Appearance
Exercises
Where to find it: Operational Resilience, then BCM & Resilience (/bcm), then Exercises.
An Exercise (EXE-YYYY-NNNN) is where a continuity plan stops being a document and becomes evidence — or fails to.
What an exercise records
| Field | Purpose |
|---|---|
| Business reference | EXE-YYYY-NNNN |
| Business service and plan | What was tested |
| Exercise type | Tabletop, walkthrough, simulation, full failover, component test |
| Scheduled and actual dates | When it was planned and when it happened |
| Target RTO and target RPO | The objectives being tested against |
| Tested RTO and tested RPO | What was actually achieved |
| RTO and RPO target met | Whether each objective was met |
| Participants | Who took part |
| Observations | What was learned |
| Evidence | Linked artefacts |
| Status | Its governance state |
| Historical snapshots | Immutable frozen state at sign-off |
Target versus actual
This is the heart of the record, and the reason the fields are held separately.
The target is preserved as the standard of record
When a tested recovery time or data loss exceeds the target, the target is not changed. The exercise is marked as failed or as a breach.
Moving an RTO from 240 to 400 minutes because a test achieved 380 converts a failed test into a passed one and quietly lowers the organisation's stated resilience. Changing a recovery objective is a governance decision requiring BIA approval, not a side effect of a disappointing exercise.
Exercise status and the truthfulness chain
| State | Meaning |
|---|---|
| Scheduled | Planned; not completed |
| In progress | Being conducted |
| Completed | Conducted; results recorded |
| Passed | Completed and targets met |
| Failed / breach | Completed and targets not met |
A scheduled exercise is never treated as completed or passed
An exercise scheduled for next quarter contributes nothing to tested capability today. A service whose only exercise is in the future reports not tested.
Breach handling
When an exercise breaches its targets, OrviQ raises a breach signal. It does not silently create records.
Human-gated creation: a person decides whether the breach warrants a finding and an action plan, and creates them explicitly.
Remediation does not convert a failed exercise to passed
Completing a remediation action does not close the finding, and closing the finding does not turn the failed exercise into a passed one.
The exercise result is a historical fact about what happened on that day. Demonstrating recovery capability requires retesting — a new exercise.
Exercise findings and actions
Exercises can raise their own findings and actions, which become canonical findings and action plans in the shared registers.
An exercise that produces no observations is usually an exercise that was not testing anything difficult.
Sign-off
Conduct and record test, then independent review and sign-off, optionally escalating to executive sign-off, then approved or rejected.
Segregation of duties: whoever conducted and recorded the exercise cannot sign off its results. Sign-off requires bcm.exercise_signoff.
On sign-off an immutable snapshot freezes the result — targets, actuals, observations, participants and reviewer.
Choosing exercise types
| Type | Tests | Cost | Realism |
|---|---|---|---|
| Tabletop | Decision-making and roles | Low | Low |
| Walkthrough | Procedure correctness | Low | Low |
| Component test | One technical capability | Medium | Medium |
| Simulation | End-to-end response without production impact | High | High |
| Full failover | Actual recovery capability | Highest | Highest |
A programme consisting entirely of tabletops has never tested recovery. A programme consisting entirely of full failovers is unaffordable and will not run. Most organisations need a mix, with the depth matched to service criticality.
Permissions
| Action | Permission |
|---|---|
| View exercises and results | bcm.read |
| Plan, schedule, coordinate and execute exercises | bcm.exercise_manage |
| Sign off exercise results | bcm.exercise_signoff |
| Generate advisory AI scenarios | bcm.ai_assist |
Requires the bcm_resilience entitlement.
Example
Exercise EXE-2026-0009 — Retail Payments secondary-site failover.
| Element | Value |
|---|---|
| Type | Full failover |
| Plan | BCP-2026-0004 v2.1 |
| Target RTO | 240 minutes |
| Target RPO | 5 minutes |
| Tested RTO | 312 minutes |
| Tested RPO | 3 minutes |
| RTO target met | No |
| RPO target met | Yes |
| Result | Breach |
Observations:
- DNS propagation took 41 minutes longer than the plan assumed; the plan cited an internal TTL that had been changed by a network team eight months earlier.
- Two of four recovery team contacts were out of date; escalation to deputies cost 22 minutes.
- Degraded-mode authorisation performed above the MBCO threshold throughout.
Human-gated records created:
| Record | Detail |
|---|---|
FND-2026-0141 | Plan activation assumptions not validated against current network configuration |
FND-2026-0142 | Recovery team contact details out of date |
ACT-2026-0288 | Add network configuration validation to the plan review checklist |
ACT-2026-0289 | Verify contacts at every plan review, not only at exercise |
What did not happen: the target RTO was not moved to 320 minutes. It remains 240, and the service reports a breached RTO until a retest demonstrates otherwise.
Six weeks later: EXE-2026-0014, a component retest of the failover path only. Tested RTO 198 minutes, target met. Tested capability now reports current and passing.
Observation 3 is worth as much as the two failures
The exercise proved the MBCO was achievable in degraded mode — which is a genuine, evidenced resilience capability that the organisation previously only assumed.
Troubleshooting
"A scheduled exercise is not improving my resilience posture." Correct. Scheduled is not completed. Tested capability requires a completed exercise.
"The finding is closed but the exercise still shows as failed." Exercise results are historical facts. Demonstrating recovery requires a retest.
"I cannot sign off an exercise I ran." Segregation of duties.
"Can I adjust the target to match what we achieved?" Only by changing the BIA through its own governed approval, with the business justification that a longer outage is now acceptable. It is not an exercise-record edit.