Terrific Table-Top Tips

For a Crisis Management Exercise

By Robbie Atabaigi

Tip: Where possible you may want to use the verbiage ‘exercise’ rather than ‘test’. An exercise promotes a
learning environment rather than a pass / fail ‘test’.

Does the word ‘Exercise’ or ‘Test’ frighten you? If you are new to the industry and / or do not have much
experience in this area, then fright would be a natural emotion. However, practice makes perfect. Plus this
information should serve as a helpful tool for both the novice, as well as the experienced, in conducting a Crisis
Management tabletop exercise.

Before we proceed any further, you might be asking yourself ‘What is a Crisis Management Team?’ The DRJ
Glossary provides the following definition: “Crisis Management Team will consist of key executives as well as key
role players (i.e. media representative, legal counsel, facilities manager, disaster recovery coordinator, etc.) and the
appropriate business owners of critical organization functions.” Your organization may call this team by a different
name, but in essence, it is the team of key executives and management who become the decision makers during a
crisis event. This team is only activated in response to a crisis event of a disastrous scale for the organization . . . or
during an exercise.

As you maybe aware, there are various levels of exercises (i.e., component, tabletop, functional, etc.). This is also
true within each exercise type. For tabletop exercises, you could start with a skeletal group of Team Leaders and
then incorporate team members as well for the next exercise. Then move onto exercising with both the primary and
alternate team members. More mature exercises may incorporate vendors, end-users, and / or local emergency
personnel (e.g., fire department, hazmat experts, etc.). Another facet is whether the exercise should be announced
or unannounced. The first few tabletop exercises should be announced to your team members so they can
successfully learn what is expected of them during a crisis event.

Now you are asking yourself, ‘How frequently should I be conducting an exercise?’ Good question. Keep in mind
that we are discussing Crisis Management Team exercises, which are very different from the full-blown IT/Disaster
Recovery exercises that, as an industry standard, usually occur annually or semi-annually. For Crisis Management
exercises, the goal is for executive management to be ready to spring into action. Conducting a Crisis Management
Team exercise on a quarterly basis would be ideal, but realistically, it could be conducted semi-annually.

As a dry run for this article, I presented a draft of this information during the May meeting of the Southeastern
Continuity Planners Association (www.scpa.us) in Atlanta. A lively discussion followed and by the end of the
session, we walked away with a refined document that listed great tips in preparing for and conducting a successful
exercise. As a result, you are being presented with a vast amount of experience within these checklists.

Although these checklists are tailored for Crisis Management issues the majority of these tips would apply for most
any tabletop exercise.

Participants:
To plan a successful exercise, you must have the correct ‘players’. Checklist #1 outlines the participants that could
be on your Crisis Management Team. Obviously depending on the size of your organization, some of the roles
maybe combined with others, or may not even exist. From this list of participants, a leader must be chosen. This
will depend upon your organization’s structure and culture. The Team Leader could be the President, VP, etc.
NOTE: In most cases, ‘C’ level management is kept informed of the situation, but usually not directly involved
with the Crisis Management Team. Again, this depends upon your organization’s structure.
(Checklist #1:)

Participants:
 Security
 Facilities
 Maintenance
 IT (data security, network, telecommunications)
 Business Continuity / Disaster Rec. Coordinator
 Finance
 Compliance
 Legal
 Risk Management
 HR
 Public Relations / Communications
 EOC Coordinator
 Government Relations
 Health / Safety
 Facilitator
 Scribe
 Other: Vendors, Key Suppliers, Customers/Users, Field Personnel,
Internal Auditor, Emergency Management Personnel, etc.

Supplies / Equipment:
Checklist #2 lists the various items you need during the exercise. You definitely want copies of the Plan brought to
the exercise. Ideally, the participants should bring their copy, but there are always a group of folks who ‘forget’.
You want to ensure the Plan is referenced throughout the exercise to ensure it is current and / or maybe in need of
revisions.

Most of my exercise scenarios are compiled in Power Point. Therefore, I bring my laptop with an LCD projector.
In addition, I have learned to bring a backup of the presentation on a separate medium. A laser pointer is also very
useful. Depending on the size of your presentation screen, you might be increasing your exercise regiment for the
day.

Ensure your exercise is conducted from either the primary or alternate Command Center. This allows you the
opportunity to test the teleconference lines, phones with multiple functions, extra LAN lines, etc. Better now than
during a true crisis event.

All other items on the checklist should be self-explanatory.

(Checklist #2:)

Supplies / Equipment:
 Crisis Management Plan (bring extras)
 Presentation on Alternate Media (CD, diskette, thumb drive, 3x5 cards, etc.)
 Laptop
 Teleconference Lines (pre-established with sufficient number of ports)
 Multiple Phones with Speakerphone and Multi-lines
 Sufficient Power Ports, LAN Connections, etc.
 Updated Emergency Contact Cards
 Hand-outs (org charts / responsibilities, etc.)
 Name Tents (name / title / team) and/or Name Badges
 Notepads / Pens / Pencils / Laser Pointer / Markers
 Large Post-It Pad and/or White Board
 Projection Screen
 Fax / Printer
 Props (ie, envelopes or a box containing numerical hours / days that can be picked
randomly to indicate the recovery of equipment, arrival of personnel, etc.)
 Forms: Problems/Issues Forms; Post-Exercise Critique Forms, etc.
To Do’s Prior to the Exercise:
You may want to revise the order of various items listed within Checklist #3. These are only suggestions. Some of
the items to address is the development / approval of the scope and objectives for the exercise. Also, it would be a
good idea to partner with the various executive secretaries to determine an available date / time of the executives
for the exercise. Another important item is to determine whether the exercise will be announced or unannounced.
As explained earlier, your first few exercises should be announced.

One thing I have learned over the years is that food is an important factor for a successful exercise. If the exercise
is a half-day session, you may want to start off with a continental breakfast, with coffee / tea, juice, etc. And you
may want to end it with an informal box lunch. Providing this type of setting allows the team members to discuss
the exercise in a de-stressed manner. As a result, more information might be revealed.

(Checklist #3:)
One Month ‘Plus’ Prior:
 Define scope and objective
 Obtain management commitment
 Determine a date/time, location, participants, and budget
NOTE: Best to conduct exercise off-site (ie, avoid interruptions, answering emails and/or voicemails during breaks, etc.)
 Reserve location of exercise site
 Schedule with ‘other’ participants (ie, customers, vendors, etc.)
 If appropriate and approved, order participant gifts
 Distribute the Crisis Management Plan for updates
 Announced vs. Unannounced
 Send announcement, if appropriate
 Create scenario(s)
Two Weeks Prior:
 Confirm scenarios with Management Liaison and/or Team Leader
 Request everyone update their contact information
 Finalize and distributed updated Crisis Management Plan
1 Week Prior:
 Coaching session with Team Leader
 Send a reminder to all participants.
 If they unexpectedly are unable to make it to the exercise, request they send their alternate.
 Verify the set-up of the exercise room
 Ensure all equipment (LCD, LAN connections, speaker phone, videoconference, etc.) is available and in working condition.
 Ask Communications to publish an article regarding the exercise
 Make arrangements for food and beverages (continental breakfast; lunch if between the 11am and 2pm timeframe; and/or snacks/beverages
for an afternoon session)
NOTE: Remember the vegetarians and/or other specialty requirements
Day Before:
 Confirm all equipment is available and working (including markers)
 Send a reminder to all participants.
 Once again, if they unexpectedly are unable to make it to the exercise, request they send their alternate.
 Create name tents and/or name badges, as well as print all handouts
Day of:
 Arrive at least 1 hour in advance to test equipment, re-arrange room (if necessary), set up names tents, notepads, pencils, hand-out packets,
etc.
Day After: - Replenish supplies and keep in a bag/box in a locked area.

Building a Scenario:
Checklist #4 is my personal favorite and the most time consuming. You will want to ensure that the scenario could
realistically happen within your environment. If your scenario has men landing from Mars, you will most likely
lose the participants’ interest for the remainder of the exercise.

Review past disaster (or near disaster) events that have impacted your industry (i.e., financial, medical, utility, etc.).
Then customize the scenario to your site. Incorporate visual aids such as maps, photos, audio clipart, etc. One item
that I incorporate into my exercise scenarios is a large font ‘I’ or ‘A’ in the upper right corner of each page. This
indicates to the participants whether the information they are about to hear is either ‘I’nformational or if ‘A’ction
on their part is about to occur.
(Checklist #4:)

Building a Scenario:
 Develop similar to a movie script; make it as realistic as possible.
 Research the internet, news, product recall incidents; consider local versus regional disasters, interview
local emergency management personnel, etc.
 Make the scenario industry specific
 Involve a major upcoming event
 Incorporate field personnel via phone
 Photos / Maps / Audio clipart (ie, telephone with ringer, stopwatch with ticking sound, counter with dollar
amount that keeps escalating throughout the exercise reflecting the current monetary loss, etc.)
 Twists / Newsflash
 May want to incorporate local emergency management personnel into the exercise. They would love the
opportunity
 Ensure all business areas are affected
 Timeline the scenario to meet real-time reactions (4 day scenario played in 4 hours)
 Employees injuries, deaths, communication issues, hardware/software issues, shifts, food, expose known
and unknown vulnerabilities, etc.

Conducting an Exercise / Post-Exercise:

Prior to presenting the scenario, you will want to address housekeeping issues and ground rules as indicated within
Checklist #5. One key item to highlight for the participants is to ‘Accept the Scenario’. Lots of time and
frustration will be saved as a result.

Throughout the session, you will want to use the whiteboard to record action items identified during the exercise.
This strategy will provide you with an efficient re-cap at the end, as well as provide an opportunity to identify
owners for the various action items.

As outlined in Checklist #6, explain to the participants they will receive the minutes as well as a bi-weekly Action
Item Report until the action items are resolved.

Then distribute a souvenir to commemorate the exercise. Take time to ensure the souvenir is unique. As a
conversation piece, it can promote future participation from existing and potential team members. In addition, you
may want to post an article and / or photos of the exercise on the organization’s intranet site. This is a great
strategy to provide awareness of the business continuity program.

And finally, revise the Plan to reflect any changes resulting from the exercise.

(Checklist #5:) (Checklist #6:)

Conducting an Exercise: Post-Exercise:
 Review evacuation route/assembly points for facility  Review and compile the surveys
 Remind to silence cell phones / pagers  Compile and distribute minutes
 Review the objective / scope  Report on progress of action items on bi-weekly basis
 Exercise vs. test; Learning experience in ‘safe’ until resolved
environment / Interact with all participants  Revise Crisis Management Plan accordingly
 Accept the scenario(s)  Post related photos/an article on the intranet site.


Time limit (scenario, response, etc.)
Team Leader to act as ‘umpire’, if necessary
 Participant Gifts–Suggestions: Plaques, certificates,
caps, pens, movie tickets, t-shirts, mugs, cards, mini-
 Identify owners / deadlines for Action Items
flashlights . . . All with a ‘preparedness theme’
As stated at the beginning of this article, many experienced practitioners reviewed and contributed to these various
checklists. However, we are in an industry that constantly seeks to improve. If you have any items you would like
to add and / or to provide comments, please feel free to contact me. Hopefully, you found this information useful.