Most organizations understand the requirement to exercise business continuity strategies, but fewer appreciate that a structured programme of different exercise types is a good verification practice. Charlie Maclean Bristol, FBCI, FEPS, explains… I don’t think any practitioner would argue with this point in the BCI’s Good Practice Guidelines (GPG): ‘An organisation’s continuity capability cannot be considered reliable or effective until it has been exercised’. The section on validation goes on to say, ‘An exercise programme should ensure that desired level of capability by: Rehearsing all plans’. If you look at most mature business continuity organizations, on the whole they will have an exercise programme and it usually consists of each plan being exercised once a year by the team. Some go a bit longer between them, but these are the main exercise activities. Their technical people are likely to do some DR exercises, sometimes they are discussed with the business continuity person but often they take place separately, and the BC person relies on IT to conduct suitable exercises. What many practitioners are missing is the next requirement of an exercising programme, which accord...