SmartSuite for the Resilience Testing Lead

Tabletop and live exercises are planned on one schedule per important business service, tasks sent automatically and participant engagement tracked as the exercise runs. The program is a set of records with status, not a planning deck.

Scenarios are built against the critical service map, so each one stress-tests the real processes, systems, vendors and teams behind a service. Results and impact ratings are recorded against the scenario, so the next run starts from the last result.

Each test records whether the service stayed within its impact tolerance, with the outcome scored and the evidence attached. Over time the dashboard shows which services have been tested, when and with what result.

The continuity plans the Business Continuity Manager owns and the BIAs the Business Continuity Analyst maintains sit in the same workspace as your exercises, so a test draws on the current plan and its result feeds the next plan review.

The IT Disaster Recovery Lead's recovery steps and the Crisis Management Lead's playbook escalations can be run inside one exercise, with every notification and decision recorded. The debrief covers the whole response, not three separate accounts.

Third-party dependencies are mapped to each critical service, so a scenario can take a supplier out and show which services and tolerances it threatens. The finding goes to the vendor's record as well as to your action list.

Each exercise finding becomes a corrective action with an owner, a due date and automated follow-up, linked to the plan or control it changes. Closure requires the update, so a lesson learned becomes a plan change rather than a line in a report.

The AI Assistant in a SmartDoc field drafts the scenario test summary, lessons-learned report or regulatory response narrative from the exercise record, so the Head of Operational Resilience gets a consistent write-up after every test and you edit rather than start from blank.

Full histories of tests, incidents, reviews and controls are kept with audit trails and role-based permissions, structured for DORA, FFIEC and ISO 22301 requirements and the PRA's severe-but-plausible testing expectations. The examiner's sample is already in order.

Head of Operational Resilience

The Resilience Testing Lead owns the scenario testing and exercise program: the annual plan, the severe-but-plausible scenarios developed for each important business service, the tabletop and live exercises, the impact tolerance tests and their documented outcomes, and the corrective actions that follow. They report results and lessons learned to the resilience lead and, where required, to regulators. The program exists to show that the organization can stay within impact tolerance, and to fix what the tests reveal.

Operational Resilience schedules exercises, captures results and scores impact tolerance tests against each important business service, so the annual program is a schedule with the scenario, the participants and the outcome recorded on each exercise. The Resilience Testing Lead can see which services have been tested, which are due and how each performed against its tolerance. Crisis Management supports the live exercises where the crisis team is stood up, so the exercise and the response record are one.

Issues Management converts exercise findings into corrective actions with owners and tracks them to closure, so a gap found in a tabletop becomes an action assigned to the Business Continuity Manager, the IT Disaster Recovery Lead or whoever owns the fix, with a date. The Resilience Testing Lead sees open actions across all exercises and can show at the next test whether last year's findings were resolved. That is the loop regulators look for: test, find, fix, retest.

Scenario design draws on the Business Continuity Manager's plans, the IT Disaster Recovery Lead's recovery capabilities and the Crisis Management Lead's response structure, and the exercise record in Operational Resilience is where those inputs and the roles each team plays are held. The Resilience Testing Lead schedules the exercise, each team sees its part, and the Business Continuity Analyst records observations during the run. Because the results sit with the service and its dependencies, each team sees what the test showed about their piece.

SmartSuite produces regulator-ready testing evidence and lessons-learned reports from the exercise records, so the report to the Head of Operational Resilience shows which important business services were tested, how each performed against its impact tolerance, what was found and what has been fixed. The same evidence serves the regulatory self-assessment under the PRA and FCA rules or DORA's testing program, and a CMS or SOC 2 request for tested plans, without a separate pack being assembled for each.

The list of important business services with their impact tolerances, the exercise calendar for the year and any open findings from previous tests. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for a testing program the first workflow is the exercise calendar, scheduled and scored against the services loaded. Teams that have been running exercises from documents usually load last year's findings first, so that the corrective action loop starts before the next test rather than after it.