The Anatomy of a Tabletop Exercise

A critical part of ensuring adequate, safe and reliable operations amid a crisis includes comprehensive tabletop exercises to demonstrate and assess capabilities before an event occurs.

Tabletop exercises examine capacities and capabilities to plan for, respond to, and recover from an emergency or security incident that could ultimately affect the business continuity and operational resilience of your organization.

The knowledge that comes from a process-driven approach to identifying, assessing and testing your organization’s risk management plans and practices, allows your security organization to evaluate mitigation and response strategies, as well as identify security gaps and look for areas of potential improvement.

“Among important issues to consider [during the design phase of an exercise] are what vulnerabilities does the security leader perceive exist at the present or in the future,” says Dean Alexander, Director of the Homeland Security Research Program and Professor at the School of Law Enforcement and Justice Administration at Western Illinois University. “The scenario should be crafted to test these risks.”

We’re not only talking about active shooter trainings either. Tabletop exercises should be considered for all sorts of scenarios that might affect your organization from a cyber incident, to hurricanes, to power outages, to pandemics.

“Design trainings that address current, near-term and even ‘unlikely’ threats,” Alexander advises. Doing so not only allows your security team and the organization as a whole to prepare for any number of events, but it gives your team opportunities to work together, while working across departments within your organization and agencies outside of your organization.

In order for tabletop exercises or live trainings to be beneficial to your team and your organization, consider the following critical elements.

1. Know who to include.

Of course, aside from scenarios such as weather disasters, pandemics, active shooters and others that could affect any organization, additional tabletop exercises unique to your organization and its inherent risks are imperative and require the leader not only have a good handle on identifying these potential risks, but — perhaps more importantly — also know who to include in the exercises.

“The intent of a well-designed tabletop exercise is to help individuals across the organization better understand their role in an emergency while providing a safe space to think critically about possible scenarios that could impact normal operations. It’s important to have the right people in the room and establish those goals,” says Tracy Skibins, Senior Director of Emergency Management at the University of Notre Dame Police Department.

Every team member involved in planning exercises for your organization should bring a specific value to the event. Determining who to include in the planning and execution of the exercise begins with identifying goals and objectives. Just as response plans should include specific roles, responsibilities and procedures to follow, tabletop exercises should put those response plans to action, clarifying roles and responsibilities within the organization and among other participating organizations.

2. Embrace the mistakes.

Another fundamentally important aspect to any tabletop exercise is making mistakes. Indeed, says Skibins, exercises are the times you want your team to make mistakes, for things to go wrong or procedures to be forgotten. This, more than any amount of planning, allows your organization to determine trouble spots, security gaps, and areas that need addressing and fixing before an actual event occurs.

“Remember that it’s OK to make mistakes during the exercise and this should be relayed to all participants prior to go-time,” Skibins says.

3. Regroup after completion.

When the exercise is complete, team members need to create an after-action report, says Alexander, and be sure to implement lessons learned in the future. “Obtain feedback from others and don’t ignore what you learned,” he emphasizes.

Skibins agrees that debriefings and after-action reports will go a long way in helping an organization make the most out of their tabletop exercises. “It allows you to plan for improvements and address any snafus,” before an actual emergency arises, she says.

Assessing the exercise after-the-fact can allow leaders to validate processes, identify issues, generate new ideas and even enhance training going forward. Just as they help procedurally, tabletop exercises give stakeholders a chance to work together and build confidence in their own actions and response should a real event come to fruition. Such training can promote teamwork, smooth transitions, and cement defined roles and responsibilities to ensure the organization’s emergency response runs like a well-oiled machine — even if the exact scenario practiced, turns out to be different in reality.