How to Conduct a Crisis Management Exercise
A crisis management plan proves its effectiveness not when it is approved, but when real people have to make decisions based on incomplete information under pressure. Understanding how to conduct a crisis management exercise therefore means designing a credible test of the company’s decision-making capabilities, not simply organizing a review meeting.
For an industrial organization—whether regulated or exposed to cyber, operational, and reputational risks—the exercise must assess one specific thing: whether crisis governance can protect people, business continuity, assets, regulatory obligations, and stakeholder trust within the available timeframe. A good exercise brings to light ambiguities, dependencies, and delays before a real-world event does.
Define the purpose before the scenario
The most common mistake is to start with a dramatic scenario—such as a ransomware attack, a fire, or a production site outage—without first determining which capabilities you intend to test. This approach leads to interesting discussions during the exercise, but the results are of little practical use.
The objective must be formulated in observable terms. For example, one can verify the Crisis Management Team’s ability to respond within defined timeframes, decide on the controlled suspension of operations, coordinate with the affected site, and approve an initial communication to customers and authorities. Alternatively, the objective may focus on the integration of crisis management, business continuity, IT disaster recovery, and insurance claims management.
The choice depends on the organization’s level of maturity. A newly formed team should first test roles, escalation thresholds, and information flows. A more mature organization can test complex decisions, such as prioritizing between facilities, simultaneous unavailability of critical suppliers, media pressure, or data breaches.
Goals should be few and measurable. If the exercise attempts to evaluate everything, it will end up producing no reliable evidence on anything.
How to Conduct a Credible Crisis Management Exercise
An effective crisis management exercise requires that its design be separate from its execution. Those who prepare the scenario should not steer the team toward the expected solution, while observers must be able to record behaviors and decisions without intervening in the discussion.
Define the scope, participants, and rules
The scope defines which functions are involved, which processes are simulated, and which information is intentionally withheld. The Crisis Management Team is typically at the center of the exercise, but managers from plant operations, IT, physical security, legal, HR, communications, procurement, compliance, and insurance functions may also be called upon. Not everyone needs to participate from the start; the gradual activation of roles can also be an element to test.
Before the exercise begins, every participant must be familiar with the rules of the exercise. The exercise is neither an individual assessment nor a competition to see who knows the procedures best. It is a controlled test of the organizational system. It must also be clear whether the session is a tabletop exercise—that is, based on guided discussion—or whether it includes simulated calls, on-call activation, operational communications, and interaction with local teams.
Confidentiality deserves attention. Scenarios may involve technological vulnerabilities, strategic sites, personal information, or contractual relationships. A serious exercise defines in advance how materials will be handled, who is authorized to participate, and how evidence will be archived.
Developing a plausible scenario—not just a dire one
The quality of the scenario depends on how well it aligns with the company’s risk profile. A cyberattack scenario is of little use if it does not take into account the systems that are actually critical, OT dependencies, recovery times, production constraints, and the potential impact on customers or data. Similarly, a physical event scenario must reflect the site layout, emergency measures, the supply chain, and realistic alternative capabilities.
Plausibility does not require an exact prediction of a future incident. It requires consistent consequences. If a planning system is unavailable, which orders cannot be fulfilled? If a warehouse is closed off, which inventory items can actually be transferred? If a news story circulates on social media, who verifies it and based on what evidence?
The scenario should be developed through “injects”—that is, incremental updates that force the team to reassess the situation. An initial inject may confirm the event. Subsequent injects may introduce a supplier’s unavailability, a request for clarification from an authority, conflicting information from the site, or media interest. Each inject must challenge a decision; it should not add complexity merely for narrative effect.
Prepare evidence and observation criteria
Observers need to know what to look for. It is not enough to simply note that the team discussed the issue at length or identified a solution. It is necessary to verify, for example, whether the event was classified correctly, whether decision-making authority was clear, whether assumptions were stated, whether decisions were documented, and whether critical stakeholders were identified.
An observation grid can cover at least the following dimensions:
- activation, composition, and guidelines for the Crisis Management Team;
- the quality of situational awareness and the handling of unconfirmed information;
- timeliness, proportionality, and traceability of decisions;
- coordination with operational response, IT, business continuity, and disaster recovery;
- internal, external, and regulatory communications;
- Managing the impacts on people, safety, customers, suppliers, and insurers.
The criterion is not the absence of uncertainty. During a real crisis, information will inevitably be incomplete. What matters is the ability to make decisions within an acceptable risk threshold, defining actions, responsibilities, timelines, and conditions for review.
Operation: Controlled Pressure and Documented Decisions
The session must be led by an authoritative facilitator who is capable of maintaining the pace and preventing the group from getting bogged down in irrelevant technical discussions. The facilitator presents the injects, clarifies the available facts, and asks questions that refocus attention on the decisions: Who is responsible? What action is authorized? By when? What evidence is missing? Who needs to be informed now?
It is not helpful to correct a questionable choice immediately. If the decision does not create an unacceptable risk in the simulation, it is preferable to allow the team to experience the consequences through the next inject. This highlights the connections between an initial choice, the delay in escalation, and the worsening of the impact.
Time management is crucial. A two- or three-hour tabletop session does not replicate the full duration of the event, but rather condenses its timeline. Every time jump must be explicitly indicated, so as to distinguish between what the team decided in the immediate term and what it would have planned in subsequent phases.
It is advisable to maintain a decision log throughout the entire test. It should include the decision, the person responsible, the time, the rationale, the assumptions, and the resulting actions. This log is not merely a formality: it is the tool the team uses to verify that decisions have been communicated, implemented, and reviewed when the context has changed.
Debriefing and Improvement Plan: Value Is Created Afterward
The debrief should begin immediately after the session ends, when participants still recall key points, concerns, and constraints. The discussion must distinguish between observations, causes, and corrective actions. Simply stating that communication was slow is not yet a useful finding. It is necessary to determine whether the delay was due to an ambiguous activation threshold, a lack of up-to-date contact information, the absence of authorization, or content that had not been pre-approved.
The final report must translate the findings into an improvement plan that includes priorities, owners, and completion dates. Some actions will be documentation-related, such as updating the escalation matrix. Others will require targeted training, changes to governance, technology investments, or a review of operational dependencies. Not all gaps carry the same weight: priorities should be assigned by considering potential impact, likelihood, regulatory requirements, and the feasibility of the action.
An exercise should not be considered complete upon submission of the report. Actions must be monitored and, when they affect key procedures or responsibilities, verified through a new exercise. Continuitaly adopts this approach to transform testing into a measurable learning cycle, consistent with the operational resilience required of complex organizations.
The most useful test is not the one that confirms the plan exists. It is the one that allows management to determine, methodically and without real consequences, what decision it would make tomorrow morning when the plan alone is not enough.
