This free business continuity plan testing checklist is for business continuity managers, risk and resilience leads and operations directors who have to show the plan works. It takes each exercise from start to finish: objectives drawn from the business impact analysis, a short scenario, the right people in the room, a facilitated run with observers, the hot wash, a post-exercise report, and the updates that follow to the plan, the BIA and the training schedule. The exercise type you choose changes the checklist. A tabletop stays discussion-only, while functional and full-scale exercises add a phase of controls for work done live. In the annual cycle a final phase covers the programme review and plan sign-off. The output is a post-exercise report, an action log with named owners and a plan whose version history shows it was tested and improved.
Business continuity asks how the organisation keeps delivering its prioritised activities during a disruption: people, premises, suppliers, communications and the manual workarounds that run while systems are down. IT disaster recovery asks how the technology comes back. The two meet at the recovery times in the business impact analysis, but they are tested by different people in different ways. A continuity exercise puts heads of department in a room, or at an alternate site, and asks what they would do. A DR test puts engineers in front of a restore console.
ISO 22301:2019, the international standard for business continuity management systems, requires an exercise programme in clause 8.5. Exercises are based on appropriate scenarios with defined objectives, run at planned intervals, and each one produces a formal post-exercise report. This checklist is built around that cycle and deliberately stops short of the technology. The IT recovery capability is assessed by the Disaster Recovery Audit Checklist, and routine restores are proved by the Backup Verification & Restore Test Checklist.
Who takes part: heads of function and their deputies, the crisis team, communications, facilities and HR.
What it tests: decisions, escalation, workarounds, call trees, alternate working and supplier contact.
Output: a post-exercise report, an updated plan and BIA, and training actions.
Who takes part: infrastructure engineers, application owners and hosting or cloud providers.
What it tests: restores, failover, replication and recovery runbooks.
Output: measured recovery times against RTO and RPO, and technical remediation.
The two should be exercised together from time to time. A full-scale exercise in which the business runs its workarounds while IT performs a real recovery is the only way to find out whether the recovery times the business was promised match the ones IT can deliver. Our disaster recovery checklist guide covers the IT side of that planning.
Six phases take each exercise from objectives to an updated plan. Phase 3 appears only for functional and full-scale exercises, and Phase 7 only in the annual review cycle.
The exercise type chosen here decides whether Phase 3 appears.
Shown only when the exercise type is functional or full-scale. A tabletop touches nothing live, so it skips this phase.
Shown only when the exercise record is marked as the annual review. It looks across the whole year rather than at a single exercise.
NIST SP 800-84 divides exercises into two families. Tabletop exercises are discussion only: a facilitator presents a scenario and participants talk through their roles and responses without deploying equipment. Functional exercises have people perform their duties in a simulated operational environment, and range from one aspect of a plan up to full-scale exercises that cover every element. FEMA’s Homeland Security Exercise and Evaluation Program (HSEEP) draws the same line between discussion-based and operations-based exercises.
| Exercise type | What happens | What it can prove | Effort |
|---|---|---|---|
| Plan walkthrough | Plan owners step through the plan with a facilitator, section by section | The content is current and each role holder understands their part | Low: an hour or two |
| Tabletop exercise | A scenario and timed injects are discussed; nothing is touched live | Decision-making, escalation, communications and gaps between teams | Low to moderate: half a day |
| Functional exercise or drill | Selected teams carry out specific procedures, such as a call cascade or relocation | Individual procedures work in practice and within target times | Moderate: needs live controls |
| Full-scale exercise | Several functions activate the plan together, with relocation and IT recovery | The plan works end to end, including the handoffs between teams | High: weeks of planning and executive sponsorship |
A good programme mixes the types over a cycle rather than repeating the same tabletop every year. A common pattern is a walkthrough whenever a plan changes, tabletops for each critical function through the year, and a functional or full-scale exercise for the most time-critical activities. For scenarios, CISA publishes free Tabletop Exercise Packages (CTEPs) covering threats such as ransomware, insider threats and natural disasters, each with template objectives, discussion questions and an after-action report template.
A dropdown for the exercise type drives conditional logic: live exercise controls appear only for functional and full-scale exercises, and the annual review phase only when the record is marked annual. Template versioning keeps a history of how the exercise process itself has changed.
Observers record decisions and timings in a table inside the task, add comments, and attach photos of whiteboards and call logs. The activity trail shows who recorded what and when, so the post-exercise report is drawn from evidence rather than recollection.
Each action is assigned to a named person or group, with a due date calculated from the exercise date. Open actions stay visible until they are closed with evidence, and a recurring schedule starts the next exercise in the programme on time.
Continuity and disaster recovery share a business impact analysis but not a test. Our disaster recovery checklist guide sets out how the DR plan, the runbooks and the BCP fit together, and the Disaster Recovery Audit Checklist assesses the IT side once a year.
Exercises often expose weaknesses in the live response. The Incident Management Checklist covers how an incident is handled and escalated, and the ISO 27001 Compliance Checklist includes Annex A 5.30, which requires ICT readiness to be planned, implemented, maintained and tested against business continuity objectives.
ISO 22301 requires exercises at planned intervals, so your programme sets the frequency and auditors check you keep to it. NIST SP 800-34 recommends testing contingency plans annually and after significant organisational or system changes. In practice most organisations exercise each critical plan at least once a year, run shorter tabletops or walkthroughs more often, and add an exercise after a major change such as an office move or a new outsourcing arrangement.
A tabletop exercise is discussion only. Participants talk through how they would respond to a scenario and nothing live is touched. A functional exercise has people actually perform their duties in a simulated environment: running the call cascade, relocating to the alternate site or working from the manual workaround. Tabletops are cheaper and good for testing decisions and coordination. Functional exercises prove the procedures work and how long they take.
The background (purpose, objectives, participants and scenario), what the observers saw, the points raised in the hot wash, a grade for each objective, and recommendations for improving the plan. NIST SP 800-84 describes the same contents for an after-action report. The report is only useful if every recommendation becomes an action with an owner and a due date, which is why Phase 5 converts them before the report is circulated.
The people named in the plan being exercised, and their deputies. For a crisis management tabletop that means senior decision-makers and communications. For a departmental exercise it means the function head and the staff who would run the workaround. Add a facilitator who knows the plan well and at least one observer who takes no part in the play and records what happens against the objectives.
Yes. Clause 8.5 requires an exercise programme that validates the effectiveness of business continuity arrangements over time, and post-exercise reports are among the documents the standard requires you to keep. The business impact analysis sits in clause 8.2, which is why Phase 6 feeds exercise findings back into it.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
