Surprise Testing – is it worth the gamble?
There is no question that “surprise testing” could be dangerous to an enterprise. Is it worth the gamble?
First, of all, let’s be clear what constitutes a surprise test. A surprise test could be completely unannounced – think of the fire alarm in your office going off in the middle of the day – or it could be partially announced with respect to timing, nature or both (“a fire drill will be conducted one day next week…;” “a business continuity exercise will be conducted within the next two weeks outside of regular business hours. Details will be disclosed at the time of the activation…”).
Over the past 25 years, I have been involved with many surprise tests, as both a participant and an observer. I am pleased to report that (at least in the cases where I was an active participant) that carefully planned and managed surprise tests did not harm the enterprises. In two cases where I was an observer and where it was inappropriate for me to guide the participants except in situations of potentially serious risk, some levels of misunderstanding or confusion resulted in moderate losses (which could have been averted).
In short, the potential risk from a surprise test is considerable. So, why would you want to conduct one? First of all, a surprise test can often produce results which simply aren’t readily achievable by any other method. For example, in many exercise scenarios, timing can be a critical factor; a surprise test can often leverage the timing factors more effectively than a scheduled test.
Second, the psychology of a surprise test is very different from a scheduled test. After all, ‘real’ disasters (often referred to as the “ultimate test”) don’t come at convenient times; a surprise test can get the stress and adrenaline levels – as well as irritation factors – a lot closer to where they would be in a ‘real’ disaster. It’s a lot different running an exercise where the participants cannot predict what’s going to happen when, rather than an exercise which is scheduled, announced and fully preplanned.
Planning, executing and managing a surprise test is vastly more complex than a typical business continuity test. Of course, surprise testing should only be considered when most or all other types of exercises have been employed rigorously. But if carefully employed, the results of a surprise test can be really valuable.
=====================================
An unexercised contingency plan could be worse than no plan at all!
Be sure to read Disaster Recovery Testing: Exercising Your Contingency Plan, Philip Jan Rothstein, FBCI, Editor – the only book on this subject – for valuable tips, techniques and insights. Now only $49.00!
Tags: exercising, Testing
