Exercising

Tabletop exercise or simulation: which one does the auditor expect?

· 5 min read · PlanProof

Short answer

Neither standard requires a particular type of exercise. What an auditor expects is a programme that is proportionate to your risks and, over time, validates the whole arrangement: evidence of objectives, a realistic scenario, a report, and closed actions. For most UAE organizations a sensible programme is a facilitated tabletop at least once a year (the standards set no frequency), a technical test wherever a plan makes a recovery promise, and a larger simulation only once the tabletops stop finding big gaps.

“Do we need a simulation, or is a tabletop enough?” is usually asked a few weeks before an audit, by someone who has just been told the budget for the year. The auditor does not have a format in mind, because the standards do not give them one. What they have in mind is a set of evidence, and there is more than one way to produce it.

What the standards say — and do not say

ISO 22301:2019 asks for an exercise programme with well-planned scenarios, clear objectives, formal post-exercise reports and exercises at planned intervals (clause 8.5). NCEMA 7000:2021 asks for much the same in clause 8.6, and adds that the programme should set criteria for measuring success. Neither names a format, tabletop or otherwise, and neither sets a frequency beyond “planned intervals” and after significant change. NCEMA’s guidance goes as far as suggesting a team walk-through as a starting point, and distinguishes an exercise (which builds competence and confidence) from a test (which checks whether a specific outcome, such as a system recovered within a time limit, is achievable).

So the honest position is that the format is yours to choose, and the auditor’s job is to decide whether your choice was reasonable given your risks, your scope and your history.

The four levels, and what each one proves

It helps to think of exercises as a ladder, with each rung proving something the one below cannot.

Walk-through. The response team sits with the plan and reads through it: who is called, who decides, where people go. Low cost, an hour or two, no scenario needed. It proves that the plan is readable and that people know it exists. It does not prove anyone can use it under pressure.

Tabletop exercise. A facilitated session, usually 60 to 120 minutes, in which the team works through a realistic scenario delivered in stages. Each stage, or inject, arrives with a short time to respond, and the team has to decide what to do with the information in front of it rather than what it would have liked to know. It proves whether the plan supports real decisions: who declares an incident, how a regulator is told, what the shift supervisor does when the cooling fails at two in the afternoon in August. Done well, it is the most information you can get per hour spent.

Functional exercise or simulation. The team responds in something closer to real time, often from the actual crisis room, with injects arriving by the channels they would really arrive by — phone calls, emails, a message from the building’s control room. Other departments may be played by a control team. It proves whether the communication chain and the tools work, not just the decisions. It costs several days of preparation and typically a full day of people’s time.

Live test or full-scale exercise. Something actually happens: a building is evacuated, a system is failed over to the alternate site, a shift runs on manual procedures. It proves the mechanism. It also carries real operational risk, which is exactly why NCEMA 7000:2021 warns that exercises must not adversely affect normal operations.

A common mistake is jumping to the third rung for the sake of appearances, before the second has stopped finding things. A simulation that spends its first hour discovering that nobody knows who is in charge has wasted a lot of people’s day finding what a tabletop would have found in fifteen minutes.

What the auditor actually checks

An auditor’s questions tend to follow the clauses:

  • Is there an exercise plan, and does it show what will be exercised over the cycle, not just this year?
  • Did the exercise have objectives written down before it started?
  • Was the scenario realistic for this organization — this location, these dependencies, this season?
  • Is there a post-exercise report, and was it approved?
  • Did the findings turn into actions with owners and dates, and were last year’s closed?
  • Where a plan promises a recovery time, has that promise ever actually been tested?

A well-run tabletop, with its report and action list, supplies evidence for most of those. The last needs a test, not a bigger exercise. An auditor will not accept a tabletop as proof that your core system can be restored in four hours. They will not need a full-scale evacuation to accept that your crisis team can make decisions. The two things are different evidence for different claims.

How to choose

Start with your risk register and your plans, and ask where the plan makes a promise nobody has checked. Those promises need tests, and the tests need to be scheduled regardless of what else the programme contains.

Then ask what your team has done before. A team that has never exercised should start with a tabletop, with the people who would genuinely make the decisions in the room — the ones who can say yes to spending money or stopping a service, not their deputies. That first session usually produces more findings per hour than anything else in the programme.

Move up to a simulation when two or three tabletops in a row produce only small findings, or when a specific exercise objective genuinely needs real-time communication to test — a media response, say, or a multi-site incident where the sites have to coordinate without a facilitator in the room.

And keep a sense of proportion about the calendar. In the UAE a good deal of the year is unsuitable for a day-long simulation: Ramadan working hours, the summer leave season, year-end closing. A 90-minute tabletop fits into those months; a full-day simulation does not, and a programme that is honest about this is easier to defend than one that promises a simulation it never manages to hold.

For most organizations we work with, the right answer for this year is a facilitated tabletop with a clear set of objectives, a scored report, and a list of actions that someone owns. Add a technical test for each recovery promise. Put a simulation on the plan for a later year and let the tabletops tell you when it is time. And remember the second trigger: a new site, a new system or a real disruption calls for an exercise regardless of the calendar. That is a programme you can defend clause by clause.

Sources