Business Continuity - Business Contingency Plans BRC V8 3.11.1

Hello All,

In need of some guidance on whether or not a "mock challenge" to a business continuity/business contingency plan is required in BRC V8 3.11.1 clause.  From what I interpret, the clause does not state a challenge is necessary, but the interpretation guidelines do say that periodic verification be performed. Is the periodic verification a challenge of the plan? What would be an example of a verification activity around business continuity plan? Might be getting lost in the weeds on this one...

Thanks,

CD

In lets just say too many years of BRC I've never had an auditor ask more than a cursory question or two about the continency elements of section 3.11, and certainly never been asked to provide evidence of a challenge - the focus is very much on the test that most definitely is required for 3.11.3.

Some potential verification activities that you could look at might be:
If IT infrastructure is critical, can your system provider do a mock exercise with you? I don't think it's neccesary every year, but all parts of the business will be grateful knowing that you have a working backup/remote access etc.

Is part of your continuity of supply achieved using alternative production facilities? If so I'd document the arrangement, and also ensure that they're on your approved supplier list as a service provider - maintaining that approved status verifies that they are suitable for your intended purpose.

Beyond generic things like this, it starts to become more about the specifics of what your contingency plan entails - if you have specific areas of concern then post them here and we can have a think about how best to achieve what you need.

FWIW I have run contingency challenges on a few areas, but that requirement actually came through from our insurers (helped with the premiums ;) ) via our finance department. Quite an interesting exercise though, and worth doing if you get chance.