How do tabletop exercises prepare your team for better crisis management?

Ask a crisis management team how a real incident went, and you rarely hear complaints about the plan. You hear about the first hour. Who was called and who was not. The two people who both thought they were in charge. The regulator notified late because nobody was sure whose job it was. The social media post that went out before the facts were in. None of those is a planning failure. They are what happens when a group of capable people meets a crisis as a team for the first time, and the first time is the real thing.

A tabletop exercise exists to make sure the first time is not the real thing.

What actually happens in the room

The team sits together, usually for 90 minutes, with a facilitator. The scenario begins with something plausible for this organization — a district-cooling failure on an August afternoon, a ransomware note on the finance system on the last working day before Eid, a flood warning that turns into road closures. Then it develops in stages. Each stage arrives as the information would really arrive: a call from the building’s control room, an email from a supplier, a message from the regulator, a screenshot of a social media post. Each one comes with a few minutes to respond.

The clock is the point. With a clock, the team cannot wait for the full picture, because the full picture never comes during a crisis. They have to decide what to do with what they have, say it out loud, and live with the consequences in the next stage.

The first ten minutes

There is a pattern to what the first ten minutes reveal, and it shows up in most organizations.

The most common thing we hear is a version of “who is actually in charge right now?” The plan names a crisis manager. The person named is on leave, or in a meeting, or the plan names a role that two people think they hold. Settling that takes several minutes of a 90-minute exercise, and it would take the same several minutes of a real incident.

The second is the notification order. Most plans list who must be told. Fewer say in what order, and almost none say what to do when the regulator and the CEO both want a call in the next fifteen minutes and there is one person to make both.

The third is the gap between “we would activate the plan” and actually doing it. Teams often agree the incident is serious enough to activate, then carry on discussing as if they had not. The facilitator’s job is to ask, gently, “so have you declared it? Who did you tell?”

None of this is a criticism of the people. These are exactly the things that cannot be learned from reading a document, and the exercise is where they get learned at a cost of 90 minutes instead of a bad day.

What changes afterwards

Three things, in our experience, and they are what “better crisis management” really means.

Decisions get faster. A team that has once decided to shut a service, or to go public before all the facts were confirmed, finds it much easier to make that call again. The exercise removes the first-time hesitation.

Communication gets ordered. Having watched a message go to the wrong audience first, teams fix the order. The notification list becomes a sequence, with a named person for each call, and the plan gets a line about what to do when two calls fall due at once.

Roles get owned. The person who held the crisis manager role for 90 minutes knows what it felt like, and so does the deputy who had to take over when the facilitator took the crisis manager “out of contact” for one stage. The plan stops being a list of titles and becomes a set of people who have done the job once.

There is a quieter fourth effect. People who have been through an exercise together trust each other more in the real thing. They have seen how the head of IT responds under pressure, and the head of IT has seen how the communications lead responds. That familiarity is hard to put in a report, but anyone who has managed a real incident knows its value.

Preparing so the exercise is worth it

An exercise is only as good as the preparation, and most of the preparation is about getting the right people ready.

Get the real decision-makers in the room. The person who can approve spending, stop a service, or speak to a regulator. If the deputies attend, you are testing the deputies, which is a legitimate objective, but choose it on purpose.

Set two or three objectives, not ten. “Confirm the team can activate the plan within 15 minutes of the first alert.” “Confirm the regulator notification is made in the right order with the right content.” “Find out whether the manual payroll process actually works.” Objectives this specific can be measured; “test the plan” cannot.

Brief the participants once, briefly. Tell them the date, the duration, and that the exercise tests the plan, not individuals. Do not tell them the scenario. The point of the first inject is the reaction to it.

Protect the time. Ninety minutes with no calls taken and no one slipping out for another meeting. A crisis management team that cannot give a crisis 90 minutes of attention has told you something before the exercise starts.

Put an observer in the room. Someone who is not responding, whose only job is to note what the team did and did not do against the objectives. The responders are too busy to see themselves.

Plan the report before the exercise. Who writes it, who approves it, and by when. A report three weeks later records impressions; a report three days later records facts. ISO 22301 (clause 8.5) and NCEMA 7000:2021 (clauses 8.6.1 and 7.3) both expect a post-exercise report with recommendations for improvement, so this is also the document the auditor will ask for.

And then do it again

The teams that handle real incidents well are not the ones that ran a brilliant exercise once. They are the ones that run one every year, each on a different risk, and that fix what the last one found before the next one starts. Crisis capability is built by repetition, and it fades without it.

If you have never run one, the first will be uncomfortable in places. Better to find that out in a meeting room than in a real incident.

Sources

• ISO 22301:2019 — Security and resilience — Business continuity management systems — Requirements — ISO, clause 8.5, which asks that exercises develop teamwork, competence, confidence and knowledge.
• NCEMA — National Emergency Crisis and Disasters Management Authority — issuer of AE/SCNS/NCEMA 7000:2021; clause 8.6 and its guidance on what exercises develop.