A business continuity plan that has never been tested is a hypothesis, not a capability. The organisations that recover well are not the ones with the thickest binder — they are the ones who have rehearsed.
The plan that only exists on paper
Most continuity plans are written to pass an audit and then filed. They name systems that have since been decommissioned, people who have left, and recovery times no one has ever verified. On the day of a real incident, the gap between the document and reality is where the damage happens.
What rehearsal reveals
The first time you actually run the plan, you learn things no review would surface:
- The backup that restores, but takes three times longer than the plan assumes.
- The runbook step that depends on a system that is itself down.
- The key decision that has no clear owner at 3 a.m.
- The contact list that is stored only on the network you can no longer reach.
Tabletop versus live
Tabletop exercises are cheap and catch decision-making gaps — who declares an incident, who talks to customers, who calls the regulator. Live failover tests are harder but catch the technical assumptions. A mature program uses both, on a cadence, with findings that feed back into the plan.
You do not rise to the occasion in a crisis. You fall to the level of your preparation.
Making it a habit
ISO 22301 asks for exactly this rhythm: plan, test, learn, improve. The standard is not the point — the muscle memory is. A plan rehearsed twice a year is worth more than a perfect one that has never left the shelf.
Want to pressure-test your continuity plan? Let’s run an exercise.