BCI blog: Improving exercising by introducing a holistic exercise programme | BCI

When a practitioner implements a management system, such as crisis, emergency, or business continuity management, they will approach the validation process with a standard definition of what an ‘exercise’ is and what they can achieve. Below is one such definition, according to the ISO 22300:2021, ‘Security and resilience’ standard:

Exercise: “Process to train for, assess, practice, and improve performance in an organization.
Note one to entry: exercises can be used for validating policies, plans, procedures, training, equipment, and inter-organizational agreements; clarifying and training personnel in roles and responsibilities; improving inter-organizational coordination and communications; identifying gaps in resources; improving individual performance and identifying opportunities for improvement; and a controlled opportunity to practice improvisation”^[1].

When looking to improve an organization’s exercise programme, we may introduce different methods of simulation and testing. We might also can change the context or introduce new factors to the exercise. In some cases, we might choose to focus it on different aspects of the management system but what if we change the approach instead? For example, what if we don’t consider the programme as a set of fixed exercises throughout the year and instead implement a continuous process? This has been proposed by the ISO 22398:2013, ‘Societal security — Guidelines for exercises’ standard.

One of the main benefits of a holistic, ongoing process is directing the organization towards continuous improvement. From the project design stage to the execution of the last exercise, each phase will be aimed at the defined objectives and identification of the best approach; including the stages of validation, monitoring, and review.

Indeed, at the end of project design, the team and the organization will review the project and take the required actions. The end of each exercise will also conclude with a debrief to identify any opportunity for improvement and the actions that need taking. 

Tips for a holistic exercise programme

When exercising, every moment can be a learning moment and a systematic approach can make the difference in progressively mastering the journey. Here, we will go through a set of tips to help organizations get the best out of their holistic exercise programme.

Tip: keep the programme efficient and lean. 

• The organization should perform a needs analysis to determine the relevant outcomes for an
• exercise programme and/or exercise project(s). An exercise programme or project begins with the organization accepting a need to manage its risks based on the results of a risk assessment. 
• The organization will consider the outcomes of the risk assessment, including it in a situational analysis and collecting relevant information (like risk management and mitigation actions, the organization’s commitments, and concerns expressed by the identified stakeholders and interested parties). During the situational analysis, the organization should seek information to help plan, conduct, and improve its exercise programme and/or projects by considering these issues. 

Identify the exercise activities that have proven to be the most effective in similar situations, while considering the need to evaluate the organization and stakeholder expectations.

Finally, design an exercise programme, choosing the appropriate exercise methods and timing, and optimise the achievement of defined objectives based on the needs analysis.

Tip: take the time to define relevant details.​​​​

• Take your time to define relevant details that can ensure the flowing and linear execution of an exercise. For instance, identify the organizational roles that need to be involved, along with the requested competencies and awareness for each of them. Define the objectives of people’s participation and their responsibilities in the exercise, as well as for the overall programme. Evaluate the necessary resources, not just in terms of people but also spaces, equipment, and arrangements for preparation, execution, and post-exercise activities.
• While designing the exercise programme, consider the feedback from previous exercises, any audit findings, as well as the corrective actions performed in the organization (such as monitoring, measurements, analysis, evaluations, and management reviews, etc.)
• Build synergies in the organization, with the aim of increasing engagement.

Tip: don’t worry about advanced exercises, exercise enhancement, or creating scenarios from past incidents. The important thing is to create a meaningful experience.

• A realistic experience helps to add an increased level of learning potential for participants. This approach to capability development leverages experiential learning, prompting participants to action resilience practices throughout the proposed exercises, which are tailored to the function and level of resilience maturity of the participants. 
• New forms of technology have opened the door to immersive exercises, which may use gaming and AI. These offer a totally different approach to conventional exercises.
• Using discussion or interviews with people who have personally experienced an incident similar to the scenario being exercised can convey and share knowledge. Any of the more unpredictable wider impacts that may arise during this process could become a precious lesson learned.
• Keep to the optimal timing and flow in the execution of the exercise. No matter the level of extension and immersion included in the programme, the priority is to enhance the learning, focused on the defined objectives.

Citations

^[1] https://www.iso.org/obp/ui/#iso:std:iso:22300:ed-3:v1:en