Exercises are an important part of preparedness and the lifecycle of crisis management, business continuity, or communications planning.
But most exercises are just plain boring.
In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk about why exercises are often so boring and techniques to “spice them up” for your exercise participants. Topics include non-linear exercises, varying inject introduction methods, and the need for unique, high-energy facilitators.
Episode Transcript
Bryan Strawser: I have been to a lot of boring exercises.
Jen Otremba: Yeah, I was at one last spring that was so boring.
Bryan Strawser: Why was it boring? It was boring because poorly facilitated, poor content?
Jen Otremba: It just felt very monotone. It felt it was a little bit drug out, I thought. It was super long. And it was just boring.
Bryan Strawser: Do you think in that case of the boring exercise that the folks that were doing the exercise got anything out of that?
Jen Otremba: I think that they probably still got some things out of it. I think that they recognize that they were lacking in certain areas and they didn’t have some of the information that they needed. But, in general, I don’t think they got out as much of it, because I don’t think it was very memorable.
Bryan Strawser: What I think has been typical at least of the exercises I’ve gone to is that they’re just poorly constructed. They’re almost always about the most innocuous thing that you could have happen, or it is about the alien invasion and we’re all going to die. It’s like the Kobayashi Maru from Star War … Star Trek, that there’s no way that you’re going to survive the scenario. It’s the no-win scenario.
Jen Otremba: Yes, and I think in this case, I think it felt like a scenario that they have run 300 times before, and the way they presented it, it was as if they were bored with the scenario, because they’ve done it a bunch of times before. I don’t think it was very well done towards … done for the client to meet their specific needs.
Bryan Strawser: It’s really unfortunate because I think that I think exercises are important. I think we spend an enormous amount of time in the business continuity, or crisis management processes of conducting risk assessments and doing the business impact analysis, if you do those. The constructing plans and then it’s time to practice, because that’s how you build muscle memory. That’s how you kind of understand roles and responsibilities in real life, and then the exercise is always such a let down.
Jen Otremba: Yeah, ultimately you don’t want to spend all that time on the plan, and just put it on the shelf-
Bryan Strawser: Woo-hoo, we’re done.
Jen Otremba: We did it. It’s obviously best to test those processes, and make sure that they’re working and not wait till an actual crisis to test them.
Bryan Strawser: And they have to be tested in a realistic manner. We don’t want to test the, oh, the network switch failed, and that’s your exercise scenario, but you also don’t want the, hey, I’m out here in space by myself and now there’s five Klingon warships about to destroy me, and I’m going to die.
Jen Otremba: Right. You generally don’t want to do a zombie apocalypse as a realistic scenario. While it sounds fun and exciting-
Bryan Strawser: How do you defend your business against the zombies?
Jen Otremba: Right. I mean, it sounds fun and it probably is fun at the time, but are you actually getting out of it what you need to get out of it.
Bryan Strawser: We connect a lot of exercises here at Bright Path for clients, and we’ve come up with some unique and interesting scenarios, but I think we’ve learned a few things about how do you make your exercises fun and relevant?
Jen Otremba: Memorable.
Bryan Strawser: Memorable maybe, is the right term. One thing that I think we’ve really done recently has been getting away from the what we’ve called the boring linear exercise, where somebody’s talking in a monotone at a podium and it’s okay, step one. Here’s the scenario. Step two, this happens. What do you do? Step three, this happens. What do you do?
Jen Otremba: Yeah, and now this.
Bryan Strawser: And now this, and now that.
Jen Otremba: Yeah.
Bryan Strawser: Oh, and here’s an inject that you didn’t see coming.
Jen Otremba: Right.
Bryan Strawser: And here’s that. I don’t know, because crises don’t evolve in that linear fashion.
Jen Otremba: They never do.
Bryan Strawser: Maybe if the scenario really is like, oh, the network switch failed, and we lost internet connectivity.
Jen Otremba: But is that really a crisi then at that point?
Bryan Strawser: Ooh, a crisi.
Jen Otremba: Crisi … crisis.
Bryan Strawser: Is it? It depends on your organization, right? It depends on your risks.
Jen Otremba: Yeah.
Bryan Strawser: But what we’ve been constructing more recently has been, I think, more nonlinear scenarios, because that’s real life. When you get into a data incident … data incident or breach. For example, it’s going to come at you from all directions. We joke sometimes that, wow man, like life comes at you fast.
Jen Otremba: Yeah.
Bryan Strawser: But it’s true in most situations.
Jen Otremba: In our previous employer we experienced that many times when we have a major situation going on, and we talked about this in previous podcasts too, but we have a major situation going on over here, but then we also have other things that continue to pop up as well.
Bryan Strawser: What’s the great scene in the movie Crimson Tide about the submarine captain that Gene Hackman and Denzel Washington plays the XO, and they have the conflict between the old generation and the new, but there’s a scene early in the movie where there’s a fire. A real fire onboard a sub, which is a life threatening situation, and as they’re fighting the fire, the captain orders a missile drill. The crew reacts, but Denzel Washington, playing the XO of the boat, kind of freaks out on the captain.
Jen Otremba: Yup.
Bryan Strawser: And the captain’s like, “We’ll talk about this later,” and then after the test is over they meet in his cabin, and the captain’s like, “I think that the perfect time to run a drill, because we’re going to have bad stuff happen, and then something else bad is going to happen, and we got to deal with them both.”
Jen Otremba: Right.
Bryan Strawser: So we practice.
Jen Otremba: Well, to be fair, is there ever a good time to run a drill?
Bryan Strawser: No.
Jen Otremba: No, because there’s always something going on.
Bryan Strawser: So when we talk about a nonlinear exercise, what we’ve done has been to combine this multiple sensory experience where you’ve got your team in a room, or you’ve got them virtually on a WebEx, or go to meeting or whatever, and you’re working through what feels like the typical table top scenario. You’re going from point A to point B to point C, when the phone rings in front of the communications team. And they pick up the phone, and there’s an actor, role playing a reporter. You can’t run from that. You got to deal with it. It’s not like, oh, I’ve read the scenario on the PowerPoint and here’s what I’m going to do. It’s … they’re on the phone and I have to react to the real time.
Jen Otremba: Right, and the whole group doesn’t stop while that person takes the call.
Bryan Strawser: Right. The facilitator has to keep the thing going.
Jen Otremba: The group is still trying to work through the problem while the communications expert is on the phone over there, and eventually we’ll get off the phone and say, “Hey guys, something changed.”
Bryan Strawser: Yup, okay, we have a pause and now we have a comm’s team explain to us-
Jen Otremba: What’s going on.
Bryan Strawser: What just happened.
Jen Otremba: Or an email.
Bryan Strawser: Or an email.
Jen Otremba: You could get an email.
Bryan Strawser: Or both at the same time.
Jen Otremba: Right.
Bryan Strawser: To the general counsel gets a phone call, or your sales team gets a phone call, and the list goes on.
Jen Otremba: Or there’s non-pertinent information that starts coming in, and they have to sift through is this something I need to deal with now, or not?
Bryan Strawser: So one thing I think we’ve done effectively, more recently, has been to interject in the exercise just completely irrelevant stuff, that has a very casual relationship to the incidents, perhaps a physical security incident at the campus that causes people to have to step out and deal with that. It could be a second smaller crisis situation that seems urgent at first, but isn’t, but the point is that we’re trying to … this is real life, we’re trying to break up the process and make it more nonlinear and catch people a little off guard, and get them used to dealing with things in different ways.
Jen Otremba: Forces them to prioritize and triage as well.
Bryan Strawser: Mm-hmm (affirmative).
Jen Otremba: Yup. We’ve done that a few times. We just did that recently.
Bryan Strawser: We did this this week.
Jen Otremba: We did.
Bryan Strawser: At least the week we’re recording this anyway.
Jen Otremba: Yes. Yes, exactly.
Bryan Strawser: So the first thing to make your exercise not boring is to have … think about this nonlinear process of how can you break it up, and how can you do injects and bring the conversation forward in a different way. We’ve gone as far as to have radio reporters do voice over news reports for us that we can inject into the exercise. We’ve had actors call in and role play different roles. We’ve had print news stories that have appeared. We’ve sent emails. We’ve done the phone thing, as we’ve described. We’ve had people pop on the WebEx conference call for the exercise, and say, “Hey, I just got this number. I got this situation going on,” and it’s just a distraction.
Jen Otremba: Yup.
Bryan Strawser: But it’s to see what the group does. Are they going to punt it, which is really what you want, get the non-essential stuff out of the way, or are they going to get bogged down in detail arguing about this thing that has injected itself.
Jen Otremba: Yup. I think it’s good to be creative, I guess, in this respect, because it’s going to keep people interested and keep people engaged in the whole process.
Bryan Strawser: So when the exercise is … this exercise has to start, by the way, with I think a viable scenario, and the more that you can tie it to an actual real risk that the company is afraid of, or should be afraid of, then I think there’s the more likelihood you’re going to get good participation, and a really good engagement from the group. So the more you understand about the company and some of the risks that they’re faced with, that where perhaps there are gaps that are not closed.
Jen Otremba: Yup. And I think sometimes it depends on do you know exactly what it is that you’re testing, so yeah, we know we’re testing this plan that they just created, but is there some kind of specific weakness that you want to outline for them, so that they have to work that out. What is it exactly that you’re testing.
Bryan Strawser: Right. Have a good scenario. Construct a nonlinear exercise, and when the exercise is over, what do we do? Will we connect a good after-action process, so we’re trying to understand what do we all … I would just start the question of what did we see here today? What did you see? I’m not asking for wins or opportunities, I’m just asking the big open-ended question, and you get interesting answers when you pose that question.
Jen Otremba: You do. Yeah. Then also that immediate discussion I think is important because there’s things that are just real fresh on people’s minds that they want to get out right away. So that initial … those initial thoughts and observations are super important to capture.
Bryan Strawser: And then what are the wins and what are the opportunities, and what do we want to do about what we saw here today. I think it’s important there to make sure that you get good concrete clear actions, and who’s going to do it, coming out of that conversation, coming out of that after-action? Then there should be a written report, even if it’s just a few pages, but how do you translate that kind of after-action discussion into here’s what the report says?
Jen Otremba: Well, and what we’ve done too, is we’ve done, say, a survey after, so it gives them a little bit more time, a couple of days maybe, to actually really think through the things that they want to capture in that after-action as well. The initial discussion followed by a survey, followed by the report, followed by maybe some sort of a presentation of key findings. So then what? What do you do with all that information?
Bryan Strawser: Well, then you’ve got work to do. You’ve got action items to go address, and follow up on, but I also think that you should look at what’s the next exercise? This should not be a one time a year thing, particularly with your crisis process. You want to be able to go … you want to be able to kind of make this a constant evolution, because you want the muscle memory with your team. You want their roles and responsibilities to be clear. You want them to be used to collaborating in working through this process, so your next exercise should attempt to break something different within that process, and hopefully you’ve addressed those after-action items-
Jen Otremba: Yeah.
Bryan Strawser: That have been addressed in your previous exercise.
Jen Otremba: Right, so whether that be some sort of a process change, or a change in the plans, or even just a additional training maybe, is all is needed-
Bryan Strawser: Right.
Jen Otremba: To utilize the plans that already exist.
Bryan Strawser: Right.
Jen Otremba: And then retest.
Bryan Strawser: Yup. So, we do a lot of exercise work here at Bryghtpath. If it’s something we can help you with, feel free to reach out at bryghtpath.com/contact, or give us a call at 612-235-6435. Good luck with your next exercise.
