Tabletops are only useful when they change behaviour. The goal is to build muscle memory, not to produce a slide deck.
Design exercises that stress real constraints: time, ambiguity, and incomplete information.
Design Principles
Pick scenarios that match your organisation’s risk profile and recent near-misses. Make the first 15 minutes uncomfortable—because that’s when real incidents go off-rail.
- One clear objective per exercise (e.g., comms clarity, escalation discipline)
- Injects that force decisions (not just discussion)
- Role clarity: who decides, who communicates, who documents
Measure What Matters
Measure time-to-decision, information flow, and stakeholder alignment—not just whether the team “talked through it.”
Capture gaps as actionable items with owners, not as general observations.
After-Action Follow-Through
If you don’t close action items, tabletop programs become theatre. Track remediation and re-test.
Inject Timeline (Example: First 30 Minutes)
Plan injects that force real decisions under time pressure. Keep injects short and specific so teams can’t “talk around” them.
- Minute 0: initial report with incomplete details; decide immediate actions and who is incident lead
- Minute 7: conflicting information appears; decide what to communicate and to whom
- Minute 15: operational constraint hits (system outage, vendor unresponsive, senior stakeholder calls)
- Minute 25: escalation threshold is crossed; decide whether to pause operations / notify authorities / activate crisis team
Scorecard (What to Measure)
Use a simple scorecard so you can compare exercises over time and demonstrate improvement.
- Time-to-assign incident lead and decision authority
- Time-to-first stakeholder update with a clear message
- Clarity of escalation trigger usage (followed vs improvised)
- Action item quality (owner + due date + verification method)
Checklist
- Define exercise objective and decision thresholds.
- Assign roles and comms channels.
- Run injects that force time-bound decisions.
- Record gaps as actions with owners and dates.
- Use a scorecard and track improvement over time.
- Re-test the top three gaps on a defined schedule.
Exercises should be aligned with business continuity and crisis management policy.