Use this tool before a tabletop, simulation or functional exercise to test whether the planned inject set actually supports the exercise objectives. Many exercises have dramatic scenarios but weak evidence because injects are not mapped to decisions, expected actions or evaluation criteria.
What this tool is designed to decide
This interactive BCM.Center tool is intended to support structured professional judgement, not replace it. The result should be used as a documented discussion aid during business impact analysis, recovery strategy design, continuity planning, exercise preparation, incident governance or assurance. The strongest use of the tool is to make assumptions visible, create a repeatable scoring conversation, and expose where evidence is weak or conflicting.
Use current, organization-specific inputs wherever possible. Avoid treating a single numeric result as an approval decision. A mature continuity program should retain the underlying evidence, record who supplied the inputs, identify the review date, and document any management override. Where an input is uncertain, use the more conservative value and record the uncertainty for follow-up.
Interactive assessment
Enter the current values, then calculate. All processing happens in your browser; this tool does not save the values to BCM.Center.
Distinct outcomes the exercise is expected to validate.
Scenario events, messages or changes introduced during play.
Key decisions evaluators expect players to make.
Percentage of injects linked to observable evidence or evaluation points.
Percentage requiring coordination across teams or functions.
How to interpret the result
A high score indicates a reasonable balance between exercise objectives, inject volume, decision opportunities, evidence collection and cross-functional coordination. A low score often means the scenario contains activity but not enough measurable learning. Too many injects can be as damaging as too few because participants spend the exercise processing messages instead of making meaningful decisions and demonstrating procedures.
The numerical output is only useful when the scoring basis is consistent. Re-run the assessment when assumptions, suppliers, staffing, technology, incident conditions, regulatory expectations or recovery dependencies change. If two business owners produce materially different scores for the same scenario, treat the disagreement as a governance issue that needs evidence and facilitation rather than averaging the numbers without discussion.
Recommended corrective actions
- Map every inject to at least one objective, expected action and evaluator evidence point.
- Remove injects that add drama without testing a capability or decision.
- Sequence pressure so the exercise escalates realistically and allows observation of handovers.
- Include at least one inject that challenges a key assumption or fallback arrangement.
- Define how hot-wash observations become corrective actions with owners and due dates.
Corrective actions should be owned, dated and traceable. High-priority actions should connect to the continuity improvement backlog, risk register, exercise program or recovery strategy decision record. Closure should require evidence, not only a status change. Examples of evidence include approved procedures, tested alternate arrangements, supplier commitments, technical recovery results, call-tree tests, staffing rosters and exercise observations.
Governance and assurance
- The exercise director should approve the objective-to-inject matrix before delivery.
- Evaluators should receive evidence criteria and rating guidance, not only the scenario timeline.
- Exercise findings should be traceable to objectives and retained with corrective-action evidence.
Review the assessment at least when the related process, service, dependency or recovery strategy changes. For critical services, consider independent challenge by the BCM function, risk function, technology recovery lead, supplier manager, facilities lead or crisis management team as appropriate. The review should confirm that the inputs remain current and that the resulting treatment is proportionate to the operational consequence.
Common mistakes to avoid
Do not use the tool as a substitute for a BIA, risk assessment, recovery plan or exercise. Do not inflate scores to justify a preferred investment and do not suppress scores to avoid remediation. Avoid combining unrelated services into one assessment because different dependencies and recovery objectives can disappear inside an average. Do not assume that a documented workaround is effective until it has been demonstrated under realistic conditions.
Another common mistake is to confuse availability with recoverability. A supplier, application or facility may be available most of the time but still have weak recovery capability after a severe disruption. Likewise, a plan may exist but depend on unavailable people, inaccessible credentials, untested data restoration or a single communication channel. The assessment should focus on the ability to sustain or recover the required business outcome.
Evidence to retain
Retain the completed assessment, input source, decision owner, review date, supporting evidence and resulting actions. Where the score is used to support funding or acceptance of residual risk, retain the approval and rationale. During an audit or post-incident review, this evidence is more valuable than the score itself because it demonstrates that the organization understood the assumptions and made a deliberate decision.
Related BCM.Center knowledge
- Tabletop Exercise Facilitation and Evaluation
- Exercise Program Management
- Business Continuity Exercise Testing
BCM.Center tools are educational practitioner aids. Adapt thresholds, scoring scales and decision rights to your organization's risk appetite, regulatory obligations, sector, operating model and approved business continuity management system.
Build injects around observable behavior
An effective inject should create a decision, coordination requirement or procedure test that an evaluator can observe. Avoid injects that simply provide information without requiring action unless they are deliberately testing situational awareness. For each inject, define the delivery method, intended audience, expected response, evidence source, evaluation criterion and contingency if players take an unexpected path. Mark which injects are essential and which can be skipped if the exercise is running late. Include recovery-phase injects, not only response pressure, so participants demonstrate restoration priorities, handover, backlog management and return-to-normal governance. A balanced exercise should reveal both strengths and improvement opportunities while remaining credible enough that participants behave as they would during a real disruption.