An exercise that includes an external organization, such as a key supplier, is by definition a joint or collaborative exercise, not an internal one. An internal exercise is restricted to the organization's own personnel and resources to test internal plans and capabilities. While exercising with suppliers is a highly effective validation method, describing it as an "internal exercise" is a contradiction in terms. The other options represent standard and valid methods for an organization to use its exercise program and related assurance activities to validate supply chain continuity.

B. This is a common due diligence activity where an organization verifies a supplier's preparedness without direct joint participation.

C. Contractually obligating suppliers via SLAs to conduct and report on exercises is a formal mechanism for ensuring supply chain resilience.

D. Internal exercises are crucial for an organization to understand its own dependencies and the potential business impact of a specific supply chain failure.

1. Business Continuity Institute (BCI), Good Practice Guidelines (GPG), 2018 Edition.

Section 9.3.2, "Exercise participants": This section explicitly distinguishes between different types of exercises based on participants. It defines an internal exercise as one "involving only the organization’s own staff." It defines a joint exercise as one "involving external organizations, such as suppliers, battle-box or data storage providers, customers, or emergency services." This directly supports that including a supplier (an external party) makes an exercise joint, not internal, rendering option A incorrect.

Section 7.4, "Managing supplier and outsourcing arrangements": This section details methods for supply chain assurance, stating that an organization should "obtain evidence of the supplier’s BCM programme" and that "contractual arrangements should include the right to require the supplier to participate in exercises." This validates options B and C as correct practices.

Section 9.2, "Exercise programme": The purpose of an exercise program is to "validate business continuity plans" and "assess the likely impacts of a disruption." This supports option D, as assessing the impact of a supply chain failure is a valid objective for an internal exercise.