VII.C Exercise and Test Strategies
Management should develop exercise and testing strategies that demonstrate the entity’s ability to support connectivity, functionality, volume, and capacity using alternate facilities. The strategies should include expectations for individual business lines and use of exercise and testing methodologies and scenarios. Testing strategies should encompass internal and external dependencies, including activities outsourced to domestic and foreign-based third-party service providers. Management should test all aspects of the entity’s BCP. Strategies may include:
- A multi-year plan to execute the specific depth and breadth of exercises and tests to identify gaps in the program by using different methodologies and scenarios over time.
- Expectations for testing internal and external recovery dependencies.
- Assumptions, methodologies, and exercises used to develop the test strategies.
Lessons learned from natural disasters and other events show that for critical business functions, testing strategies should include transaction processing and functional testing to assess the recoverability of infrastructure, capacity, and data integrity. Regardless of the recovery strategy used, management should regularly test recovery provisions commensurate with the risk to the entity and, where applicable, the overall financial service sector.
VII.B Exercise and Test Policy
VII.D Exercise and Test Objectives