Tabletop Exercise Guide: How to Plan and Run One

What is a tabletop exercise?

An exercise is a controlled, objective-driven activity used for testing, practising or evaluating processes or capabilities.¹ ISO 22398, the international guideline for exercises, separates discussion-based exercises, which talk through a scenario, from operations-based exercises, which put people and systems into action.² A tabletop exercise is the main discussion-based form.

Participants sit together, in person or online, and respond to a scenario that the facilitator unfolds over a few hours. Nothing is switched off, no one is evacuated and no system is failed over. The output is a set of observations about whether the plan, the people and the decisions would hold up in a real event.

When should an organisation run a tabletop exercise?

• When a new crisis management or business continuity plan has been written, to check it before it is relied on.
• When a new executive or crisis management team has formed and has never worked a scenario together.
• As part of an annual requirement. ISO 22301:2019 expects business continuity arrangements to be exercised at planned intervals, and APRA-regulated entities must run an annual business continuity exercise under CPS 230.³
• After a real incident or a near miss, to test the fixes that came out of the review.
• Before a known period of risk, such as a major event, a system migration or the bushfire and storm season.

How do you plan a tabletop exercise?

Most of the work in a good tabletop exercise is done before the day. Agilient plans each one in this order:

• Aim and objectives. One sentence of aim and three to five objectives, each written so it can be assessed, for example “test whether the crisis management team can decide within the first hour whether to close the site”.
• Scope and participants. Which plan is being tested, which teams take part and who is deliberately left out. Include the alternates, not only the principals.
• Scenario. A narrative that will force decisions against the objectives, built from the organisation’s own risk register.
• Injects. The timed pieces of new information that move the scenario on and create pressure.
• Roles. A facilitator who runs the discussion, a controller who manages timing and injects, observers who record performance against the objectives, and a scribe who keeps the decision log.
• Materials and logistics. Participant briefing, plan extracts, a room or video link, and a clock that the facilitator can move forward.

Agree the ground rules in advance. The exercise is no-fault, participants respond as they would on the day rather than as the plan says they should, and what is said in the room stays in the room except as recorded findings.

How do you write a good tabletop scenario and injects?

The scenario should be severe but plausible. A scenario that is too comfortable teaches nothing, while one that is implausible lets participants dismiss it. The best scenarios come from the organisation’s own risks: the loss of a key site, a supplier failure, a serious security incident, extreme weather affecting staff and premises, or a prolonged technology outage.

Reveal the scenario in stages. Each stage moves the clock forward, perhaps to the next morning or the following week, and adds information that forces a new decision. Injects can include a call from a journalist, an email from a regulator, a message from a worried family member, a supplier saying a delivery will not arrive, or a social media post that turns out to be wrong. Some injects should deliberately leave information incomplete, because real crises rarely arrive with all the facts.

Write the injects against the objectives. If an objective is to test escalation, there must be a point at which the team has to decide whether to escalate, and the observers must know what good looks like at that point.

How should a tabletop exercise be facilitated?

A tabletop exercise for an executive or crisis management team typically runs for two to four hours. The facilitator opens with the aim, the ground rules and the starting situation, then releases each stage of the scenario and its injects in turn.

The facilitator’s job is to keep the discussion on the objectives, draw out the quieter participants and stop the group solving problems that are not theirs. When a team reaches a decision, the scribe records it, the time and who made it. When a team stalls, the facilitator can prompt with a question rather than an answer. Observers stay silent and record what they see.

Close with a hot debrief while memories are fresh: what went well, what did not, and what each participant would change. Ten to fifteen minutes is usually enough.

What happens after a tabletop exercise?

The exercise only pays for itself if the findings are acted on. Within two weeks, the organiser should issue a short report that:

• restates the aim and objectives, and assesses performance against each;
• lists the strengths, so they are kept, and the gaps, so they are fixed;
• gives each finding an owner and a date;
• recommends what the next exercise should test.

Findings should then be tracked like any other risk treatment, and reported to the executive or board. The next exercise should test whether the fixes worked. This is how a set of separate exercises becomes an annual exercise program that builds capability year on year.

What are the common tabletop exercise mistakes?

• No written objectives, so the exercise becomes an interesting conversation with no measurable result.
• A scenario chosen for drama rather than relevance to the organisation’s risks.
• Too many participants for a real discussion, or the wrong ones, such as delegates who cannot make decisions.
• The facilitator also playing a participant, which leaves no one managing the exercise.
• No observers, so the findings depend on memory.
• A report that arrives months later, or never, so nothing changes.

How Agilient supports tabletop exercises

Agilient designs and facilitates tabletop exercises for executive teams, crisis management teams and business continuity teams across government, critical infrastructure and the private sector. Recent examples include tabletop exercises for a national property group’s new crisis management team and three tailored tabletop exercises for a community services organisation.

Exercises connect directly to Agilient’s crisis management consulting and business continuity consulting, so gaps found in an exercise can be fixed in the plans. Teams that want to run their own exercises can take the crisis management training and tabletop exercises course.