By Tam Williams, KingsBridgeBCP:
Tabletop exercising success. Whether you’re conducting your first, you conduct them regularly or you’re looking to improve them, there are always steps to take to make your tabletop exercising more successful. Here are the 10 steps you’ll want to take to make your next tabletop exercise a success.
1) Choose the Correct Format
There are lots of different ways to achieve tabletop exercising success. Here we’ll discuss two options, but of course, you may want to use a hybrid of these two:
First, you can have everyone in the room together: representation from all of your recovery teams in one room. Run through the exercise as one large group over the course of a number of hours.
Second, you can use a small group format where each team conducts an exercise on their own with just their recovery team. You’ll need to understand the readiness of your plan and participants to make the best choice.
More experienced teams with more mature plans tend to really benefit from the large group approach. This format has its strengths: a) the interdependencies can be highlighted; b) management can practice their role in managing the response and c) you get the exercise over within one day.
On the other hand, less experienced participants may find this approach overwhelming. It does not provide a lot of opportunities to drill down into issues with individual plans. Lastly, scheduling it can be really difficult to find time in everyone’s calendar.
Less experienced teams and/or less mature plans tend to benefit from the small group approach. There is a number of reasons for this: The environment is less intimidating. There is ample time for questions. Each team is addressed individually, allowing time to drill down into issues with individual plans. Scheduling is easier as everyone only has to commit to one hour in their calendar. However, the teams don’t get to experience seeing management in action, and tracking interdependencies can be more challenging.
2) Update Your Plan!
To smoothly achieve tabletop exercising success, you don’t want to get side-tracked with lots of out-of-date information. Here are some points that will scuttle your tabletop exercising success before it even gets started:
- a) update your plan
b) all participants have a copy of the most recent version of the plan
c) keep a close eye on the team membership.
If your company has high turn over or people move around within your organization, be sure to capture these changes. It is critical to have the right people around the table when the exercise begins.
3) Pick an Appropriate Scenario
Make sure you’re picking a scenario that is appropriate to the risks for your organization. To know what is a possible scenario, the Threat Risk Assessment (TRA) is a good place to start. Once possible scenarios have been defined, refer to your Business Impact Analysis (BIA) for their impacts. It is very possible that a threat has little to no impact to your critical business units.
Armed with this information, pick a scenario that touches on one or more of the four major results or outcomes from a business interruption: no building; no people; no systems; or no third-party providers. To ensure tabletop exercising success, you want your scenario to be both realistic, yet also provide some variety.
If you or your team(s) get stuck on one type of scenario, they might not be able to adapt when something different occurs. For example: If your scenario impacts your building, your teams may struggle when they don’t have their systems. If “no systems” is used too often, can they respond when their key vendors are unavailable?
4) Seek Expertise
With a scenario selected, you now need to do a little research to make sure it’s truly realistic. This might mean meeting with IT to ensure the system outage you have planned can realistically run the number of days you’ve laid out in your scenario. It doesn’t end with IT, check with facilities to verify exactly what the generator will power and for how long. You may also need to check with experts outside of your organization. For example, confirm your scenario matches how long you can expect to be out of your building while an arson investigation takes place.
5) Select Appropriate Facilitation Techniques
A well-run meeting can do wonders for making your participants more likely to come back for more. When you’ve got positive participants, you have greater odds of tabletop exercising success.
Start with a little research into facilitation techniques that can help make your meeting a success. A quick round of introductions can be a great ice breaker exercise, it helps those that don’t know each other to get comfortable. Your teams will need to work well together and that comes from comfort and/or familiarity with each other.
Consider establishing ground rules at the start. These can range from how participants are to contribute, what should they do if their phone rings and when will you break for lunch. To more substantive items such as “don’t question the how of the scenario, deal with the results” rule to avoid the exercise getting sidetracked. When discussing the scenario, it is VERY common to get caught up in a number of “what if” discussions.
You’ll also want to consider how to get the quieter folks in the room to participate, “quiet ones” will always defer to those who “take charge.” Find a way to get all of the information from all of the participants. Equally, you may need to temper the involvement of the more dominant personalities.
Prepare a “parking lot” to house future discussion points for further discussion. This keeps the discussion moving and avoids a single issue slowing down the meeting. If you find yourself running a lot of tabletop exercises or just longer meetings, a good facilitation course is a great investment in your professional development.
A lot of great information gets shared during a tabletop exercise and you don’t want to miss any of it!
Here are 4 VERY simple steps to take:
- Large strategic issues where the plan may not be as solid as you thought.
- Smaller action items such as updating areas where information is no longer correct.
- Be sure to have both a facilitator and a scribe at all exercises. The facilitator will have enough work to do just running the meeting to take any notes, so be sure to have a single person assigned to simply capture.
- Provide lots of paper at all of the tables in the room so that participants can write down their thoughts. Even if they don’t have the opportunity to share them with the room, reviewing these notes after the fact can highlight issues that didn’t bubble to the surface during the exercise. You can even label the paper at the table by each phase of the exercise and encourage participants to take their notes on the corresponding sheets of paper as the exercise progresses.
Now of course in our current pandemic situation, small group tabletop exercises via videoconference are absolutely doable and you then have the option of recording the session as well as having participants write in their comments using the chat function (participants can also send these comments privately to the facilitator if they so choose).
7) Effective After-Action Review
You’ll want to cover two different aspects in your after-action review. First, there is how well the plan held up. Could there be any strategic areas to improve? Where all the teams prepared? Was the information in the plan current and sufficient to make the necessary decisions, etc.
Second, we need to evaluate how well the exercise itself was conducted. Was the scenario appropriate? Difficult enough but not too difficult? Was the room the correct size? Where the correct participants there? Did everyone find it was a good use of their time? Was the actual exercise process too painful or cumbersome for those involved? We do want them to come back for the next one!
8) Update the Plan and Address Action Items
Don’t overlook anything that you learn from the exercise. Any good tabletop exercise can unearth so much great information that needs to be at the tip of everyone’s tongue. Be sure that strategic gaps, missing information, outdated information, business processes are streamlined to be performed more efficiently or effectively. The moment the exercise is complete is the moment to start addressing these issues. If there are left over issues, you will be addressing them next year. This will leave your participants wondering what the point of all this is. A supercritical action plan at this point is to ensure that the plan gets updates and address all strategic issues.
9) Share Your Success
Share you success! Update your plan, address the action items and grab this valuable opportunity to share your success. Obviously, share with management, your board, key customers, auditors, etc., but it’s more important to share with your exercise participants.
One of the big challenges with business continuity is raising the profile of the plan and program. Some auditors have said they should be able to walk into an organization and ask any employee about a company’s business continuity plan and that employee should know that the plan exists and what their role is in that plan. Once your exercise is complete, seek out opportunities to raise its profile. Great places to begin sharing are internal newsletters, all hands meetings, or the corporate intranet to raise the profile of your program in the eyes of the employees, as well as management.
10) Make it Routine
Lastly, it’s important to make tabletop exercising and business continuity routine within an organization. This doesn’t mean having large-scale exercises on a monthly basis but there are other ways of injecting business continuity into the everyday without this level of formality.
One method is leverage evacuation drills:
- While departments are standing in the parking lot waiting for the green light to be let back inside, use this opportunity to target a department or two to see how prepared they are should they be told at that moment that they are not getting back in the building for a few weeks.
- If you have a company policy that laptops are to go home at the end of the workday, you can run friendly competitions to see which departments leave the least number of laptops behind on a given evening.
With these occasional exercises you can keep everyone in the business continuity frame of mind and encourage employees to see business continuity as more than just plan updates and the occasional tabletop exercise.
About KingsBridgeBCP: KingsBridgeBCP offers businesses of all sizes BCP Software Solutions and industry know how based on best practices. From a FREE Edition to a Platinum Edition there is a Shield for everyone. Customize our software packages to meet your needs, to ensure you are getting the best value in every project. To learn more about KingsBridge click here.