Optimizing Crisis Management Exercises: Best Practices From Drills to Crisis Simulations

One great exercise does not make a prepared crisis team. A program of exercises does, each one harder than the last. The best practices for conducting crisis simulations start long before the simulation: with the drills and tabletop exercises that earn a team the right to be put under real pressure.

Most organizations do it backwards. They run the same annual tabletop for five years, or they jump straight to a full-scale simulation with a team that has never practiced together. Neither builds capability. Here is how to optimize your crisis management exercises as a progression, from the first drill to a simulation that tests the whole organization.

Start With What the Exercise Is For

Every exercise needs objectives tied to what your organization actually worries about. If a data breach is your most likely crisis, your exercises should test the decisions a breach forces: when to notify, who approves a statement, and when your executives get involved. If you run plants, test a site loss. The scenario is the vehicle. The objectives are the point.

Three rules before you design anything:

• Train first. An exercise tests whether people can use the plan. If they’ve never been taught the plan, you’re testing something else. As I said on Managing Uncertainty, Episode 307, without training “exercises risk becoming a place of what I would call failure theater instead of being a learning experience.” Executive training can take as little as an hour.
• Have a plan to test. Never run an exercise against a plan that doesn’t exist just to prove you need one. All it does is frustrate people.
• Decide what kind of exercise this is. A confidence builder, where the facilitator guides the team, or a challenge for a mature team, where the facilitator adds pressure and fog. Both are valid. Mixing them up is how exercises go wrong.

The Exercise Spectrum: Drills, Tabletops, and Crisis Simulations

Exercises run along a spectrum, and realism and stress rise as you move up it. Ready.gov describes walkthroughs and orientation sessions, tabletop exercises, functional exercises, and full-scale exercises. The Homeland Security Exercise and Evaluation Program (HSEEP) groups them as discussion-based and operations-based. In the private sector, the useful rungs are:

• Drills. Short, focused practice of one task: an evacuation, a mass notification, an employee accountability roll call. Drills build muscle memory and let teams learn each other’s roles at low cost.
• Microsimulations. Short, self-run scenario discussions a business leader can lead in under an hour. They keep teams sharp between bigger events. More in Using Crisis Microsimulations to Counter Crisis Fatigue.
• Tabletop exercises. A facilitated discussion of a scenario that unfolds in moves. Tabletops build confidence and cohesion, and they are the right starting point for a new team or a new plan. If people spend the session listening instead of deciding, it was a briefing, not an exercise.
• Lightweight or functional simulations. Teams receive real-time inputs and do part of the work, such as drafting the holding statement or making the notification decision, for one function or one part of the scenario.
• Full crisis simulations. Multiple teams work a scenario in real time, through real channels, with a control cell driving injects and consequences. Our crisis simulation page puts it simply: “If a tabletop validates the plan, a simulation validates the organization.”

Use “simulation” for the formats where people do the work. A tabletop is a discussion, and calling it a simulation sets the wrong expectation.

Build a Multi-Year Exercise Program

The goal is a cadence, not an event. On our exercises page we describe it this way: “microsimulations and tabletops through the year, with a major simulation on a one- to two-year cycle.” A program that matures over three years often looks like this:

• Year one: build confidence. Train the crisis management team. Run drills for notification and accountability. Hold a facilitated tabletop for the crisis team, then tabletops for key business units. Fix what they find.
• Year two: add pressure and people. Run tabletops twice a year with harder scenarios. Add a lightweight simulation for communications or information security. Bring in your executives and a critical vendor.
• Year three: test the organization. Run a full crisis simulation that carries the scenario from detection through the crisis team to your executives, with your outside partners playing their real roles. Keep microsimulations and tabletops running in between.

Our Exercise Maturity Model describes the same climb, from ad hoc drills and tabletops (“Everybody starts here”) to a defined strategy where simulations are built in and executives practice alongside the crisis team. As we put it on Episode 172, “It’s really about building confidence and elevating difficulty over time.” On that episode we described a client we had exercised for about five years: “they’ve evolved from drills and tabletops on more of an ad hoc basis to now this almost fully integrated real-time simulation.” That is what a program looks like.

The progression applies to people as well as formats. For a major U.S. health insurer, we built an executive cyber-extortion tabletop that extended an earlier crisis-team exercise to the company’s executives, so it could test the escalation from the crisis team to its most senior leaders.

Best Practices for Conducting Crisis Simulations

When your team is ready for a simulation, these practices separate a real test from an expensive meeting.

1. Test the full escalation chain. Run the scenario from the people who detect the problem, through the crisis team, to your executives. “You have to simulate and practice handoffs between teams because that’s where we see the biggest breakdown” (Episode 172).
2. Use real channels. Send injects by email, text, Teams, and phone, the way information arrives in a real crisis.
3. Make the team do the work. Draft the press release, make the pay decision, write the regulator notice. Discussion is for tabletops.
4. Give actions consequences. If the team tells a reporter “no comment,” the story runs. On Episode 172 we described exactly that: “25 minutes later in the simulation, the story breaks on Bloomberg.”
5. Bring in the outside world. Media, regulators, customers, and third parties all put pressure on a real response. Include your critical vendors and outside counsel. On Episode 281 I noted that many outside counsel “expect to come in and run the show,” and that in one joint exercise “neither company really knew the details of each other’s business continuity plans.” Find that out in practice.
6. Use time as pressure. Multi-day simulations, where teams meet once or twice a day and work issues between calls, feel far more like a real crisis than two hours in a conference room.
7. Stress the process, not the people. Push hard, but never ambush. End the simulation in recovery, so people leave having worked their way through it.
8. Use a facilitator who adapts. Teams go off script. A good control cell adjusts in real time and keeps the exercise on its objectives. Success is meeting the objectives, not reaching the last inject.

Common Pitfalls in Crisis Management Exercises

• Silos. Security runs its tabletop, legal runs its own, and communications runs a third. The real incident will not be that polite. Exercise the handoffs between teams.
• The same scenario every year. If your team handles the scenario well, it’s time to change it. The scenarios that break teams are rarely the ones in the plan.
• No feedback. If participants leave without hearing what went well and what didn’t, the exercise taught them very little.
• No accountability. Findings without owners and due dates come back as the same findings next year.
• Executives on the sidelines. Your executives make the hardest decisions in a crisis. If they never practice them, you haven’t tested your response.

After the Exercise: Hot Wash, Survey, and After-Action Report

The After-Action Report (AAR) is the only part of the exercise that outlives the day. Do three things:

• Hold a hot wash immediately. While memories are fresh, agree on the factual timeline, what worked, and what didn’t.
• Send an anonymous survey the next day. People who have had a night to think will tell you things they wouldn’t say in the room.
• Deliver the AAR within seven to ten days. Write it in plain English, prioritize the findings, and give every action an owner and a date. Test the open items again in the next exercise.

Our guide to an effective after-action process walks through each step. For the wider case for exercising at all, start with crisis management exercises.

A single exercise tells you how your team did on one day. A program tells you whether it is getting better. Build the program.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the exercises section of our Ultimate Guide to Crisis Management.
• Start the progression. Exercise in a Box® gives your leaders 15 scenarios they can run themselves, and Exercise in a Day® builds a full custom tabletop in one business day.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to plan your next exercise, or your next three, with us.