30 Nov, 2009
Tick Box Testing
Posted by: pdjamez In: Agile Continuity|BCM|Embedding|Strategies|Thoughts
For many of the people I have spoken to regarding the BCM process, the exercising of their plans has a number of expected outcomes. The first is validation and the second is staff training. If you look to the standards then there is a third outcome, that of identifying vulnerabilities within the current response. For my money it is the third outcome that requires more emphasis.
The role of a Business Continuity Co-ordinator is often misunderstood. It is not their job to develop any of the organisation’s responses but to develop and maintain the process by which business resilience is delivered. Please excuse the bluntness but the clue is in the title.
In a single project there are one or more deliverables that need to be tested against a specification. This testing confirms the value delivered by the project. It is often apparent that the co-ordinator feels responsible for the quality of the output of the planning process, but this I would argue is the wrong perspective. Their responsibilities lie with the efficacy of the process and it’s continual improvement. Business continuity is not a project management process with a single output but is infact an iterative process. Testing therefore has a different meaning, especially from the perspective of the co-ordinator. If you are using testing as a validation process then you are creating a tick box culture that will limit your ability to develop a resilient organisation.
Testing is not about validation, it is an opportunity to identify weaknesses in the existing plans and procedures. If you do not find a vulnerability in your response during an exercise then the exercise is at fault and you need better testing. At this point I’ll take the opportunity to point to a recent post by Ken Simpson at Contemplating…. Blog regarding the the High Reliability School of thought. New Zealand’s Resilient Organisations group noted a preoccupation with failure and a need to encourage reporting errors and near misses as a critical success factor. I can’t think of a better more controlled way of identifying vulnerabilities than during an exercise where the resulting impact is close to zero.
Oops, missed this excellent post by Stoneroad on validation. Check out The Six Questions of Validation. Note to self check Google Reader before posting.
Related posts:
Recent Comments