It happens all the time: Organizations invest huge amounts of money, time, and effort into designing a top-notch business continuity program and then half-heartedly train employees to carry out recovery plans. Their assessment of this process: Mission accomplished.
I would argue it’s an incomplete victory. Without an effective training program followed by the right level of business continuity testing, there’s little chance that your employees would know enough to successfully carry out your plan. It’s like having enough life jackets to save everyone—but not telling people where to find them or how to use them.
Business continuity training and testing go hand-in-hand. Skip these entirely and your plan is guaranteed to fail. And implementing one without the other—training without testing—is risky business, too; how can you be sure the training worked? Both must be used in concert to ensure the overall success of your plans.
The only way you can be sure your employees will do what they’re supposed to do in the event of a disruption is to teach with the end result in mind. Think through what you need them to do, train them to do it, and test them to be sure they can perform. To do that you’ll need to set appropriate learning objectives.
In the case of business continuity training, learning objectives are set based on what you want your employees to do if a disruption were to occur. Because training encompasses all levels of your organization, learning objectives will vary based on different audiences. In general, however, good learning objectives have these two characteristics:
For an incident management team training class, for example, attendees may be required to learn how to do the following:
Train general employees yearly, focusing on basic directives, such as who to call in case of a disaster, contact information for the parties in charge, and how to evacuate the building. Senior executives usually play a more critical role in recovery, requiring them to learn crisis management skills. Their training should be more frequent and in-depth to ensure that they can meet expectations in a time of need.
I always recommend in-person training over methods like emailing material to a group, for example. Live training is more impactful, as long as you don’t waste people’s time. Training sessions should be focused and to the point, covering only those things people need to do and remember. And find someone capable of delivering the material in a way that catches the audience’s attention—otherwise, you’ll lose people quickly.
Start testing shortly after training. If the test aligns with your learning objectives, you’ll know definitively if your employees can execute recovery plans—or if you need to provide further training. Again, keep in mind that testing is an opportunity for your employees to practice what they are learning.
Two types of testing should be used in succession:
Some organizations add to (or, in some cases, replace) the tests above with knowledge testing—multiple choice tests on paper. As someone who maneuvered through one too many grade school tests using the sheer power of memorization, I can tell you that memorization doesn’t have anything to do with real learning. (Plus, giving written tests isn’t likely to boost your popularity among coworkers.) Desktop testing followed by live testing delivers the best results.
Effective training and rigorous testing are critical components of all business continuity programs. For more information and resources that can help support your BC program—including tools for measuring compliance and residual risk, as well as conducting a Business Impact Analysis—visit BCMMetrics.