Trust But Verify: Testing Your Plans Before You Need Them
We opened this series with a simple truth: a continuity plan that's never been tested is just a guess with a nice cover page. That's the final professional practice in the BCI's Good Practice Guidelines — Validation — and if you only take one thing from this whole series, make it this one.
Validation means checking, deliberately and regularly, that everything from the previous five practices actually works in reality. That your backup genuinely restores. That your alternative supplier genuinely has capacity when you call them, not just when you assumed they would. That the person named as deputy incident lead actually knows they've been named, and knows what to do. Plans decay quietly. People leave, systems change, contact numbers go out of date — and none of that shows up until the moment you actually need the plan, which is the worst possible moment to find out.
For chamber members worried that “testing” means an expensive, disruptive simulation, the reality is more forgiving. Validation happens on a spectrum, and smaller businesses can get real value from the simpler end of it.
A desktop exercise — talking through a scenario as a team, with no systems actually switched off — is cheap, takes an hour, and reliably surfaces gaps: “wait, who actually has the spare key?” or “I thought Dave had that supplier's mobile number.” A walk-through of a specific procedure, like actually trying to restore a file from backup or actually calling the alternative supplier to confirm they'd help, tests a single assumption cheaply. A full simulation, where you genuinely work from the fallback location or system for a day, is the gold standard, but it's reasonable to save that for your highest-priority risks rather than everything at once.
Whichever level you choose, the discipline that matters is the same: write down what you learned, and actually change the plan. An exercise that reveals a gap and is then filed away unchanged has wasted the one useful thing testing gives you. The most resilient businesses we've worked with treat every test — even a short, informal one — as an update to the plan, not a pass/fail exercise on the day.
A sensible starting rhythm for most SMEs is a short desktop exercise annually, plus a quick, practical check of your top one or two critical dependencies — like actually restoring a backup — every six months. That's a modest time investment for the confidence that when disruption arrives, your plan will hold up to more than a first reading.
That completes the six professional practices that make up good business continuity management, as set out in the BCI's Good Practice Guidelines Edition 7.0: establishing a system, embedding it in your culture, understanding your risks, designing sensible solutions, enabling them properly, and — above all — testing that they work. None of it requires a large budget or a dedicated department. It requires a decision to start, and the discipline to keep checking.
Continuity Shop delivers the BCI's Certificate of the Business Continuity Institute (CBCI) training and provides business continuity consulting to organizations across Greater Manchester and beyond. If this article has raised questions about where your own business stands, get in touch with [email protected] to talk through your options.
More on
