Strategy.
It’s what separates the winners from the losers.
In sports.
In war.
And in business.
So why do so many organizations fail to implement one for their crisis and business continuity exercises and then wonder why their program continues to flail?
Implementing a crisis and business continuity exercise strategy doesn’t have to be complicated.
But the return on investment can be profound.
Here, we talk about why you need a crisis exercise strategy, how to create one, and the common mistakes to avoid.
What is a crisis and business continuity exercise strategy and why do you need one?
If you’re here because you Googled: “What is a business continuity exercise“ OR “Crisis exercise templates,” you might not understand what an exercise strategy even is or why it’s important.
Here’s why you should.
An exercise strategy—or a plan of action for testing and practicing your business continuity and crisis plans—can help you and your team:
- Test your plans, roles, and responsibilities in a safe environment—waiting for the next crisis to find out whether or not your plan works is less than ideal.
- Build the muscle memory your team needs to respond swiftly to a real crisis or business continuity threat—what winning athlete waits until the game to put their skills into action?
- Build collaboration and coordination among team members, stakeholders, and incident response teams.
- Identify things that are missing from your current crisis and business continuity plans.
- Capture lessons learned from exercising your plans—What went well? What didn’t? Where are there opportunities for improvement? And how are you systematizing and tracking them?
How to build a crisis and business continuity exercise strategy
Creating an effective exercise strategy involves a lot more than downloading some exercise templates or having your team review your plans at your next meeting.
If you want to create an exercise strategy that actually works, you need to understand:
- The different types of crisis and business continuity exercises
- Which ones to use and when
Let’s take each one in turn.
1. What are the different types of crisis and business continuity exercises?
Exercises can run the gamut from multi-day full simulations involving your crisis or business continuity team, other employees, and outside stakeholders, to microsimulations and drills calculated at helping individuals hone a very discrete part of your plan in a limited window of time.
We use a combination of full simulations, lightweight simulations, facilitated tabletops (where your team talks through rather than acts out a response), and drills in designing a custom exercise strategy for each of our clients. You can see each type on our exercises page.
2. Which exercises should you use and when?
Not all exercises are alike or appropriate, depending on your business and what stage it’s at in developing its exercise strategy. That’s why we use a building block approach to designing an exercise strategy for each of our clients.
Where you start depends a lot on the foundation that you’ve already built. For example, a more mature program might already have a foundation of prior exercises and tabletops to build from. If that’s the case, it might be appropriate to immediately layer in more complicated simulations, in addition to conducting regular tabletop exercises and drills.
However, doing an exercise with your team can be a painful experience if it’s not gauged appropriately to their experience and abilities. If your team hasn’t already built its business continuity and crisis management chops, a full-scale exercise can be demoralizing and an ineffective use of time and resources.
If your business continuity and crisis management program is relatively new or your team hasn’t had a plan before, we recommend starting with a facilitated tabletop exercise. Tabletops are very linear and straightforward and are a great place to start if you need to still get your team comfortable with the process.
You should aim to do a tabletop at least twice each year for your crisis team, ideally in the Spring and Fall. In addition, you should make sure that every business unit does a tabletop of their respective plan at least annually, ideally right after updating those plans. Our business continuity exercises are built for exactly that.
Once your team has developed a baseline comfort level with your plans, you can layer in more robust simulations and exercises and do them more frequently. This might include half-day lightweight simulations that provide the experience of two or three hours of a realistic crisis or business continuity response. We like to do these quarterly, rotating through the most common scenarios on a regular schedule.
Full simulations, like a multi-day data breach exercise, are more involved and time-consuming. They can involve the likes of coordinating leadership handoffs, communicating with your reputation management and communications teams, responding to mock subpoenas, and even a simulated FBI raid. For this reason, we recommend doing full crisis simulations annually or every other year.
We go deeper on sequencing these building blocks in crisis simulation and exercise program best practices, and on the levels a program moves through in Ep. 172: Bryghtpath’s Exercise Maturity Model.
7 exercise strategy mistakes to avoid
The biggest mistake we see organizations make is not having an exercise strategy at all.
Then, the most common mistakes we typically see are with:
- Goals: Exercise goals are often not aligned to what is really needed in the organization.
- Difficulty: An exercise either too simple (easy) or impossible to solve (complex).
- Realism: The exercise does not reflect reality.
- Stressors: The exercise does not induce an appropriate level of stress on the participants; this is often especially true for more mature organizations.
- Silos: The exercise is not structured well as a cross-functional exercise, for example, requiring a coordinating response from both communications and reputation management to a specific mock incident.
- After-Action Report: There is a lack of direct feedback & accountability measures to ensure you incorporate your exercise learnings.
Doing it for the Wrong Reasons: Finally, and this one deserves its own special paragraph, we get inquiries all the time from people who want us to help facilitate an exercise in hopes of embarrassing their executives into action.
This is not an exercise strategy.
It’s an ambush. And it will probably only leave a bad taste in everyone’s mouth.
If you are struggling to convince your leadership to give you the resources and support you need to implement business continuity and crisis management plans, there are better ways to do this. It’s something we help our clients with all the time and we can help you too.
Keep Going
A few ways to go deeper if this was useful.
- Read more. The Ultimate Guide to Crisis Management covers where exercises fit in a full program, and how to create and conduct a rewarding crisis management exercise covers running each one.
- Run your next exercise. Exercise in a Day® builds a full custom tabletop in one business day, and Exercise in a Box® gives your leaders 15 scenarios they can run themselves.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to build your exercise strategy with us.
