I know someone who got a job with a large bank.  Her first assignment was to evaluate the bank's contingency plans for dealing with various kinds of emergencies.  By way of example, they explained to her that they had a bunch of policies and procedures to use if they ever lost power on a floor full of data-entry terminals.  She should look at those policies and procedures and tell them if they were adequate.

She had no clue about how to approach this problem, so she asked me for suggestions on how to do so.  My first suggestion was that she shut off the main circuit breaker on a floor full of data entry-terminals and see what happened.  She told me that she would be fired if she even suggested such a thing.  I responded: "Then we have answered your question--If they'd fire you for suggesting a live test, their contingency plans are not adequate."

There is a general principle here: If you're not willing to force a failure, you probably don't know what the actual effects of a failure would be.  You may think you know, but you don't.