On paper, many companies look exactly the same. They have a business continuity plan, complete with sections, appendices and signatures. The differences only become visible when something serious happens. A company whose plan exists only on paper may find itself unable to continue operating. A company with a genuine business continuity plan can restore operations from a defined and regularly tested point in time. It is a stark comparison, but one that accurately reflects what is at stake.

Can resilience be tested without experiencing a real crisis? It can. More importantly, it must be. Resilience should be tested before a crisis because once a crisis begins, it is already too late to learn. Every error identified during an exercise costs a few hours of work. The same error discovered during an incident can cost the company downtime, customers and reputation.

The problem is that most companies either test the wrong things or do not test at all. Testing is often confused with reviewing a document, ticking off a procedure or checking whether systems restart successfully. These are all useful activities, but none of them shows whether the company can continue operating after losing control of its environment.

Effective testing begins with a set of scenarios tailored to the organisation. These scenarios should reflect the real challenges involved in maintaining the continuity of the processes covered by the plan. There is no universal list. A manufacturing company, a healthcare provider and a retail chain face different risks and need to practise different responses.

The fundamental principle is simple: resilience can only be tested by simulating a situation in which control is lost. Checking whether a system operates as planned measures the quality of the plan under the conditions it was designed to address. Resilience is only demonstrated when an exercise introduces a serious disruption: a provider becomes unavailable, the reliability of the data is called into question or the environment must be rebuilt elsewhere.

Such a test provides three things that no document can deliver. First, it reveals what is missing from the plan before those gaps become costly. Second, it prepares people to perform the roles they will need to carry out without hesitation during a crisis. Third, it establishes the most important element: a tested point in time from which the company can restore its operations. Without it, the plan remains a declaration rather than proven capability.

The word regularly matters. A single exercise conducted three years ago only tells us something about the company as it existed three years ago. Environments, people and dependencies change faster than documents, which means the organisation’s proven recovery point must also be regularly revalidated. Testing is not a project to be completed and checked off. It is an organisational habit.

For the management board, this requires a change in how the subject is assessed. Asking whether a plan exists is asking about a document. The right questions are different. When was the plan last tested? What scenario was simulated? What went wrong, and what was done about it? A plan that has never failed during an exercise has most likely never been properly tested.

The difference between a company that is prepared on paper and one that is genuinely prepared is not created on the day of a crisis. It is created long before, in a calendar where exercises were scheduled or in one where there was never enough room for them. A crisis simply reveals whether testing was treated as a priority or repeatedly postponed.