What to Do After a BCP Test

After a BCP test, the step before signing off the revised plan is to compare the test brief with one critical service's full delivery chain. A test can succeed while the service it was meant to protect remains unable to run. That happens when the exercise checks your own recovery but leaves an essential partner outside its scope.

A business continuity plan test checks whether agreed procedures can maintain or restore critical services under specified disruption conditions.

Record the exercise results before revising the plan

Begin with the agreed exercise objectives. Write down what participants were asked to demonstrate and what they actually did. Keep the original test brief with the results. Without it, a later reader cannot tell whether a successful result covers the service they need to approve.

Capture observations while participants can still explain them. Record the point at which work stopped, the workaround used and its result. Separate something demonstrated during the exercise from something participants said they could do. A discussion about restoring a system does not establish how long the restoration takes.

FEMA's exercise improvement guidance pairs an after-action report with an improvement plan. It describes corrective actions as work that needs continued monitoring and implementation. That gives the debrief a practical purpose: turn an observed weakness into work someone must complete.

Give each correction an owner and a completion date. Specify what evidence will show it works. Updating a phone number needs a different check from changing an entire recovery procedure. Where a finding changes the plan, identify who must receive the new version and which old instructions must be withdrawn.

Preserve the difference between a corrected document and a demonstrated recovery capability. A revised instruction can be accurate while the people expected to use it still lack access, equipment or time. The same distinction matters after a crisis management exercise.

Put unresolved findings before the person responsible for accepting the recovery plan. State the affected service and the consequence of leaving the finding open. Do not let a completed debrief imply approval that nobody has given.

Before closing the exercise, check what its result actually allows the service owner to conclude. The answer must refer to the tested conditions, rather than an unrestricted statement that the plan works.

The Walk helps you check whether your BCP test covers the external handoffs your critical service needs. Start the Walk →

A tested workaround needs a defined service target

A properly run test gives useful evidence. It can reveal whether staff find the plan, understand their responsibilities and complete a recovery action. It can show a delay that a written procedure concealed. Those findings deserve correction even when the exercise has a narrow scope.

The Northern Ireland government's testing guidance recommends credible, challenging scenarios. It also calls for clear testing criteria and a plan for correcting findings. It advises organisations that outsource work to assess whether the provider's continuity plan is compatible with their own.

For example, a test may demonstrate that staff can take orders by telephone when an online portal fails. That is useful. Before adopting the workaround, the service owner must also decide what volume it needs to handle and how long customers can wait. This is an illustrative example, not a reported case.

A workaround has to meet the service requirement, rather than merely be available. If the exercise processes one order, report that result. Do not infer that the same arrangement can process a full day's demand. Ask what further evidence the approval decision needs.

The risk assessment should help identify which service interruptions matter. Its priorities can then inform the next exercise. A scenario analysis can suggest conditions to include, but the test brief still needs a defined service outcome.

Keep the successful result and state its limits. That allows the organisation to use evidence it has earned while directing the next test toward an important unanswered question.

What did WannaCry disrupt without infecting the trust?

County Durham and Darlington NHS Foundation Trust was not directly attacked during WannaCry on 12 May 2017. Yet other organisations closed network access to protect themselves. The trust's NHS England case study describes disruption to services that depended on those connections.

The patient transport booking portal became unavailable. Staff could not transfer CT and MR scans to tertiary centres. Automated blood-result transfers also failed. Local protection did not preserve every connection required to deliver care.

Staff used telephone bookings for patient transport. Images went onto DVDs and travelled by taxi. Blood results reverted to paper, which slowed the process. The response maintained alternative ways of moving work, with different demands from the usual digital arrangements.

The trust updated its continuity plans. Changes included direct-dial numbers for transport bookings and arrangements for transferring images by DVD. The case study says shared services require organisations to understand their interdependencies and align their plans.

The account does not document a formal BCP test before WannaCry. It cannot support a claim that the trust passed an exercise which missed these dependencies. It does show why an organisation's unaffected systems cannot, by themselves, establish that a shared service will continue.

For a service owner reviewing a test, the relevant question is therefore broader than whether the local recovery steps worked. Did the exercise include the handoffs needed to complete the service? A partner can become unavailable because it protects its own network, even when your organisation has no technical fault to repair.

Include a partner's protective shutdown in the service frame if that shutdown can stop delivery. The next test can then examine an agreed alternative handoff. Record who starts it and whether the receiving organisation can use what arrives.

This is also a reason to keep operational recovery separate from the decisions required when disruption becomes a business crisis. A restored application might leave managers choosing which delayed work takes priority. That choice needs a service objective and a person authorised to make it.

The scope of the test must match the scope of the recovery claim. For a technical recovery claim, check whether the restore evidence covers the loss scenario. If the exercise covered only internal systems, describe it that way. The remaining service dependencies become work to check before wider approval.

Compare the test brief with the full delivery chain

Take the critical service named in the opening action. Write its required outcome in plain words. Start at the request for that service and follow the work until the recipient gets the result. Include the external handoffs along the way. Keep this to one service initially so the comparison produces a usable answer.

Put the test brief beside that chain. Mark which handoffs the exercise actually included. For each excluded handoff, ask whether its loss would prevent the agreed outcome. NHS England's continuity toolkit explicitly calls for understanding internal and external service dependencies and clarifying the system's scope.

Choose the next check from the missing handoff that can stop the service. This may mean testing a manual exchange with a partner, confirming access to an alternative booking route, or running a focused exercise. Use the least disruptive check that supplies the evidence needed for approval.

Where a partner must take part, agree the conditions together. Check whether your fallback depends on the same unavailable network. Give the service owner the resulting evidence before signing the recovery plan. If the evidence remains incomplete, record the limitation and the temporary arrangement being accepted.

The Universal Decision-Making Method starts by making the decision's frame clear. Here the decision concerns continuing the whole service, so the frame must include whoever supplies an essential part of it. A list of identified risks can support that work, but cannot set the exercise boundary by itself.

Close the exercise with a clear statement of what was demonstrated and what still needs checking. Revisit that statement when an essential partner or delivery route changes. The next recovery approval then rests on current service conditions.

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.