At Safe Harbor Consulting we specialize in creating and facilitating Tabletop Exercises. In fact, most of our projects and a large percentage of our revenue is earned from performing this service. We, therefore, understand, appreciate and tout the benefits and values of conducting these exercises and realize the efficiencies and effectiveness of using this non-invasive testing technique.
I do get concerned however, that organizations depend too much on the tabletop exercise as their one and only business continuity, disaster recovery, crisis management testing tool.
Tabletop exercises are great for educating management, employees and others on the strategies and solutions in place. Tabletop exercises are terrific for ensuring the documentation supporting these programs are complete, accurate and easy to understand. Tabletop exercises are tremendous for promoting communications and cross-checks between various departments and groups that have different yet coordinated roles in a comprehensive resiliency and recovery organization.
Tabletop exercises do not physically prove the validity, effectiveness and timeliness of most of the physical infrastructure and logistics in place to engage and support a real-life implementation of the solutions in place.
Talking through how you would engage call trees or notification and escalation protocol should not take the place of actually performing call tree and notification tests.
Ensuring people know where to go and how to conduct business in alternate site locations (even those that use in-house, displacement strategies) should not stop you from physically exercising this strategy every now and then.
Reviewing lists of phone numbers of people and agencies to call at time of a crisis, should not prevent you from physically dialing those numbers to verify they reach the intended party and that party understands what is/would be required of them at time of crisis.
Tabletop exercises are indeed, relatively inexpensive ways to educate people, heighten awareness of programs, procedures and protocol. Tabletop exercises can be conducted with little disruption to the production work environment and little risk of impacting productivity. And, conducted properly, tabletop exercises can absolutely discover plenty of opportunities to improve your programs and implemented solutions. I just wish to caution folks that these exercises should not stop you from attempting mock events that more closely simulate a real life response to a potential business interruption event.
I am not saying, “Do not do tabletop exercises”, or even, “Do fewer tabletop exercises”; I am just suggesting that you should strive to include physical tests in your overall exercising process, when possible, to better prepare your company for the eventual business interruption event.
These, “other kinds of exercises” are hard to coordinate, take up time of many employees in the organization, can be disruptive to the production environment and, can be rather expensive to conduct – but, the further validation they provide and the heightened level of preparedness they instill can be worth the investment, every now and then.
Just don’t let yourself become too complacent with the tabletop exercise. Try to get permission to do more, if you can. Outside agencies, like fire departments, local emergency management agencies, and the such, usually love to assist and play a role in these exercises – I urge you to reach out to them and see how they might help you raise your exercise bar.
Safe Harbor Consulting would absolutely love to continue to perform a bunch of tabletop exercises – but, we would be even happier if we could assist you with a more life-like simulated exercise to really test your business continuity, disaster recovery and/or crisis management posture.