How to Build a Crisis & Business Continuity Exercise Strategy

Strategy.

It’s what separates the winners from the losers.

In sports.

In war.

And in business.

So why do so many organizations fail to implement one for their crisis and business continuity exercises and then wonder why their program continues to flail?

Implementing a crisis and business continuity exercise strategy doesn’t have to be complicated.

But the return on investment can be profound.

Here, we talk about, why you need a crisis and business continuity exercise strategy, how to create one, and the common mistakes to avoid.

What is a crisis and business continuity exercise strategy and why do you need one?

If you’re here because you Googled: “What is a business continuity exercise“ OR “Crisis exercise templates,” you might not understand what an exercise strategy even is or why it’s important.

Here’s why you should.

An exercise strategy—or a plan of action for testing and practicing your business continuity and crisis plans—can help you and your team:

• Test your plans, roles, and responsibilities in a safe environment—waiting for the next crisis to find out whether or not your plan works is less than ideal.
• Build the muscle memory your team needs to respond swiftly to a real crisis or business continuity threat—what winning athlete waits until the game to put their skills into action?
• Build collaboration and coordination among team members, stakeholders, and incident response teams.
• Identify things that are missing from your current crisis and business continuity plans.
• Capture lessons learned from exercising your plans—What went well? What didn’t? Where are there opportunities for improvement? And how are you systematizing and tracking them?

How to build a crisis and business continuity exercise strategy

Creating an effective exercise strategy involves a lot more than downloading some exercise templates or having your team review your plans at your next meeting.

If you want to create an exercise strategy that actually works, you need to understand:

• The different types of crisis and business continuity exercises
• Which ones to use and when

Let’s take each one in turn.

1.   What are the different types of crisis and business continuity exercises?

Exercises can run the gamut from multi-day full simulations involving your crisis or business continuity team, other employees, and outside stakeholders, to micro-simulations and drills calculated at helping individuals hone a very discrete part of your plan in a limited window of time.

We use a combination of full simulations, lightweight simulations, facilitated tabletops (where your team talks through rather than acts out a response), and drills in designing a custom exercise strategy for each of our clients.

2.   Which exercises should you use and when?

Not all exercises are alike or appropriate, depending on your business and what stage it’s at in developing its exercise strategy. That’s why we use a building block approach to designing an exercise strategy for each of our clients.

Where you start depends a lot on the foundation that you’ve already built. For example, a more mature program might already have a foundation of prior exercises and tabletops to build from. If that’s the case, it might be appropriate to immediately layer in more complicated simulations, in addition to conducting regular tabletop exercises and drills.

However, doing an exercise with your team can be a painful experience if it’s not gauged appropriately to their experience and abilities. If your team hasn’t already built its business continuity and crisis management chops, a full-scale exercise can be demoralizing and an ineffective use of time and resources.

If your business continuity and crisis management program is relatively new or your team hasn’t had a plan before, we recommend starting with a facilitated tabletop exercise. Tabletops are very linear and straightforward and are a great place to start if you need to still get your team comfortable with the process.

You should aim to do a tabletop at least twice each year for your crisis team, ideally in the Spring and Fall. In addition, you should make sure that every business unit does a tabletop of their respective plan at least annually, ideally right after updating those plans.

Once your team has developed a baseline comfort level with your plans, you can layer in more robust simulations and exercises and do them more frequently. This might include half-day lightweight simulations that provide the experience of two or three hours of a realistic crisis or business continuity response. We like to do these quarterly, rotating through the most common scenarios on a regular schedule.

Full simulations, like a multi-day data breach exercise, are more involved and time-consuming. They can involve the likes of coordinating leadership handoffs, communicating with your reputation management and communications teams, responding to mock subpoenas, and even a simulated FBI raid. For this reason, we recommend doing full simulations annually or every other year.

7 exercise strategy mistakes to avoid

The biggest mistake we see organizations make is not having an exercise strategy at all.

Then, the most common mistakes we typically see are with:

• Goals: Exercise goals are often not aligned to what is really needed in the organization.
• Difficulty: An exercise either too simple (easy) or impossible to solve (complex).
• Realism: The exercise does not reflect reality.
• Stressors: The exercise does not induce an appropriate level of stress on the participants; this is often especially true for more mature organizations.
• Silos: The exercise is not structured well as a cross-functional exercise, for example, requiring a coordinating response from both communications and reputation management to a specific mock incident.
• After-Action Report: There is a lack of direct feedback & accountability measures to ensure you incorporate your exercise learnings.

Doing it for the Wrong Reasons: Finally, and this one deserves its own special paragraph, we get inquiries all the time from people who want us to help facilitate an exercise in hopes of embarrassing their executives into action.

This is not an exercise strategy.

It’s an ambush.  And it will probably only leave a bad taste in everyone’s mouth.

If you are struggling to convince your leadership to give you the resources and support you need to implement business continuity and crisis management plans, there are better ways to do this. It’s something we help our clients with all the time and we can help you too.

Want to work with us or learn more about Exercises?

• Our proprietary Resiliency Diagnosis process is the perfect way to advance your crisis management, business continuity, and crisis communications program.  Our thorough standards-based review culminates in a full report, maturity model scoring, and a clear set of recommendations for improvement.
• Our Exercise in a Box product contains 15 simple tabletop exercise scenarios that your business leaders can utilize for crisis microsimulations with minimal involvement from your team.
• Our Crisis Management services help you rapidly implement and mature your program to ensure your organization is prepared for what lies ahead.
• Our Ultimate Guide to Crisis Management contains everything you need to know about Crisis Management
• Our Free Crisis Management 101 Introductory Course may help you with an introduction to the world of crisis management – and help prepare your organization for the next major crisis situation.
• Learn about our Free Resources, including articles, a resource library, white papers, reports, free introductory courses, webinars, and more.
• Set up an initial call with us to chat further about how we might be able to work together