A tabletop exercise can test, assess and ultimately improve your crisis plan and your crisis response team’s performance. That is, if it’s done right.
To be successful and contribute to your organization’s higher state of crisis readiness, your tabletop exercise has to convincingly simulate a crisis scenario. It has to give participants a taste of the chaos that would be an inevitable part of any crisis. If the exercise is not done right, all you will have done is taken up a lot of people’s time without improving your organization’s crisis readiness.
So how do you make sure you’re doing it right? Here are eight rules to follow to make your tabletop exercise as valuable as it possibly can be.
Rule 1 – First and foremost — create your tabletop exercise objectives
By first identifying objectives for your exercise, you’ll be able to design your exercise and its simulated chaos in a way that works toward achieving those objectives. Say your response team has never had a chance to convene before the exercise. Testing how well they collaborate and how their decision-making process functions would be one of your objectives. You can then begin thinking about an exercise crisis scenario that emphasizes a series of challenges forcing your response team to make difficult, consequential decisions. You could, for example, inject developments into the scenario that require the crisis team to quickly modify its messaging both to external and internal stakeholders.
Rule 2 – Understand your audience based on your tabletop exercise objectives
With several objectives in hand as a guide to scenario development, you’ll next want to turn your attention to who precisely from your organization is participating in the exercise. Do you have a formal roster of a crisis team along with each individual’s backup? You should. Will your scenario entail participants who are external to your organization, such as first responders? That could mean that representatives from these external groups should be invited to participate in the exercise. In an actual crisis you would undoubtedly need to work seamlessly with these outside organizations, so exercising with them is a smart move.
Rule 3 – Create an overview of your scenario
With objectives and participants decided, you’re now ready to put together a one-page overview of the simulated chaos you need to create. Think of the overview as if you’re telling a story, with a beginning, middle and end. The story moves forward through a series of scenario injects that you create, again, with an eye to achieving your objectives.
Now that you have your overview of the scenario, you’ll want to think about how you’d present it to your crisis team a week or so before exercise day. You could develop a pre-read document or, far better, introduce the scenario with a video, as in our experience, well-produced, realistic videos are far better at capturing and holding the attentions of crisis exercise participants.
Rule 4 – Realism is the path to successful crisis management tabletop exercises
Now it’s time to put the details into the scenario. Make certain to work with a subject matter expert from your organization to help add the realism. If, for example, the scenario is a cyber attack, you’ll want to work with an IT expert or two to ensure authenticity. If it’s a toxic release scenario you’ll want to consult with toxicologists and public health officials to keep things real. Nothing will harm the success of your exercise more than if it’s not realistic. The crisis team will be dismissive, even contemptuous, of the exercise if they can’t relate to it. However, by keeping your scenario scrupulously realistic, your audience will engage.
Rule 5 – Think logistics, and always test your logistics before the day of your tabletop exercise
We’ve seen so many tabletop exercises fail or have delayed starts due to not preparing logistics beforehand. Here’s a short list:
- Send the invite calendar to your participants months in advance
- Book your desired room and a breakout room(s)
- Test the technology in the room the day before
- If you have virtual participants, make sure you have a good system that they can call in on
- Make sure you have white boards and pens
- If you have a technical person to help with technology, make sure they’re there to help set up on the day of the exercise or, preferably, the night before.
Rule 6 – How you manage the exercise agenda may make or break it
Keeping the exercise moving along on schedule is crucial to its success. And your schedule will have to factor in all sorts of activities of various durations, including bathroom and coffee breaks. If your exercise will include times when the team members must move to breakout groups representing their specific functions, their rearrangement to the breakout areas or rooms could take ten minutes. Two breakout sessions? That’s twenty minutes. Not anticipating and allowing for these sorts of time-consuming actions will throw off the schedule, inflicting great harm to the exercise if it goes overtime and tightly scheduled executives have to leave before the end.
It’s a good idea at the start of the exercise to go over the exercise agenda that details each inject period, break, or whatever. Outlining the agenda to the team at the start helps to ensure everyone remains on track during the event. And make sure you leave a period of time at the end for the “hot wash,” a debrief discussion.
Rule 7 – After the tabletop exercise, do this well and it will ensure your event is a success
The hot wash at the end of the exercise is only a very brief, initial impression and discussion of the exercise. It’s a forerunner to the comprehensive After Action Report (AAR) that you would issue a week or two after the exercise. The AAR pinpoints lessons learned — what went right and what went wrong during the exercise — and, most importantly, it includes actionable recommendations aimed at improving both the crisis plan as well as the team’s performance.
A good AAR is a key step toward making your organization more crisis ready and resilient. The recommendations in the AAR have to be implemented with updates made to your plan and procedures.
Rule 8 – Don’t let the momentum slip, it’s about creating muscle memory
A successful crisis simulation exercise and its constructive AAR is only one step in what should be thought of as a series of steps in a process of continuous improvement. One “check the box” exercise is surely not sufficient to ensure optimal readiness over the long term. An organization should have a programmed approach to exercises, such as scheduling them at regular six-month or one-year intervals with different kinds of chaos-infused scenarios.
Follow these eight rules for a tabletop exercise with realistically simulated chaos and you’ll have a crisis plan and response team that are in a state of optimal readiness. Only through regular simulated crisis exercises can continuous improvement be achieved over the long term, making your organization as prepared as it possibly can be for the real thing.
* * *