Knowing What to Test
At the start of the chapter we described a test as a specific type of exercise that has a pass/fail or otherwise graded outcome. The key difference is that while an exercise can be exploratory, helping you to feel out how things might work in various scenarios, a test is something you undertake when you need to find out whether your arrangements can stand up to reality. In common with any exercise, a test needs clear objectives.
When you’ve sorted out and planned your objectives (as we describe in the earlier section ‘Planning the Exercise and Its Objectives’), you’re ready to ask: ‘What do we want to test?’ Well, this is where you can really get colleagues involved. You’ll have your own ideas; they, we hope, have theirs. We can make sensible suggestions to start you off on the right road. But remember, you know your business, we don’t.
Start with simple topics and leave the prospect of Armageddon to another day. That doesn’t mean the key issues for business should be simple, of course; no point in that. In this section, we look at your planks of support: that is, your business processes that you can’t allow to fail and the questions you’re very likely to need to address if disruption occurs.
Testing people
You can test:
Access to HR data.
Staff awareness of their roles in a disruption.
Your access to up-to-date staff job descriptions/objectives.
What potential points of failure exist.
How you would cope with the loss of staff expertise.
Key contributions to your business from other organisations.
Your concerns may include:
Effective co-operation and working across the organisation.
Quick and effective access to all data.
Accuracy of your staff skills audit.
How you can cope with loss of key staff.
What tasks you may ‘stand down’ and for how long can you afford to do so.
Accountability and accurate recording of the business during disruption.
Identifying good practice and learning lessons.
Testing places and services (the workplace)
You can test:
Loss of critical features your workplace provides.
Your ability to find the same requirements elsewhere and quickly.
Whether you’ve identified, agreed and recorded all key requirements.
Implications of having to relocate and the possible effects on staff.
Your concerns may include:
Informing staff that your premises are inaccessible.
Loss of equipment, records and access to their source.
Lack of suitable alternative premises.
Staff access to a new site.
Testing your ICT
You can test:
Your ability to effect safe and swift shutdown of your systems without data loss.
Your callout contract with your IT provider that covers breakdown, network problems and other failures.
How you’d re-negotiate the service contract if it doesn’t include provision for BC options.
Security of your systems, PCs and laptops.
Security of your stored data.
Your cascade call procedure – particularly if land lines are down.
Your concerns may include:
Whether you can deliver without IT.
How you access your recovery plans.
Your ability to identify critical business activities and which may be jeopardised.
How you are going to access data.
How you are going to record activity and ensure safe electronic recording for normal running.
Testing communications
You can test:
Suppliers, customers and media contacts.
Your capability to ensure single point of message ‘control’.
Communicating with staff on- and off-site.
Your concerns may include:
Isolation from critical contacts.
Maintaining control of internal and external messages.
Quick and effective monitoring of activity.
Safeguarding your reputation and protecting the brand.
Ensuring careful announcement of a satisfactory return to normal running.
Testing finance
You can test:
Your ability to pay bills and receive payments.
Your reliance on IT.
Your ability to maintain records and manage financial data.
Availability of skills needed operate your finance systems.
Other staff operating your systems if key people are away.
Whether you can pay your staff if systems fail.
Your concerns may include:
Complete collapse of your financial systems.
Loss of financial records.
Your ability to operate manual systems.
Loss of staff expertise.
Payments of staff and non-receipt of payments.