A continuity plan can look complete on a shared drive and still fail at 8am on a Monday, when a key system is unavailable, a supplier has stopped trading or the person who holds the emergency contact list is on holiday. Business continuity testing is how you find out whether your plan works in the conditions it was written for – before customers, contracts and cashflow are affected.
For SMEs, the aim is not to create an enterprise-scale disaster exercise. It is to test the practical decisions, people and information that will keep your business operating or get it back on its feet quickly. Done properly, testing gives directors confidence, provides useful evidence for ISO 22301 and exposes weaknesses while they are still affordable to fix.
Why business continuity testing matters
A business continuity plan makes promises: critical services can be maintained, data can be restored, customers will be kept informed and key suppliers have alternatives. Testing turns those promises into evidence.
This matters commercially as well as operationally. Tender questionnaires, larger customers and insurers increasingly ask whether continuity arrangements are tested, rather than simply documented. A tested plan can show that your business has considered disruption seriously and knows who will do what if it occurs.
The value is usually in the small discoveries. Perhaps your recovery time objective is unrealistic because a software provider only offers next-business-day support. Perhaps two managers both assume the other will speak to customers. Or perhaps your backup is running but nobody has attempted a full restoration. These are manageable issues when identified during an exercise. They are far more costly during a real incident.
For organisations working towards ISO 22301, exercises also support the requirement to evaluate continuity procedures and capabilities. The standard does not demand one identical test for every business. It expects testing that is planned, appropriate to your risks and followed by improvement.
Start with the disruptions that could stop work
The best test is not necessarily the most dramatic one. Choose a scenario that reflects how your organisation actually operates, the services customers rely on and the risks identified in your business impact assessment.
A construction contractor might test loss of access to site records and health and safety documentation. A professional services firm may focus on a cyber incident affecting cloud systems, client files and remote working. A manufacturer could test failure of a sole-source component supplier, while an online retailer may test a payment platform outage during a busy trading period.
Start with one scenario that has a credible impact and a clear learning purpose. If your most critical process depends on a particular person, system, premises or supplier, that is a sensible place to begin. Avoid a vague scenario such as “major disruption”. State what has happened, when it happened, what is unavailable and what assumptions the team can make.
For example: “At 10.30am, the company’s main file server is encrypted by ransomware. Staff cannot access job records or customer contact details. Email remains available on mobile devices, but IT support cannot confirm when systems will be restored.” This gives participants enough detail to make real decisions.
Choose the right type of continuity test
Business continuity testing should be proportionate. A live exercise can be valuable, but it is not always the right starting point for a small business. Testing methods range from low-disruption discussions to controlled technical recovery exercises.
Tabletop exercises
A tabletop exercise brings the relevant people together to discuss their response to a scenario. A facilitator introduces new information in stages, such as a customer complaint, a supplier update or a staff absence. Participants explain what they would do, who would authorise decisions and what information they need.
This is often the most cost-effective option for SMEs. It tests roles, escalation, communications and decision-making without disrupting normal operations. It is also an effective way to identify whether the written plan is clear enough for someone who did not create it.
Walk-throughs and call-out tests
A walk-through tests individual parts of the plan. You might check that contact numbers work, confirm staff can access emergency documents remotely or ask the incident team to join a short call at short notice. These tests are simple, but they can reveal outdated information and unclear responsibilities quickly.
Technical recovery tests
If continuity depends on digital systems, technical testing should not be left to assumption. Ask your IT provider or internal team to restore a sample of backed-up data, recover a key application in a controlled environment or demonstrate how users would work from an alternative location.
A successful backup job is not the same as a successful recovery. The relevant question is whether the information can be restored, accessed and used within the timeframe your business has committed to.
Live simulations
A live simulation tests a response under more realistic conditions. It may involve transferring work to an alternative location, using manual processes for a set period or operating from a secondary system. This can produce strong evidence, but it requires careful planning so that customers, safety and normal delivery are not put at risk.
For many SMEs, a staged approach works best: start with tabletop exercises, test critical technical recovery separately, then progress to a limited live simulation once the basics are proven.
How to run a useful business continuity test
Set a clear objective before inviting anyone to the exercise. “Test our plan” is too broad. A better objective could be to confirm that the incident team can communicate with customers within two hours of a cyber incident, or that payroll can be processed if the office is inaccessible.
Assign a facilitator who can keep the exercise moving and challenge assumptions. They do not need to be external, although an independent facilitator can be useful where senior managers are heavily involved in the response. Nominate someone to record decisions, timings, issues and actions. Without a record, a worthwhile discussion can become difficult to evidence later.
Make sure the right people attend. This normally includes the person with authority to make decisions, operational leads, IT or system support, communications or customer service, and any team responsible for safety, premises or suppliers. In a small organisation, one person may hold several of these responsibilities. That is exactly why the exercise should consider absence and delegation.
During the test, ask practical questions. How do we know an incident has reached the point where the continuity plan is activated? Who has authority to close a site, pause production or approve additional spending? Where are current customer priorities recorded? What alternative process can staff use if the usual system is unavailable? When and how do we tell customers what has happened?
Do not let the group solve every problem with “we would contact the supplier”. Ask what happens if the supplier cannot respond, is affected by the same incident or cannot meet your required recovery time. The purpose is not to make the scenario impossible. It is to understand dependencies and make realistic choices.
Measure what happened, not what was intended
At the end of the exercise, compare the response against your objectives. Record actual timings where possible, even in a tabletop setting. If the team says customers would be contacted within two hours, identify who prepares the message, who approves it and where the contact data comes from.
Useful evidence includes the exercise plan, attendee list, scenario, notes of decisions, test results and an action log. Keep the record straightforward. A two-page report with clear actions is more useful than a lengthy document that nobody revisits.
Classify actions by priority. Some changes can be made immediately, such as updating a phone number or saving an offline copy of key contacts. Others may need budget or management approval, such as introducing a second internet connection, changing a supplier arrangement or improving backup retention. Give every action an owner and target date.
Most importantly, verify that actions have been completed. Re-testing a changed process is often the only way to know whether the improvement has fixed the original problem.
Common mistakes that weaken continuity exercises
The most common mistake is treating testing as an annual paperwork task. If the plan changes after a new system, site, supplier or major contract is introduced, the test programme should change too. A continuity plan based on last year’s organisation may give false reassurance.
Another issue is testing only the IT response. Technology is often central, but continuity also depends on people, communications, premises, records, suppliers and decision-making. A system may be restored quickly while customer commitments still fail because nobody has agreed how work will be prioritised.
Finally, avoid making every exercise too comfortable. If participants have the plan open in front of them and know every scenario detail in advance, you are checking familiarity with the document rather than the organisation’s ability to respond. Give enough warning to make attendance possible, but retain some uncertainty.
Build testing into normal management
A sensible programme might include a short contact and communications check every six months, an annual tabletop exercise for the most significant scenario, and technical recovery testing at intervals agreed with your IT arrangements. The right frequency depends on your risk profile, contractual requirements and pace of change.
Review tests after real incidents too. A power cut, supplier delay or system outage can provide more useful evidence than a planned exercise if you capture what happened and turn lessons into action.
Business continuity testing should make disruption less uncertain, not add another layer of administration. Keep the exercise focused, record what matters and improve one weakness at a time. That is how a plan becomes a practical capability your people can rely on when it counts.
