need to consider whether they can work well together as a team and whether indeed they know each other well enough to perform effectively as a unit, after all, you are only as good as the sum of your parts.
Both approaches of course have their value. If you decide for the role play (which does not involve dressing up in fancy costume), you can make this as realistic as you like, just be sure to be aware of the fact that different people will react in different ways. Certainly, if you wish to include a death of a colleague in your scenario, it is wise not to use real people’s names but safer to stick to a fictitious name instead; using real names can have terrible emotional consequences for some of the players on your stage. How realistic you can make it, will of course depend on how realistic you can afford to make it, but the sky really is the limit here. You can involve multiple teams and use multiple locations in your scenario; there is no right or wrong. Andy did, however, strongly advise anyone planning to use multiple teams to first carefully consider which teams to involve at what point otherwise you will have people involved with nothing to do for long periods of time, which destroys the ‘engaging’ element of your scenario and will result in loss of interest and loss of ownership and ultimately spell out a miserable failure.
So how do you get the most out of your exercising? Here are Andy’s top tips:
- Plan and prepare for your exercise properly
- Think about the management and the coordination of the exercise
- Use experienced facilitators
- Develop an exercise plan and schedule
- Ensure you have clear objectives and measurable success criteria
- Brief all participants including the facilitators in advance as well as you can or should
- Have some independent observers on the side line as they can provide excellent, impartial feedback post-event
- Create and use post exercise critique forms and log books to capture key information and observations
- Write a report and follow up on the report’s recommendations as part of your lessons learned (after all exercising is also about improving your capability)
- Finally de-brief everyone who was involved and make sure all loose ends are firmly tied up
At this point, Andy reminded us of the 5 Ps (or 6 Ps used in the army, but we won’t mention the sixth one here!): Proper Planning Prevents Poor Performance – good planning breeds success; success breeds confidence, confidence in your plan, in your team and ultimately in your organization to withstand any scenario!
The final question that Andy put on the table was when to exercise?
The Business Continuity Management Lifecycle tells us to exercise and test at the end of the process, but we could exercise during strategy definition or maybe during the implementation process. In fact, Andy went one step further and made the brave suggestion that maybe the Lifecycle should begin with exercising as this is guaranteed to make people sit up in their seats and pay attention; it will highlight the key issues; it will emphasise the importance of Business Continuity and it could be key to getting buy-in especially at the top, which as we know can be more than difficult!
This webinar certainly provided me with ample food for thought and hopefully you have learned something too by reading this blog!