Putting Plans to the Test: Business Continuity and Crisis Management Exercising
Sectors: Manufacturing, Housing, Education, Technology, Research, Logistics, Higher Education | Scope: Tabletop exercises, crisis management training, post-exercise reporting | Outcome: Tested plans, evidenced learning, actionable improvements
A business continuity plan that has never been tested is, at best, a hypothesis. The only way to know whether your organisation can actually respond to disruption — whether the right people know what to do, whether the plan reflects operational reality, whether the decisions that matter can be made under pressure — is to put it to the test in a safe environment before you need it for real.
Exercising is one of Cambridge Risk Solutions’ core service offerings, delivered across a wide range of sectors and organisations, from global manufacturers and technology companies to housing associations, education trusts, and research institutions. Some clients exercise annually as part of their ISO 22301 certification cycle or regulatory requirements. Others return on a less frequent basis, or at moments of organisational change when a refresh feels overdue. The trigger varies; the methodology does not.
The Approach
Every exercise begins before the day itself. Clients share their existing plans in advance, giving Cambridge Risk Solutions the opportunity to review them with fresh eyes — identifying gaps, outdated assumptions, or areas where the plan and operational reality have drifted apart. A conversation about current risks, organisational priorities, and any specific concerns shapes the scenario design, ensuring that what happens on the day is relevant and challenging rather than generic.
On the day, the session opens with a training element tailored to the audience and the organisation. Depending on what the client needs, this might cover crisis management principles, decision-making under pressure, business continuity fundamentals, or the specific frameworks and triggers within their own plan. The goal is to ensure that participants arrive at the exercise with the right mental model — understanding not just what the plan says, but why it is structured the way it is and what good looks like when things go wrong.
The tabletop exercise itself is designed to be realistic, progressive, and uncomfortable in the right ways. Scenarios draw on the specific operational context of the organisation — the dependencies, the vulnerabilities, the decisions that would actually need to be made. Injects develop as the session progresses, introducing complications and time pressure that reflect how real incidents tend to behave. Participants are encouraged to work through decisions rather than simply identify the correct answer from the plan.
In one exercise for a manufacturing client, the scenario involved the simultaneous loss of power and a critical piece of specialist equipment with a lead time measured in months rather than days or weeks. No generic BC template would have anticipated that dependency — and working through the implications in a safe environment, rather than discovering them during an actual incident, was precisely the point. The debrief that followed produced a set of actions that fundamentally changed how the organisation thought about its supplier relationships and its recovery priorities.
The Output
Every exercise concludes with a detailed post-exercise report. This is not a summary of what happened on the day — it is a substantive document that captures findings across the full session, identifies both good practice and areas for improvement, records specific actions for the organisation to take, and makes recommendations for how the plan should be updated and how the next exercise should be designed.
It is the report, as much as the exercise itself, that delivers lasting value. Organisations that return annually often find that the previous year’s report becomes the starting point for the next exercise design — a virtuous cycle of continuous improvement that is exactly what ISO 22301 and good BC practice require.
The Clients
Cambridge Risk Solutions has delivered exercises for organisations across a wide range of sectors, including global semiconductor manufacturing, social housing, multi-academy education trusts, technology, research and innovation, port logistics, and higher education. Some have been exercising with Cambridge Risk Solutions for many years. Others are newer to the process — occasionally referred by existing clients who have found the approach valuable enough to recommend to peers facing similar challenges.
That breadth of sector experience informs the quality of the scenarios. An exercise facilitator who has worked across manufacturing, healthcare, financial services, education and logistics brings a significantly wider frame of reference to scenario design than one who has worked exclusively in a single sector — and that breadth shows in the realism and relevance of what happens on the day.