Resilience through crisis management
Enhancing preparedness with simulation and tabletop exercises
Crisis management is a critical component of any organization’s strategic planning, and it becomes even more important during unexpected and challenging times. Recent events such as the COVID-19 pandemic, geopolitical instability or the increase in cybercrime have reminded us of the importance of having a well-designed crisis management plan. Such plan can help an organization deal with a crisis effectively, minimizing the impact of the crisis and reducing potential damages.
Components of a comprehensive crisis management plan include:
- Risk assessment: identifying potential threats and assessing their likelihood and potential impact.
- Mitigation strategies: developing plans to prevent, minimize, or manage risks.
- Response plans: outlining the steps to be taken during a crisis, including communication, coordination, and resource allocation.
- Recovery plans: establishing procedures for restoring normal operations and addressing long-term impacts.
- Documentation: creating and maintaining records of crisis management plans, procedures, and training materials.
However, even the best crisis management plan can fall short if it has not been tested. Simulations and tabletop exercises are the two types of tests commonly performed to ensure effectiveness. While different in their testing scope and the way they are performed, these two exercises enable organizations to identify potential gaps in their plan (missing procedures or perfectible execution) and ensure that everyone involved is familiar with the plan and knows their roles and responsibilities. After all, a plan is only as good as the way it is followed.
Ideally, as a best practice, such exercises should be conducted on a yearly basis. In a long term continuous improvement approach, the objective will therefore be to build on gaps identified during the debrief phase of the previous exercise in order to identify which aspects to focus on during the next test.
Simulation exercices
A simulation exercise is a practical and interactive training session that mimics real-life crisis scenarios. Participants are required to respond to simulated events, allowing them to practice their roles and responsibilities in a safe and controlled environment. These events are derived from plausible risks identified during the risk assessment phase of the crisis management plan.
Concretely, the simulated events can vary from a critical application not functioning properly, to a whole data center being down. They can be tailor-made and combined in order to test the plan on the most important risks faced by the organization doing the simulation. While particularly interesting for its modularity and the possibility to test the plan in depth, a simulation exercise requires a lot of preparation and is hard to use on less mature organizations.
Tabletop exercises
On the other hand, a tabletop exercise is a discussion-based activity that involves a group of participants (usually the board and heads of key divisions), called the Crisis Unit, working through a hypothetical crisis scenario. Typically, a team of six to twelve people will sit together in a room for a couple of hours and will have to react to incoming stimuli. Those stimuli are combined to form a plausible scenario. They can vary in form (incoming email, phone call, news article…), sender (employee, client, supplier, journalist,…) and content (notification of incident, malfunction, complaints, request for interview,…). As with simulation exercises, stimuli can be adapted to better focus on risks specific to the organization.
Which one should you choose?
Even though both types of exercises are good opportunities to practice hypothetical scenarios in a low stress environment, they still differ greatly. Tabletop exercises focus on decision-making and communication, allowing to test the higher level components of a crisis management plan. On the contrary, simulations are about physical actions, detailed planning and execution, which can make them more complex and longer in duration.
Both exercises are complementary and organizations should ideally test their crisis management plan with the two of them. However, depending on the context of an organization, its goals and resources, practicing with only one of them can be the most relevant choice.
Tips and Conclusion
To make the most out of tabletop and simulation exercises, it is key that participants get fully involved, communicate clearly, and, most importantly, identify areas for improvement. Following the response plans will help identify missing or deficient components, while collaborating with all members of the crisis unit is essential for effective teamwork. Moreover, sharing insights at the end of the exercise will help improve future response plans, both in terms of content and organisation. By implementing these tips, participants will get the most out of the exercises and improve their emergency preparedness and response skills even more.
In conclusion, testing your crisis management plan through simulation exercises and tabletop exercises is crucial to ensure that your organization is well prepared to handle a crisis. Whether through simulation exercises or tabletop exercises, regular testing will help you identify gaps in your plan and ensure that everyone involved knows their roles and responsibilities. With a well-designed and tested crisis management plan, your organization can minimize the impact of a crisis and even turn it into an opportunity to learn and grow.
Authors
The Resilience Lab
Sources: