What does ISO 22301 require on exercising and testing?

ISO 22301 asks for more than a continuity plan. It also asks you to exercise it, demonstrably. What exactly does the standard say, where does it often go wrong in practice, and how do you set up an exercise programme that really pays off?

ISO 22301 is the international standard for business continuity management. Alongside policy, risk assessment and plans, the standard asks organisations to exercise and test their plans and procedures regularly. In practice, that part often gets the least attention. Not out of unwillingness, but because the plans themselves already take so much time that exercising gets pushed back to next year.

Yet that is precisely the most interesting part of the standard. It’s where you find out whether everything you’ve written down actually works.

What the standard actually requires

The standard requires you to set up a programme of exercises and tests that, over time, demonstrates that your continuity strategies and solutions work¹. Those exercises have to meet a number of conditions:

They fit the scope and objectives of your continuity management plan.
They are based on well-prepared scenarios with clearly defined objectives.
They build teamwork, competence, confidence and knowledge among the people who have a role in the plan.
Taken together over the years, they test all your strategies and solutions, not just one part.
They produce a formal report with outcomes, recommendations and improvement actions.
Those outcomes feed into continual improvement.
They take place on a fixed schedule, and whenever something significant changes inside or outside the organisation.

And then you actually have to do something with the results: make the adjustments and carry out the improvements.

The standard also requires you to assess whether your business impact analysis, risk assessment, strategies, plans and procedures are still suitable and effective¹. You do this partly through exercises and tests, but also through evaluations after real incidents, and by looking at the continuity of key partners and suppliers. That assessment should also take place at fixed intervals, as well as after an incident or a significant change.

The difference between exercising and testing

The standard talks about both, and the difference is worth knowing. A test is an exercise in which you define in advance what counts as a pass or a fail. Think of switching over to a recovery site or restoring a backup within the agreed time. It works, or it doesn’t.

An exercise focuses more on people: does the team know who takes the lead, how decisions are made, who communicates with customers and staff? There’s no simple right or wrong, but there is a great deal to learn.

A good programme needs both. A failover that works technically is of little use if nobody knows who has the authority to decide to activate it.

Where it often goes wrong in practice

If you work with the standard, you’ll probably recognise one or more of these patterns:

The same tabletop exercise every year. According to certification bodies, repeating the same exercise isn’t enough; a programme should keep testing different scenarios, teams and parts of the organisation.
Only the technology gets tested. The IT failover is checked every year, but the crisis team has never worked through a scenario together.
A report without follow-up. There is a report, but the improvement actions haven’t been assigned, or are still open a year later. Auditors look specifically for reports with completed actions, and for evaluations that have demonstrably changed something in the system.
Real incidents stay out of the picture. An outage or incident is resolved and then forgotten. Yet it counts as a common nonconformity when real disruptions are never debriefed and followed up. Every incident is a free exercise.
The programme only covers part of the picture. The standard requires exercises, taken together over several years, to test everything. A programme that only touches head office, or only IT, leaves gaps.

What a good evaluation report contains

The report after an exercise is more than evidence for the auditor. It’s your organisation’s memory. A useful report answers at least these questions:

What did we want to test? The objective and scope of the exercise.
Which scenario did we use? Including the twists introduced during the exercise.
Who took part, and in what role? Roles, not names, in an evaluation.
What happened? A timeline of decisions and actions, ideally recorded during the exercise itself.
What went well? That’s just as important to hold on to as what could be better.
Where did practice differ from the plan? And is that down to the plan, to the arrangements, or to something that was still missing?
What improvement actions follow? With an owner and a date.
When do we check whether it worked? Preferably in the next exercise.

A report structured this way shows your auditor what was tested, what went well and which steps you’re taking. But above all, it helps your own team get further next time.

A programme spanning several years

You don’t have to do everything in one year. A programme that gradually becomes more demanding often works better than one big exercise. Start, for example, with a walkthrough of the plan and a tabletop exercise with a realistic scenario, alongside a technical test of your most important failover. Then build up gradually: different scenarios, unexpected twists, departments or locations that haven’t been covered yet, and a test of whether key roles can be reached. That way you work towards a simulation under time pressure, in which the crisis team has to make decisions with incomplete information, possibly together with a key supplier. In between, briefly debrief every real disruption, and plan an extra exercise whenever there’s a major change in the organisation, such as a new system, a move or a merger.

Why the debrief makes the difference

The standard puts a lot of emphasis on the report and the improvement actions, and for good reason. Research shows that a good debrief improves performance by around a quarter on average, both in simulations and in real situations, and both in healthcare and beyond². Research also shows that debriefs work better when they focus on the team and draw on an objective record of what happened³.

In other words: the report isn’t the paperwork after the exercise. It’s where the learning happens.

Building towards confidence

The aim of the standard isn’t ticking a box. The standard wants you to be able to show that your plans work, and that you learn from what happens during an exercise. You can tick the box on paper. A crisis is a different test.

At Crisis Dynamics we design and facilitate exercises and simulations that meet the requirements of ISO 22301, from a first tabletop exercise to a full exercise programme spanning several years. After every exercise you receive an evaluation report with concrete improvement actions, focused on the plan and the collaboration, never on individuals.

You can’t prepare for every crisis, but you can make sure your team can handle any crisis.

Sources

ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, clauses 8.5 and 8.6.
Tannenbaum, S.I. & Cerasoli, C.P. (2013). Do team and individual debriefs enhance performance? A meta-analysis. Human Factors, 55(1), 231–245.
Keiser, N.L. & Arthur, W. (2021). A meta-analysis of the effectiveness of the after-action review (or debrief) and factors that influence its effectiveness. Journal of Applied Psychology.

Written by the Crisis Dynamics team