Tabletop Exercises: What's up with that?

A tabletop exercise is a great way to get business continuity plans off the written page without the interruption of a full-scale drill. Rather than actually simulating a disaster, the crisis management group gathers for three hours to talk through a simulated disaster. The exercise planning process determines the participants, exercise scenario, injects and the execution order for the course of the exercise. A group of exercise planners focused on the objectives selects the best means to reach those objectives and develops a complete exercise plan known as the master scenario event list (MSEL). The MSEL serves as the script for the execution of the exercise; it includes the ordering of injects, time of execution, and the expected reactions from the training audience. It can be a full-scale production that involves local first responders and professional moderators, or it can be a simple affair conducted by in-house disaster planners. The idea is to have an escalating scenario that unfolds in several segments. After each segment, small working groups discuss how they would respond, then report back to each other before hearing from moderators about what happens next. Tips for an Effective Tabletop Decide how much gloom and doom you want. When planning a tabletop, ask: "Do you want this to be a physical event with assets damaged and destroyed, or do you just want those things inaccessible? Do you want death and injuries, or just to test the ability to get work up and going someplace else?" It’s sensible to ask your delegates to suspend their disbelief if you’re running a scenario-based exercise. It’s useful to ask them to remember you’re testing the plan, not the scenario. You can also suggest that they make reasonable assumptions regarding any issues or holes they spot. But none of this takes away from the fact that you should aim to make any scenario as realistic as possible. Test how quickly you can pull together key players. To be realistic, the crisis management team doesn't always know when a tabletop will occur. Instead, the company tests how quickly it could reach all those individuals. Specialized software pings team members' phone numbers and communications devices, alerting them that the crisis management team is assembling. Involve everyone. Make sure each person has a role. If one person answers all the questions, have others enact how they would respond if that person were unavailable. Acknowledge that first-timers may be nervous. Some business managers don't want to show that they may not know how to respond to a certain issue. To make them more comfortable, consider holding an hour-long orientation, well prior to an actual exercise. Later, work your way up to a three-hour exercise. Consider inviting local law enforcement and first responders to participate. Encourage misinformation – and add “surprises” (AKA: Injects). During a crisis, you're always asked to make timely decisions based on incomplete and inaccurate information. Also, you can be sure that there will be crises within the crisis. You can simulate the confusion this causes by giving the groups handouts containing different information. Take the lessons with you. A designated note-taker should keep track of what happens; always leave time for lessons learned.