Testing the plan

A plan nobody has run

The toolkit's words are that your arrangements cannot be considered reliable until they are exercised and have proved to be workable. Until then the plan is a document. Exercising has three purposes: validating the plans, rehearsing the key staff, and testing the systems that resilience depends on. How often depends on the organisation, the rate of change in it or its risks, and what earlier exercises found, but the toolkit suggests at least once a year.

The four types

Testing is for the parts of a plan that can be tried directly: the contact list, the activation process, back-up power, communications equipment and information management.

A discussion exercise is the cheapest to run and the easiest to prepare. It brings staff together to learn the plan and their own responsibilities, and to talk through its problems and solutions. The toolkit calls it useful for training, for embedding the subject in the culture, and as a first validation of a new plan.

A table-top exercise is scenario based. Staff sit round a table and take decisions as the scenario unfolds, much as they would in a real incident. It usually lasts between two hours and half a day. For a small or medium organisation the toolkit says it is likely to be the most efficient way to validate the plan and rehearse the key staff.

A live exercise ranges from a test of one component, such as an evacuation, to a full test of every part of the plan. Full live exercises are complex and can be costly, and the toolkit asks you to check first that the organisation can run one without disrupting its own key products and services.

Designing the scenario

Keep it simple. Make it relevant and realistic by going back to the risks identified when you were understanding the organisation. The local resilience forum may sometimes help, the toolkit says, but you can do it yourself. Whatever the type, consider inviting the stakeholders you rely on, especially suppliers.

After the exercise

Record and evaluate the event. Debrief immediately, then write it up as a lessons learned report with actions, and update the plan.

Maintaining and reviewing

A maintenance programme should update the plan when the organisation changes, including restructurings or new ways of delivering critical activities, when the outside environment changes, after lessons from an incident or exercise, and when staff change. Use version control.

The toolkit also recommends a documented review, by audit or self-assessment, at regular intervals. The review checks that all key products, services, critical activities and supporting resources have been identified; that the arrangements reflect the organisation's objectives and the level of risk it faces; that the maintenance and exercise programmes have been carried out; that improvements found in incidents and exercises have been built in; that training and awareness are in place; and that change control works.

The same rule elsewhere

Other guidance says the same thing. The Department for Education lists exercises and tests, such as fire drills, in the planning process for schools and nurseries, with a lessons learnt exercise after any crisis. The Hampshire and Isle of Wight community plan template asks a group to review its plan every year and after every use, and Dorset Prepared offers to run a two to three hour test of a community plan against an agreed scenario. See writing a continuity plan and writing a community emergency plan.