Business Continuity & Disaster Recovery: What Happens When the Plan Actually Gets Tested

Business continuity and disaster recovery plans can look comprehensive on paper but still fail when a real disruption occurs. This practical session moves beyond policy and documentation to examine how auditors can determine whether BCP and DR plans would actually work when tested. Participants will explore how to assess realistic dependencies, validate RTO and RPO targets, evaluate tabletop exercises and live testing, and distinguish genuine organisational resilience from plans that only satisfy compliance requirements. The session also addresses how to translate BCP/DR findings into meaningful governance-level reporting for Boards and Audit Committees, helping organisations identify weaknesses before a real incident puts their continuity plans to the test.

Key Topics Discussed:

• Distinguishing Business Continuity Planning (BCP) from Disaster Recovery (DR)
• Auditing BCP and DR plans through practical testing
• Assessing realistic operational and technology dependencies
• Evaluating whether RTO and RPO targets are achievable
• Identifying gaps between documented plans and actual capabilities
• Reviewing tabletop exercises and live recovery testing
• Determining whether testing genuinely stresses the plan
• Recognising resilience versus compliance-driven planning
• Identifying weaknesses that may emerge during a disruption
• Evaluating governance and oversight of BCP/DR programmes
• Reporting BCP/DR findings to Boards and Audit Committees
• Turning audit findings into practical resilience improvements