Resilience and BCM exercises are the lifeblood of BCM programs. That's where the rubber meets the road, where you find out whether the plans and recovery strategies you've built actually hold up when teams are under real pressure.
Yet even as incidents and disruptions grow more complex and harder to predict, exercise programs are still treated like a box to check. The tabletop gets scheduled and run. Someone writes up an after-action report, twenty-some findings, and files it away, as if it were just another meeting, its minutes kept as proof it happened. Six months later, nobody can tell you which of those findings actually got closed. The exercise happened, the file proves it, but the organization is not one bit more prepared than it was the day before you ran it.
If that sounds familiar, you haven't failed at anything. You're running the program the way most BCM teams are set up to run it.
As Nico Prösti, Fortiv's Head of BCM Solutions, put it, many organizations end up rewarding activity instead of improvement. Regulatory deadlines, audit findings, and annual exercise calendars create pressure to move quickly, until "motion becomes confused with progress." In a crisis, he argues, that confusion becomes expensive.
For most practitioners, the challenge is compounded by limited resources. Teams of one to four people are often expected to support organizations with tens of thousands of employees and hundreds of critical processes. Under those conditions, success becomes defined by coverage: complete the exercises, satisfy the audit, move on to the next business unit. But resilience isn't built through cadence. It's built through learning.
To understand what separates exercises that merely satisfy compliance from those that genuinely improve resilience, we spoke with three practitioners who have spent decades designing and running exercise programs for complex organizations: Regina Phelps, founder of EMS Solutions; Mike Janko, former Director of Global Business Continuity at Goodyear and author of Excellence in Operational Resilience; and Nico Prösti, Head of BCM Solutions at Fortiv and ex-Deloitte BCM consultant.
Design for discomfort, not applause
Mike Janko has spent decades thinking about exactly that distinction, across more than 40 years running business continuity for global organizations. He puts the difference between a real exercise and a scheduled one about as plainly as anyone can: "A completed exercise proves you held a meeting. A closed corrective action proves you are becoming more resilient."
It's a distinction many organizations overlook.
According to Janko, effective exercises share three characteristics. The right decision-makers are in the room, not just the business continuity team, but the people who will actually make decisions during a crisis. The scenario reflects a credible threat rather than whatever happens to be dominating the news cycle, and, perhaps most importantly, everyone enters the room committed to acting on whatever weaknesses the exercise exposes. Miss any one of those elements and the exercise risks becoming little more than a well-organized discussion. "If it goes perfectly," Janko adds, "you probably didn't challenge yourself enough."
Phelps has designed more than 3,700 exercises over her career, and she has a name for the discomfort a good one should produce: the exercise hangover. Years ago, she ran an executive exercise where she'd been asked to tie everything up neatly at the end, so people would walk out feeling good. She went along with it, despite her own reservations, and the team worked hard through a genuinely difficult problem to reach a resolution. As the CEO left the room, he told her it had been a great exercise. Then he stopped, turned around, and said, "You know what? It wasn't that bad."
That single line was what made Phelps reconsider her approach. If the CEO walked away thinking it hadn't been so bad, the neat, feel-good ending had worked too well; it let him off the hook before the scenario had really landed. From then on, Phelps stopped tying her exercises up in a bow. "I can actually make them leave the room with what I call an exercise hangover," she said. "Then I get a lot more out of that experience than if I make them feel good."
A well-designed exercise shouldn't reassure people. It should leave them questioning assumptions they didn't realize they held.
The findings still need somewhere to go
Exposing uncomfortable truths is only half the equation. You can run the sharpest exercise your organization has ever seen and walk away with twenty precise, uncomfortable observations, and still accomplish nothing if nobody has the standing to make the organization act on them.
This is where many BCM programs stall. Small continuity teams often lack the organizational influence to ask business leaders to commit time, budget, or resources to corrective actions. The exercise succeeds. The follow-up doesn't. Phelps sees the problem repeatedly. "Many times the individuals in the business continuity or crisis management space don't have enough weight in the organization to go into a vice president's office," she says. Without executive sponsorship, or a governance structure capable of assigning ownership and tracking remediation, even the best-designed exercise becomes another report on a shared drive.
Building buy-in before you have it
So what do you do if you don't have a governance committee or an executive sponsor waiting to be assigned to you? You build the case for one, starting well before anyone gives you permission.
Phelps calls this covert marketing. Set up Google Alerts for competitor activations and industry incidents. When something happens somewhere else, use it: send a note, start a conversation, show your organization what happened and ask whether the same thing could happen here. "Don't be passive," she said. "Talk about what you're doing. Provide the value every day." Most organizations activate their plans once every few years at most, so waiting for a real event to prove your worth means waiting a long time. You have to create the visibility yourself, in the gaps between.
Janko's advice runs in the same direction: start smaller than feels comfortable. Take an existing meeting, a safety briefing, a team standup, and add five minutes to it: "If we lost access to Outlook right now, how would we communicate?" Assign an owner to whatever gap that question surfaces. Bring the answer back next time. Do that consistently and word gets around. "Before you know it, it's a pull, it's not a push," Janko said. Ask for an hour instead of a six-figure exercise budget, and show the value every time you get one.
Both halves, together
The practitioners all arrive at the same conclusion from different directions. Exercises don't build resilience because they're realistic. They build resilience because realistic exercises reveal weaknesses that organizations are willing and able to fix.
That requires two things working together. Exercises that are honest enough to make people uncomfortable. Governance that is strong enough to turn uncomfortable discoveries into completed corrective actions. Without the first, exercises become theater. Without the second, they become documentation.
Real resilience begins only when both come together.
The full conversation this piece draws from, including Regina Phelps and Mike Janko's remarks on governance, scorecards, and closing the loop on exercise findings, is available in the on-demand recording of the webinar, "Building BCM Exercise Programs That Demonstrate Resilience."
