https://www.virtual-corp.com/business-continuity/table-top-exercise-revelations/

By Bob Farkas, PMP, AMBCI, SCRA

One of the most useful, insightful, and entertaining business continuity activities is table top exercises. These are generally well known to Business Continuity practitioners as an important step in emergency preparedness and disaster recovery planning. Table top exercises often involve key personnel discussing simulated scenarios, where their roles play a part, and how to respond in emergency situations. In this article, I will present a real example that can illustrate the type of useful information that can be obtained from an exercise. Moreover, an exercise scenario does not have to be complicated to provide value. To quote Leonardo Da Vinci, “Simplicity is the ultimate sophistication.”

Setting the Stage 

Recently, a West coast high tech firm requested assistance from Virtual Corporation with implementing a business resiliency program throughout the enterprise. Each department that was deemed in-scope completed a Business Impact Analysis (BIA) and developed its initial Business Continuity Plan. If the department Recovery Time Objective (RTO) was 24 hours or less, it would conclude its business continuity planning activities with a table top exercise.

One of the firm’s divisions located in the United Kingdom fell into the category that needed to complete a table top exercise. The exercise included participants from three critical departments which provide security monitoring services and support for their commercial clients. The local business continuity lead determined a building fire would be the appropriate scenario for the exercise.

The Dilemma

Once the exercise began, participants described their initial actions in responding to the building evacuation announcement. They pointed out that the company’s safety and evacuation procedures require that laptops be left behind at the employees’ work areas to facilitate and ensure everyone’s swift and safe evacuation from the building during a potential fire or other disruptive event.  The scenario was advanced to where the fire had been extinguished and the Fire Marshal declared the building unsafe to occupy. At this point, the participants in the exercise indicated management would instruct employees to go home. A major issue quickly became apparent. They would be unable to work remotely since their laptops remained in the building that they could no longer access. The short-term solution was to use their mobile phones to hand off work to other locations and manage work as best as possible with their mobile phones until their laptops were replaced.

During the discussions that followed, the question arose as to how quickly replacement laptops could be provisioned. Not soon enough it turned out; the company did not have a local (UK) IT service center. Laptops are supplied from the company’s facility in Dublin, Ireland. This led to a list of other issues and questions that needed to be addressed such as machine inventory, availability of pre-imaged machines, prioritization of need, expedited delivery and identifying alternate, local sources. The real magnitude and impact to these departments’ abilities to continue work was not fully considered until this exercise brought these issues to the forefront.

Exercises also challenge common assumptions and beliefs. In the building fire exercise scenario, virtually everyone’s initial reaction to not being able to work from their impacted location was that they would work remotely/from home without carefully considering the implications of that decision. In the building fire scenario described above, no one thought they’d be without a laptop until reminded that their laptops could not be retrieved. Raising such issues during the exercise, and thus one of the benefits of an exercise, is to force people to consider the situation more carefully and think through other alternative recovery options such as relocating to another facility (with available computers) or mitigations such as having a local laptop supplier.

Conclusion

Much can be learned from table top exercises as illustrated by this example. It is a valuable training and planning tool to improve responsiveness and organizational resiliency. However, such benefits can only be realized if exercises are done regularly and the lessons learned are applied. Similar to how regular physical exercise can benefit one’s personal well-being, table top and other business continuity exercises can also benefit an enterprise’s resiliency well-being. Therefore, exercise often.

About the Writer

Bob Farkas, PMP, AMBCI, SCRA
Manager, Project Management Office/Project Manager

Bob has been with Virtual Corporation since 2001 during which he has led many Business Impact Analysis (BIA), Business Continuity Planning, and Risk Assessments projects across health care, manufacturing, government, technology and other services industries. In addition, he has been instrumental in building and refining Virtual’s processes and toolkit bringing new approaches and insights to client engagements. His career spans materials engineering, programming, telecom marketing research, IT outsourcing and business continuity. Bob holds PMP, AMBCI and SCRA certifications and has a Master’s in Chemical Engineering from the New Jersey Institute of Technology and Bachelor’s in Metallurgical Engineering from McMaster University (Hamilton, Ontario.)