The purpose of basing a BCP test on a specific scenario is to create an element of realism by simulating a threat scenario that could significantly affect the organisation. Simulations introduce a realistic stress level so that plans and delegates are challenged in a robust and meaningful way.

 

A scenario can be thought of as a root cause - the event that created the impact on our organisation, and which resulted in an operational impairment on people, processes and things that is significant enough to warrant invoking incident management and business continuity plans. So when considering a BCP test scenario we need to make sure that it adds realism and relevance to the BCP test.

​

To do this we need to consider two things: what the precise BCP test scenario is and what impact it will have.  The  impact of the chosen scenario will have a significant bearing on the usefulness of the test: if the impact is too small, then the BCP test will become a “near miss” and will not require the business continuity plan to be invoked. An excessively large impact could become overwhelming – meaning that the BCP test is halted because the planned impact creates a “meltdown” that cannot be managed.

​

Below we provide a list of scenarios categorised by the impact they can create:

 

BCP test scenarios that can be used to support BCP tests where the primary impact is loss of access to buildings or workplace:

​

Power failure

Road closure

Fire

Flood

Bomb / bomb scare

Water services outage or infection

Gas leaks

Terror Attack

Structural damage to buildings (caused by weather or accidental damage)

 

BCP test scenarios that can be used to support BCP tests where people are the primary impact

​

Contagious illness

Strike

Transport outage

 

BCP test scenarios that can be used to support BCP tests where critical infrastructure is the main impact

​

Power failures

Hardware failure

Cyber attack

Critical application failures

External telecoms failures

 

Of course, some of these scenarios can impact more than one thing – a flood can not only damage or deny access to the workplace it could affect IT systems and external networks. These considerations will be part of the BCP test objectives and the BCP test plan. 

​