Exercising a continuity plan: the requirement organisations under-do

Start with a tabletop: the response team, a realistic scenario, and somebody taking notes on what nobody could answer. It costs a couple of hours and reliably exposes the undocumented dependency, the out-of-date contact list, and the decision nobody is sure they can make.

Then escalate: a functional test of one recovery path, then a live test where the risk appetite allows. The record should say what did not work. An exercise report with no findings suggests either an unambitious exercise or an unrecorded one, and an auditor will read it the second way.