Crisis response exercises are a fantastic way of assessing your response plans and making your business more resilient. But what’s the best way to design and run such an exercise?
I gathered 4 key tips from our network of risk leaders, exchanged during one of our private meetings on designing and implementing an effective crisis response exercise.
These are summarised below, and the full meeting write-up is available to members on our Intelligence platform.
1. Keep it realistic
For any crisis response exercise to be a success, it needs to be realistic. The scenario being simulated should be one that is relevant to the risks faced by the organisation, while still being challenging enough to test the plans in place.
In order to achieve this, technical experts need to be brought in right from the beginning of the process so they can be involved in designing how the scenario plays out over the course of the exercise, as well as helping work out who should be involved in implementing the response plan.
2. Have plans in place
The purpose of a crisis response exercise is to test the effectiveness of response plans already in place at an organisation. This means that the scenario used for an exercise should be one for which the organisation already has a well thought out response plan in place.
Similarly, it is pointless to run a scenario for a crisis that an organisation has recently faced, because you will have either already proven you are well prepared for an event, or, if things went badly, then you should have learnt the necessary lessons from the post-incident review process.
3. Use the right people
To be effective, a crisis response exercise needs to have the right people in the right positions, and sometimes this means taking senior leaders out of the equation (although they are often useful as observers or facilitators).
Some scenarios, for example, may play out in the absence of particular board members or technical experts, and using an exercise to determine the preparedness of delegates and alternative points of contact can be a thoroughly useful process.
4. Consider external stakeholders
Real-life crises will often require organisations to pull in external stakeholders and partners to help respond to the incident as it develops.
In a crisis response exercise, it may not always be possible to involve these external partners in real-time (although it is a useful tool if the option is available), so internal staff members may need to play the part of those particular roles.
Here it is important to consider the playbook they will be reading from and ensure they are fully aware of what they can and can’t say before the exercise starts.
External facilitators can also be used to fill these roles if a more independent approach is needed, or if more people are needed to be involved in the response-side of the exercise.
Click here to find out more about our upcoming member meetings.
Are you an in-house risk manager who could benefit from collaborating with a global network of risk leaders? Talk to us about becoming a member today.
