The FFIEC doesn't set your testing interval. You do.

"The FFIEC requires annual testing" is a familiar line in bank business continuity. Neither half of it is what the guidance says.

"Requires" first. The FFIEC's Business Continuity Management booklet is examination guidance, and its testing expectation is written as "should":

"The board and senior management should provide for appropriate exercises and tests to verify that business continuity procedures support business continuity objectives."¹

When the FDIC announced the 2019 booklet, it put it plainly: "The changes do not impose new requirements on examined entities."²

Then "annual". The booklet sets no interval. It makes cadence a function of risk:

"Exercises and tests should occur either at appropriate intervals, when new risks are identified, or when significant changes affect the entity's operating environment."¹

Three triggers, and no number. How often is appropriate is the institution's call, and the booklet adds that "the entity's risk profile should influence the frequency, objectives, and documentation of the overall exercise schedule."¹

The only cadence figures in the booklet or its examination work program are examples, in a step that checks your program from the examiner's side:

"Determine whether management covers all of the functions in the exercise and test universe according to its established timeframes (e.g., all processes are covered annually or every three years)."³

Read that one slowly. It's the sentence most likely to be lifted out of context.

• The timeframes are yours. Examiners check coverage against the ones management has established. The FFIEC doesn't set them.
• "Annually or every three years" follows "e.g." They're examples of what an institution's timeframe might look like, not a standard, a floor, or a one-to-three-year band.
• It measures coverage, not frequency. Covering every process over three years is not "an exercise every three years."

None of this makes the expectation softer. A date on a calendar can be met by turning up. Timeframes you set against your own risk profile have to be explained, and the examiner's objective for this area is whether your program is "sufficient to allow management to assess the entity's ability to meet its continuity objectives."³ That is harder to fake than an annual event.

So the honest summary is this: examiners check that you cover every function in your exercise and test universe within the timeframes your institution has set, and that you exercise again when risks or your environment change. The FFIEC doesn't give you a date. It expects you to set one that fits your risk, and to keep to it.

Who the guidance reaches, what examiners check, and what the booklet asks of your scenarios and your mix of exercise types are all in one place: What the FFIEC actually asks of your exercise program.

---

Regulatory references current as of September 2026. This piece is scheduled for re-verification by March 2027.

¹ FFIEC IT Examination Handbook, Business Continuity Management booklet (November 2019), Section VII, "Exercises and Tests." Quoted passages are verbatim.

² Federal Deposit Insurance Corporation, FIL-71-2019, "Updated FFIEC IT Examination Handbook – Business Continuity Management Booklet" (14 November 2019).

³ FFIEC IT Examination Handbook, Business Continuity Management examination work program (Appendix A, Examination Procedures). The objective and the procedure step are quoted verbatim.