That allows companies to ensure that people know what they're expected to do in case of a crisis, and identifies problems early.
"If you can do it through an exercise, then it's only an awkward situation and something they can address when its not so critical," Smith said. "When we get executives, lawyers, and IT professionals together, the dialogue that starts to happen is very interesting."
For example, the first time a company runs one of these tests, he said, what usually happens is that the IT participants are constantly called away from their work responding to the problem in order to update the other executives on what's going on.
"There's nothing like pain to get people's attention," he added.
However, 21 percent of companies never do this kind of testing at all.
Sign up for CIO Asia eNewsletters.