Most organizations choose a tabletop exercise facilitator on the scenario pitch and the price. They should choose on two things the sales call rarely covers: whether the room will actually make decisions, and what you will hold in your hands two weeks later.
A tabletop exercise is a decision-forcing device. If your people spend three hours listening instead of deciding, you bought a briefing, not an exercise.
A disclosure before we start: Bryghtpath designs and facilitates tabletop exercises for a living, so read this with that in mind. The questions below work for any firm you evaluate, including us. Ask all of them.
Why the Choice of Tabletop Exercise Facilitator Matters More Than the Scenario
Scenarios are easy to buy. Ransomware, severe weather, a vendor failure, an executive scandal. Every tabletop exercise firm has a library, and most of those libraries look alike.
What separates a useful exercise from a wasted afternoon is the person running the room and the work that happens before and after it.
Here is what we hear from teams right before they go looking for outside help:
- “We have plans. We’ve never really tested them.”
- “The auditors want an exercise every year. I need it to be worth more than the checkbox.”
- “The last exercise was a lecture. Nobody made a single decision.”
And here is what we hear after an exercise that worked:
- “We wouldn’t be in a good spot should we have to recover.”
- “We don’t know when we can recover what, in what order.”
That second set sounds like bad news. It is the best outcome a tabletop can produce. A leadership team that discovers its recovery gaps in a conference room, on your schedule, has time to fix them. A team that discovers them during a real outage does not.
The facilitator decides which of those conversations you end up having.
| Old View | New View |
| The exercise satisfies the annual audit requirement | The exercise surfaces the gaps you would otherwise find in a real event |
| A good scenario makes a good exercise | The facilitation makes the exercise; the scenario is the vehicle |
| Success means the team “did well” | Success means the team found problems worth fixing |
| The after-action report is a summary | The after-action report is a prioritized work plan |
| One exercise a year | Each exercise builds on the last one |
Before You Call Anyone: Four Things to Decide
You will get better proposals, and a better exercise, if you can answer these first.
- Why now? An audit finding, a board directive, a new crisis team, a recent incident that went poorly, or a regulatory deadline (ISO 22301, FFIEC, HITRUST). The trigger shapes the scenario and the audience.
- What plan are you testing? A crisis management plan, a business continuity plan, an IT disaster recovery plan, or the interaction between them. “All of them” usually means none of them gets tested well.
- Who needs to be in the room? The team that owns the plan. For most organizations that is 10 to 50 people. If your executives need to participate, say so early, because it changes the design.
- What decision do you want to walk out with? “Validate the plan” is not a decision. “Decide whether we can restore payroll within 72 hours without the primary data center” is.
If you cannot answer at least three of the four, start there. A good facilitator will help you work through them in the first call. A weak one will skip straight to scenario options.
Seven Questions to Ask a Tabletop Exercise Firm
1. Who will actually facilitate our exercise?
The senior practitioner on the sales call is not always the person in the room. Ask for the name of the facilitator, what real incidents they have worked, and how many exercises they have run for organizations like yours.
A good answer: a named person with operational crisis or continuity experience, who will also lead the design.
A red flag: “Our team will assign someone once the contract is signed.”
Facilitation is a skill built in real events. Your executives will test the facilitator’s credibility in the first fifteen minutes. If the facilitator has never been in a room where this was real, the room will notice.
2. How do you build the scenario?
A good answer: the firm reviews your plans, interviews the people who would live the scenario, and iterates the scenario with your sponsor before anyone sees it. You approve it before the exercise.
A red flag: a scenario chosen from a catalog with your logo added.
Custom does not mean exotic. It means the scenario hits your actual dependencies, your actual vendors, and the decisions your actual leaders would face. That is where the useful findings come from.
3. How will you force decisions in the room?
This is the most important question on the list. Ask the firm to walk you through a single move of a past exercise, anonymized.
A good answer: structured moves with must-answer questions, injects (new developments introduced mid-exercise) that respond to what the team decides, and a facilitator who presses for commitments: who decides, by when, with what information.
A red flag: a slide deck that narrates the scenario while participants nod.
4. Will the exercise reach recovery, or stop at response?
Many tabletop exercises spend their entire time on the first hours: notification, escalation, the first statement. The hardest decisions come later. What do you restore first? What is tied to what? How far back can you safely go?
Ask how the firm will make sure the scenario reaches recovery sequencing within the time available. Teams often leave an exercise saying, “If we’d had another hour, we would have gotten to recovery.” A good design plans for that and gets there.
5. What does the after-action report look like?
Ask for a redacted sample. Read it before you sign.
A good answer: an After-Action Report (AAR) with observations tied to specific moments in the exercise, recommendations ranked by priority, and owners. It aligns to the standards you answer to (ISO 22301, ISO 22361, NIST SP 800-53, FFIEC, HITRUST) and holds up in an audit.
A red flag: a narrative recap of what happened, a list of strengths, and generic recommendations that could apply to any company.
The AAR is the only part of the exercise that outlives the afternoon. It deserves as much scrutiny as the scenario.
6. How will you handle our executives?
Senior leaders dominate rooms, defer to the most senior person, or treat the exercise as a test they intend to pass. Ask how the facilitator manages each of those.
A good answer: specific techniques. Directing questions to the role that owns the decision, rotating who answers, and calling out “we’ll figure that out later” when it appears.
A red flag: “Everyone usually participates well.”
7. What happens after this exercise?
A single annual tabletop finds the same problems every year. Ask how the firm thinks about the next exercise, and whether they will tell you when you have outgrown tabletops.
A good answer: a sponsor debrief that sets the next exercise, and a candid view of when a functional exercise or full-scale crisis simulation makes more sense.
A red flag: silence on anything beyond the current statement of work.
What a Facilitated Tabletop Exercise Costs
Facilitated tabletop exercises are scoped by scenario complexity, participant count, and format. Ours start at $25,000. Design runs four to six weeks. The exercise runs two to four hours. The AAR follows within two weeks.
Not every organization needs that on day one. If your budget is tight or you have a capable internal lead, you have options:
- Run it yourself. Exercise in a Box® gives your team 15 ready-to-run scenarios for $1,799.99.
- Get a custom exercise fast. Exercise in a Day® builds you a custom exercise in one business day for $7,500.
- Bring in a facilitator when the stakes justify it: your first external exercise, an executive or board audience, an audit or regulatory requirement, or a team that keeps finding nothing new in its own exercises.
The most expensive option is the one that produces no decisions. Count the cost in leadership time: thirty executives for three hours is ninety hours of your most expensive people. Spend it on an exercise that changes how your team recovers, not one that reads them a script.
How We Answer These Questions
Since we asked you to put every firm through these seven questions, here are our answers.
- Who facilitates: senior practitioners who have run real crises inside Fortune 100 companies, and who also lead the design.
- The scenario: built from your plans, your risk profile, and interviews with your people. You approve it before the room sees it.
- Decisions: structured moves, must-answer questions, and live injects that respond to the room.
- The AAR: prioritized, observation-linked recommendations, aligned to the standards you answer to, followed by a sponsor debrief.
- What’s next: we recommend the next exercise, and we will tell you plainly when you have outgrown tabletops.
You can see the full approach on our tabletop exercises page, including anonymized results from health systems, insurers, and manufacturers.
Choose the facilitator who will make your team uncomfortable in the room, so you are not uncomfortable in a real crisis.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- See how we run tabletops. Our tabletop exercises are custom-built, decision-forcing, and end in an after-action roadmap.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your next exercise with us.
Your AI Agent Is Now Part of Your Incident