A restore you have never tested is not a backup
Backup jobs that report success are reassuring and prove remarkably little. RMAN can complete without error against a configuration that omits a tablespace added last year, or write to a destination with no remaining space for the next full backup, or retain fewer generations than the recovery window described in the policy. None of that surfaces until a restore is attempted, which is the worst possible moment to find out. A green job history is evidence that a job ran, and nothing beyond that.
Tested restore means taking the backup and bringing a database up from it, on separate storage, on a schedule, and recording how long the whole thing took. That elapsed time is the number that matters, because a recovery time objective written into a policy document remains a wish until somebody has measured the actual duration from failure to open. Point in time recovery is tested too, since restoring an entire database is rarely the scenario you face.
The scenarios worth rehearsing are the awkward ones. A single dropped table with the rest of the database live and in use. A corrupt datafile. Recovery to a point just before a bad batch job ran. Complete loss of the primary site. Each has a different procedure and a different duration, and a runbook covering only total loss leaves the most frequent incidents entirely unrehearsed. The dropped table is by some distance the most common of them, and it usually happens during a change window when everybody involved is already busy.
- RMAN configuration reviewed against the actual tablespace and archive log layout, not assumed correct
- Scheduled restore tests onto separate storage, with elapsed time recorded each cycle
- Point in time and single object recovery rehearsed, not only the full database restore
- Recovery time and recovery point objectives stated, then measured against a real test
- Backup destinations monitored for capacity and retention, with failures alerting a named person