BCP exercising and testing (ISO 22301 clause 8.5)
Exercising and testing is one of the requirements that auditors check most closely in ISO 22301 . Clause 8.5 requires you to run exercises regularly to check whether your continuity plans work in practice. An untested business continuity plan (BCP) is not enough evidence for an auditor. Practical explanation of the standard is in ISO 22313 , and certification runs through bodies supervised by the RvA (Dutch Accreditation Council) .
The standard does not require one specific type of exercise. What counts is that you run exercises that match your risks and that you use the results to improve your plans.
Exercise types: from simple to full
ISO 22301 does not contain a fixed list of exercise types. In practice, five types are used most often. They increase in complexity, cost and realism.
| Exercise type | Description | Who takes part? | Cost and time | Best for |
|---|---|---|---|---|
| Document review | Going through the plans to assess completeness and whether they are up to date | BCM team | Low (hours) | Annual basic check |
| Tabletop exercise | Discussing a scenario around a table, with no physical actions | Management and process owners | Low to medium (half a day) | Testing roles and decision lines |
| Functional exercise | Specific functions or systems are actually deployed | IT, facilities or communications team | Medium (one day) | DR procedures, communication plan |
| Full-scale exercise | Realistic simulation involving nearly all parties concerned | Everyone involved, possibly suppliers | High (one day to several days) | Periodic large-scale test |
| Live failover test | Actually switching over to backup systems or a backup location | IT and crisis team | High (technical risk) | Validating IT continuity plans |
Tabletop exercise: the most used
A tabletop exercise is the most accessible type. You discuss a scenario (ransomware, fire, supplier bankruptcy) step by step around a table. Nobody has to do anything physical, but everyone thinks out loud: who makes which decision, who communicates what, and what information do we need?
For example, a manufacturing company with 80 employees runs a tabletop on this scenario: “On Monday morning, the ERP system is unreachable because of ransomware. Order processing has stopped.” The crisis coordinator, the IT manager and two production managers sit at the table for half a day. They work through the activation path, the communication steps and the recovery priorities. The outcome: three gaps in the plan, which they fix afterwards.
Live failover test: the most critical for audits
A live failover test is the most convincing form of evidence for auditors. You actually switch over to your backup environment and measure the real recovery time. That is also the risk: if things go wrong, you have a real incident.
Always run a live failover test outside peak hours, with an explicit go/no-go decision based on a current risk assessment. Document the outcome and any deviations from your RTO.
Frequency: how often should you exercise?
ISO 22301 does not set a fixed frequency. The standard requires you to plan exercises based on your risks and to justify the frequency. In practice, most organisations use these guidelines:
| Exercise type | Minimum frequency (indication) | Audit expectation |
|---|---|---|
| Document review | Yearly | Required, lowest threshold |
| Tabletop exercise | At least once a year | Almost always expected |
| Functional exercise | 1-2 times a year | Depends on scope |
| Full-scale exercise | Once every 2-3 years | For larger organisations |
| Live failover test | At least once a year (IT-critical) | Critical for IT scope |
For organisations subject to NIS2 (the EU Network and Information Security Directive), regular testing is also an explicit NIS2 requirement. You can read more about this link at ISO 22301 and NIS2.
Evaluation: from exercise to improvement
An exercise that does not lead to actions is a missed opportunity. ISO 22301 clause 8.5 requires you to evaluate exercises and to follow up improvement actions in a way you can demonstrate. In practice, it works like this:
- Exercise report: document the scenario, participants, timeline and findings.
- Categorise findings: separate urgent shortcomings (the plan does not work) from improvement points (the plan could be better).
- Assign actions: link each finding to an owner and a deadline.
- Follow-up check: at the next exercise, check whether the actions are closed.
- Management review: report the exercise outcomes and improvement actions to management.
Auditors want to see the exercise report, the findings, and evidence that the actions were followed up. A plan that never leads to improvements does not inspire confidence.
Common mistakes when exercising a BCP
| Mistake | Result | Better alternative |
|---|---|---|
| Only a paper review, never a scenario exercise | An auditor does not accept it as complete evidence | Combine a document review with at least one tabletop a year |
| Exercise not documented | No evidence for an auditor or regulator | Always write a short exercise report |
| Findings not resolved | The same mistakes come back | An action list with owners and deadlines |
| Always the same scenario | Blind spots remain | Vary the scenarios: cyber incident, data centre outage, staff shortage |
| Suppliers not involved | Dependencies are not tested | Involve critical suppliers in relevant exercises |
Linking exercises to your audit
The ISO 22301 audit process checks exercises as one of its core points. Before the audit, make sure you have:
- at least one documented exercise per year;
- exercise reports with findings and improvement actions;
- evidence that improvement actions have been completed;
- a schedule for future exercises.
You can read more about audit expectations on the page audit process.