Skip to content

Exercises

Where to find it: Operational Resilience, then BCM & Resilience (/bcm), then Exercises.

An Exercise (EXE-YYYY-NNNN) is where a continuity plan stops being a document and becomes evidence — or fails to.


What an exercise records

FieldPurpose
Business referenceEXE-YYYY-NNNN
Business service and planWhat was tested
Exercise typeTabletop, walkthrough, simulation, full failover, component test
Scheduled and actual datesWhen it was planned and when it happened
Target RTO and target RPOThe objectives being tested against
Tested RTO and tested RPOWhat was actually achieved
RTO and RPO target metWhether each objective was met
ParticipantsWho took part
ObservationsWhat was learned
EvidenceLinked artefacts
StatusIts governance state
Historical snapshotsImmutable frozen state at sign-off

Target versus actual

This is the heart of the record, and the reason the fields are held separately.

The target is preserved as the standard of record

When a tested recovery time or data loss exceeds the target, the target is not changed. The exercise is marked as failed or as a breach.

Moving an RTO from 240 to 400 minutes because a test achieved 380 converts a failed test into a passed one and quietly lowers the organisation's stated resilience. Changing a recovery objective is a governance decision requiring BIA approval, not a side effect of a disappointing exercise.


Exercise status and the truthfulness chain

StateMeaning
ScheduledPlanned; not completed
In progressBeing conducted
CompletedConducted; results recorded
PassedCompleted and targets met
Failed / breachCompleted and targets not met

A scheduled exercise is never treated as completed or passed

An exercise scheduled for next quarter contributes nothing to tested capability today. A service whose only exercise is in the future reports not tested.


Breach handling

When an exercise breaches its targets, OrviQ raises a breach signal. It does not silently create records.

Human-gated creation: a person decides whether the breach warrants a finding and an action plan, and creates them explicitly.

Remediation does not convert a failed exercise to passed

Completing a remediation action does not close the finding, and closing the finding does not turn the failed exercise into a passed one.

The exercise result is a historical fact about what happened on that day. Demonstrating recovery capability requires retesting — a new exercise.


Exercise findings and actions

Exercises can raise their own findings and actions, which become canonical findings and action plans in the shared registers.

An exercise that produces no observations is usually an exercise that was not testing anything difficult.


Sign-off

Conduct and record test, then independent review and sign-off, optionally escalating to executive sign-off, then approved or rejected.

Segregation of duties: whoever conducted and recorded the exercise cannot sign off its results. Sign-off requires bcm.exercise_signoff.

On sign-off an immutable snapshot freezes the result — targets, actuals, observations, participants and reviewer.


Choosing exercise types

TypeTestsCostRealism
TabletopDecision-making and rolesLowLow
WalkthroughProcedure correctnessLowLow
Component testOne technical capabilityMediumMedium
SimulationEnd-to-end response without production impactHighHigh
Full failoverActual recovery capabilityHighestHighest

A programme consisting entirely of tabletops has never tested recovery. A programme consisting entirely of full failovers is unaffordable and will not run. Most organisations need a mix, with the depth matched to service criticality.


Permissions

ActionPermission
View exercises and resultsbcm.read
Plan, schedule, coordinate and execute exercisesbcm.exercise_manage
Sign off exercise resultsbcm.exercise_signoff
Generate advisory AI scenariosbcm.ai_assist

Requires the bcm_resilience entitlement.


Example

Exercise EXE-2026-0009 — Retail Payments secondary-site failover.

ElementValue
TypeFull failover
PlanBCP-2026-0004 v2.1
Target RTO240 minutes
Target RPO5 minutes
Tested RTO312 minutes
Tested RPO3 minutes
RTO target metNo
RPO target metYes
ResultBreach

Observations:

  1. DNS propagation took 41 minutes longer than the plan assumed; the plan cited an internal TTL that had been changed by a network team eight months earlier.
  2. Two of four recovery team contacts were out of date; escalation to deputies cost 22 minutes.
  3. Degraded-mode authorisation performed above the MBCO threshold throughout.

Human-gated records created:

RecordDetail
FND-2026-0141Plan activation assumptions not validated against current network configuration
FND-2026-0142Recovery team contact details out of date
ACT-2026-0288Add network configuration validation to the plan review checklist
ACT-2026-0289Verify contacts at every plan review, not only at exercise

What did not happen: the target RTO was not moved to 320 minutes. It remains 240, and the service reports a breached RTO until a retest demonstrates otherwise.

Six weeks later: EXE-2026-0014, a component retest of the failover path only. Tested RTO 198 minutes, target met. Tested capability now reports current and passing.

Observation 3 is worth as much as the two failures

The exercise proved the MBCO was achievable in degraded mode — which is a genuine, evidenced resilience capability that the organisation previously only assumed.


Troubleshooting

"A scheduled exercise is not improving my resilience posture." Correct. Scheduled is not completed. Tested capability requires a completed exercise.

"The finding is closed but the exercise still shows as failed." Exercise results are historical facts. Demonstrating recovery requires a retest.

"I cannot sign off an exercise I ran." Segregation of duties.

"Can I adjust the target to match what we achieved?" Only by changing the BIA through its own governed approval, with the business justification that a longer outage is now acceptable. It is not an exercise-record edit.


OrviQ Enterprise Governance, Risk & Compliance Platform