Companies with untested BCP plans may face as much risk as those with no plans at all