Design the exercise around decisions, not drama
A useful BCM or crisis exercise is not a story-writing contest. The scenario exists to create the conditions under which participants must demonstrate plans, decisions, coordination and recovery capability. The most productive exercises begin with clear objectives, identify the capabilities that need evidence, and then introduce only enough scenario detail to make those capabilities visible.
This builder creates a structured outline rather than a complete script. It proposes a scenario arc, inject sequence and evaluation questions based on the selected disruption family and objective. Facilitators should adapt the output to the organization’s real services, locations, suppliers, technology, escalation structure and risk profile.
Choose one primary objective
Exercises become weak when they try to test everything at once. A two-hour tabletop cannot meaningfully validate crisis leadership, every business continuity plan, disaster recovery, communications, supplier recovery, evacuation and cyber response simultaneously. Select a primary objective and treat other capabilities as supporting observations.
For decision-making, focus on thresholds, authorities, incomplete information and escalation. For recovery strategy, force prioritization and dependency sequencing. For communications, introduce competing stakeholder needs, uncertain facts and approval pressure. For dependency coordination, make an external provider or internal shared service part of the critical path. For command and handover, test logs, action tracking, situational awareness and continuity between shifts.
Use a scenario arc that changes the operating problem
A strong scenario normally moves through stages. The opening inject establishes ambiguity and requires recognition. The second stage creates operational consequence. The middle injects increase pressure through dependency failure, conflicting information, resource limits or stakeholder expectations. The later stage forces recovery decisions, transition planning or prolonged-operation choices.
Avoid making every inject simply “more bad news.” Some injects should test information validation, competing priorities, recovery success, partial restoration or the consequences of an earlier decision. Participants should be able to influence the scenario through their actions. If nothing they decide changes the discussion, the exercise becomes theatre rather than assurance.
Scale complexity to team maturity
For a new team, clarity is more valuable than surprise. Give enough information to practice roles, escalation and plan use. For experienced teams, remove some certainty and introduce dependency conflicts. For advanced teams, use time pressure, incomplete information, concurrent impacts and consequences that expose assumptions. Complexity should reveal capability—not make the exercise impossible.
The builder adjusts the tone of suggested injects according to maturity, but the facilitator still needs to judge psychological safety, operational workload and the organization’s exercise culture. A difficult exercise can be constructive; an exercise that humiliates participants rarely improves resilience.
Write injects that produce observable evidence
Every inject should have a reason to exist. Write down the expected capability, not the expected answer. For example, an inject about a supplier failing should test whether the team identifies the affected service, confirms contractual notification, activates an alternate or escalates the unresolved exposure. It should not demand that participants recite a preselected sentence.
Good injects produce observable outputs: a decision, escalation, communication, log entry, priority list, recovery sequence, request for evidence or risk acceptance. Evaluators can then assess whether the output was timely, authorized, informed and consistent with the organization’s plans.
Evaluation questions that matter
- Did the team recognize when normal operational management was no longer sufficient?
- Were decision authorities and escalation paths understood without excessive facilitator prompting?
- Did participants distinguish verified facts, assumptions and unresolved questions?
- Were business priorities translated into an actionable recovery sequence?
- Were critical dependencies and external obligations considered early enough?
- Were decisions, owners and deadlines captured in a usable log?
- Did communications reflect what was known at the time rather than overstate certainty?
- Were recovery claims challenged with evidence and validation steps?
After-action discipline
The exercise is not complete when the room closes. Capture observations as specific capability gaps, assign accountable owners, define evidence of closure and track actions to completion. Distinguish between plan defects, training gaps, technical limitations, dependency issues and governance decisions. Repeating the same finding across exercises without changing capability is a sign that the exercise program is producing reports rather than resilience.
When possible, retest material corrective actions. A revised document may close a wording issue, but a new recovery procedure or escalation process should be demonstrated under realistic conditions. Use trends across exercises to identify systemic weaknesses such as poor dependency data, slow decision approval or weak action tracking.
Related BCM.Center resources
Use the tabletop exercise scenario template, the crisis management guide, and the BCM Readiness Scorecard to connect exercise findings with wider program maturity.