PP6: Validation – The Difference Between a Plan and Proof
Professional Practice 6 (Validation) shifts Business Continuity from a hypothesis of readiness to verified proof. Learn to structure exercise spectrums, apply the 10-70-20 rule, and prevent plan decay.
GPG 7.0 Series Note: This is Part 6 of our hands-on BCMS implementation series based on the BCI Good Practice Guidelines (GPG Edition 7.0). Having built response architectures and battle cards in PP5: Enabling Solutions, Professional Practice 6 focuses on proving organisational readiness through rigorous exercising, testing, and continuous review (see my original PP6 Validation Learning Notes for CBCI exam preparation).
The GPG 7.0 Overview:
- PP1: Policy and Programme Management
- PP2: Embedding Continuity
- PP3: Analysis (BIA and Risk Assessment)
- PP4: Solutions Design
- PP5: Enabling Solutions
- PP6: Validation <- (You are here)
The Core Objective
For the senior leader, Business Continuity must be reframed from a compliance-driven checkbox to a verified operational capability. True strategic resilience is not found in the mere existence of a plan, but in the verified competence of the organisation to execute it under duress.
Within the Good Practice Guidelines (GPG) 7.0 framework, a plan is merely a "hypothesis of readiness." While Professional Practice 5 (PP5) provides the playbooks, Professional Practice 6 (PP6) is the rigorous discipline of proving—or disproving—the efficacy of the resources and strategies we have deployed.
Validation is the mechanism that measures Competence, defined by the BCI as "the ability to apply knowledge and skills to achieve the intended result." It evaluates the cohesiveness of teams and the quality of the Business Continuity Management System (BCMS). By moving from embedding to Embracing Business Continuity, as established in PP2, we ensure that validation is the physical manifestation of a culture that protects the organisation and its interested parties. True proof of resilience is never found on a shelf; it is discovered only through a structured spectrum of challenge.
The Exercise Spectrum: Matching Intensity to Organisational Maturity
Selecting the appropriate exercise type is a strategic resource allocation decision. Misaligning the exercise type with the organisation's current maturity leads to either a waste of leadership time or unnecessary operational trauma that can undermine a resilience culture. GPG 7.0 defines a clear hierarchy of exercises designed to build competence incrementally:
Discussion-based (Tabletop): Strategic exploration of roles and logic across key stakeholders.
Scenario and Walkthroughs: Tactical validation of specific procedures, such as switching to paper-based assessment materials and manual recording protocols during a primary digital outage.
Simulations: Testing systems and pressure-testing response teams under realistic conditions. For example, validating whether a core enterprise platform can achieve its 1-hour Recovery Time Objective (RTO) through a technical hot-continuity failover.
Live and Full-scale: The ultimate proof of resource and people mobilisation to confirm the organisation can meet its Minimum Business Continuity Objective (MBCO)—the baseline operational capacity required to maintain strategic delivery during a disruption.
Tests: A specific type of exercise that incorporates a formal pass or fail element within its defined objectives.
The strategic risk lies in "jumping the curve"—attempting a live test before completing tabletop exercises. This creates organisational panic rather than capability, bypassing the comfortable learning environment required to build the constructive attitudes found in a resilient culture.
The 10-70-20 Golden Rule: Maximising Return on Investment
In the economics of time, the value of an exercise is not in the "doing," but in the "distilling" of lessons learned. To maximise return on investment (ROI), senior management must enforce the GPG 10-70-20 ratio for all validation activities:
Briefing (10%): Setting aims, objectives, and role clarity to ensure the intended result is clearly understood by all participants.
Execution (70%): The performance phase where we stress-test resource dependencies (People, Technology, Information, Supplies) identified during the BIA.
Hot Debrief (20%): Immediate capture of insights, emotions, and operational gaps while the experience is fresh.
The Hot Debrief is the most critical asset for a senior manager; it represents the intellectual capital of the resilience programme. It is the only way to achieve continual improvement based on qualitative and quantitative measures. Crucially, it serves as the mechanism to prevent Individual Heroics from masking systemic failures. If a process only succeeded because one person worked 20 hours straight, the system has failed, and the hot debrief must capture that vulnerability before it is forgotten.
Safety and Integrity Protocols: Protecting the Organisation and the Individual
Validation requires a "No-Blame Culture." Penalising gaps discovered during exercises incentivises staff to hide vulnerabilities—a terminal risk to the organisation. A psychologically safe environment transforms a "failed" exercise into a "successful" discovery of a hidden vulnerability, which is the hallmark of a resilient mindset.
To protect operational integrity, the following protocols are non-negotiable:
The "No Duff" Rule: A mandatory safety command that serves as an instant halt mechanism. If a real emergency occurs during an exercise, "No Duff" suspends the simulation immediately to ensure life safety and real-world integrity are never sacrificed.
Stop-Start Authority: Ensuring top management is advised of exercise risks and has a documented process to halt activities that deviate from planned parameters.
Maintenance and Expiry: Managing the Resilience Half-Life
Modern business operates at a clock speed that renders static plans obsolete. Validation is the antidote to Plan Decay. Where strict statutory deadlines or regulatory SLA commitments apply, an outdated plan is a precursor to operational failure and reputational disaster.
Senior leaders must view the following triggers as mandatory directives for review:
High-Priority Maintenance: Plans for prioritised activities with RTOs under 24 hours must be validated at least every six months.
Change Triggers: Mandatory review following major technological shifts (such as cloud migrations), office relocations, or supply chain alterations.
Governance Review: Formal quarterly reviews to ensure all plans remain fit for purpose relative to current personnel and dependencies.
Allowing a plan to expire is a leadership failure of governance. The cost of continuous maintenance is a fraction of the catastrophic cost of an outdated response.
Conclusion: Completing the Resilience Loop
As emphasised in the GPG 7.0 Epilogue, a BCMS is a living system, not a static destination. Professional Practice 6 completes the cycle by feeding findings back into the entire framework:
PP1 and PP2: Informing policy and culture based on proven gaps in competence.
PP3 and PP4: Refining Analysis (BIA) and Solutions based on real-world performance data.
PP5: Updating plans to ensure they remain actionable playbooks, not academic theories.
The role of the Executive Leadership Team is not to ask, "Do we have a plan?" but to demand the evidence: "Have we proven it works?" Only through rigorous validation can a leader move from a hypothesis of readiness to the proof of resilience.
What's Next?
With validation complete, the operational loop of the BCI Good Practice Guidelines (GPG 7.0) is closed. The focus now turns to embedding these findings into continuous programme management and long-term enterprise governance.
Previous Step: Read PP5: Enabling Solutions – Turning Blueprints into Actionable Capabilities.
Disclaimer: These are independent study notes compiled to assist candidates preparing for the Certificate of the Business Continuity Institute (CBCI) examination. This content is not officially endorsed, sponsored, or affiliated with the Business Continuity Institute (BCI). The official body of knowledge is the BCI Good Practice Guidelines (GPG) Edition 7.0, which can be sourced directly from the BCI.