How to maximize effectiveness and have the company spring for doughnuts
The concept of performing a tabletop exercise was born of the need to practice a somewhat complex set of activities without breaking the budget or burning valuable company time. Most businesses look with a jaundiced eye on taking employees out of their assigned duties to “practice” a plan that may never be used: i.e. a business continuity plan. This is true during the most prosperous of times. How then does the business continuity professional convince business management that a tabletop exercise (or worse yet, a series of exercises) is essential during a business cycle trending downward? The following document offers some tips and tricks to planning, executing and following-up on business continuity plan exercises so that the company will see the benefit of these activities and maybe even spring for the doughnuts at the nest tabletop event.
1) Exercise Preparation
So much of what business continuity professionals do is rooted in standard, tried and true business principles. This is no truer than when talking about the tabletop exercise. Think of the tabletop exercise as you would any other business meeting. For example: start on time, finish on time (or early if possible), keep the meeting moving and on point, etc. Here are some tips on preparing for a tabletop exercise that are above and beyond the normal business meeting preparations that may increase your tabletop return on investment (ROI) .
a. Room set-up: The tabletop exercise is by its nature a collaborative event. It consists of many people offering ideas, comments and questions that speak to the scenario and plan being exercised. The room itself should be large enough that participants are comfortable and spaced far enough apart to have documentation, coffee cups or refreshments and any other materials handy without infringing on their fellow participants. Remember, it’s easier to make a large room smaller than it is to cram 20 people into a room meant for 10. The second and perhaps most important aspect of room choice is the format of the tables, chairs and furniture in the conference room. Using a U or O shape for tables and chairs is the most effective set-up if the facilitator wants attention on themselves during the course of the tabletop. In this arrangement, participants are able to easily interact with each other. This also lends itself to easily referring to flipcharts or a screen if an overhead projector is used. If the tabletop requires breaking down into smaller groups that reflect recovery sub-teams, remember to have enough space in the room so that reorganizing participants is not time consuming and cumbersome. In contrast, the classroom or lecture set-up does not lend itself to an easy interchange of ideas between participants and sends an unwanted message that communication between participants is not required or necessary.
b. Exercise format: Be creative, keep it interesting and when in doubt, do without…
Tabletop exercises do not have to be boring recitations of tasks and checklists. In fact, if properly formatted, it can be an exciting, interesting and most importantly, effective rehearsal of activities that can save an organization during a crisis. A tabletop exercise needs to have a few basic elements such as scenarios, objectives, operating conditions, and roles and responsibilities of participants. To differentiate this from other meetings, add realistic phone calls to predetermined participants of the meeting with a co-worker playing the role of the fire chief or hazmat team providing additional detail to the scenario. Or create additional operating conditions on flash cards to be distributed during the tabletop at pre-established points that takes the tabletop in a different direction. This will encourage new ideas and strategies for the business continuity plan. If the facilitator is ever in doubt about the effectiveness of the element being added, the best advice is to do without it. Creating confusion or allowing the discussion to wander just for the sake of creativity is counter-productive to the goal of adding value to the business continuity plan.
c. Scenarios: Scenarios need to be events that really could happen to your organization. There would be no reason to have a scenario of a massive hurricane hitting your company if it has a single location in Des Moines, Iowa. On the other hand there are only so many ways you can envision a fire damaging your headquarter facility. The scenario that you use must have an impact on the essential functions of your firm but must not be so complex or catastrophic that tabletop discussion is rendered useless. Too many tabletops have wandered off course because a scenario that is being discussed has no relevance to the firm or, conversely, destroys all the facilities and eliminates the entire staff of the company. As long as the participants of the tabletop can see themselves in the scenario it will have an impact on them and encourage input.
d. Who should participate? Clearly the participants of the tabletop should be the members of the business continuity team that is having their portion of the plan exercised. There are others, though, that can make your tabletop more ”visible” and be an internal public relations coup. Departments/teams in organizations do not conduct business in a vacuum during normal business conditions. Likewise, your recovery teams will not perform in a vacuum in a recovery. Therefore, having “guest” representatives from other teams to observe and contribute to the tabletop makes perfect sense. For instance, the Finance team may not know exactly how funds flow to and from the bank or third party to the customer so having an expert from the accounting systems team would bring value to the tabletop exercise with their expertise on fund flows. (This is important if the function being discussed is an essential function owned by the finance team) This practice also starts to build real bridges between teams that will prove invaluable during a true disaster. By having the right people involved in your tabletop exercise you are providing the opportunity for pertinent questions to be asked and real gaps in your plan to be identified. As word of your ability to build bridges between essential business partners grows, you will assist yourself in securing a stronger commitment from the business managers to the business continuity program.
2) Executing the Exercise
You’ve prepared for it. Now how do you execute the exercise in a way that proves to management that business continuity planning is a vital function that brings a high return on investment. Here are important elements of successfully executing the tabletop:
a. Establish exercise objectives: The main question that the business continuity professional must answer is “why are we doing this?” In fact that should be one of the opening statements at the outset of the tabletop exercise. Remember, as a BCP professional you are thinking about business continuity almost constantly in your normal work day. Most likely the participants of the tabletop only think about it as part of their other work responsibilities. The BCP professional is constantly fighting for “brain space” in the heads of the business partners. Don’t assume that because they accepted an electronic invitation to your exercise that they have a full understanding of what is supposed to be accomplished. State in solid terms what you want to accomplish with the exercise. Any documentation that you create for the exercise should have the objective clearly established. If education is the main objective of a tabletop, and that’s not a bad place to start, then a simple declarative statement about using the tabletop exercise to educate the business partner should be included.
b. Exercise what you planned on exercising: Make sure that you are exercising only that part of the plan that would be executed by the participants in a real crisis. This goes back to the development of the scenario. If you want to exercise the plan that involves re-locating the staff to the work group relocation site then a scenario that does not damage the primary building and force people out of the facility will not suffice. Too often, poorly executed exercises drift off into discussions about non-essential functions or irrelevant tasks that are not part of the business continuity plan. If this happens participants will leave the meeting confused about their roles and responsibilities in a crisis and very likely report back to their superiors that the tabletop was not useful.
c. Facilitation: Facilitation of the exercise is an essential component of execution. As a facilitator the BCP professional can steer the exercise away from discussions regarding non-essential functions, ensure that all participants are heard, and document gaps in the business continuity plan that arise from the participant input. There are a number of pitfalls that a good facilitator will avoid. If the BCP professional can remember that the plan is designed for the business partner to be successful in a crisis he/she can maintain a professional balance during the exercise. The exercise is designed to identify gaps in the plan, so the BCP professional should not take the identification of a gap as a personal affront. Ultimately, the business partners own the plan and you are there to help them make it as strong as it can be.
Additionally, if there are high ranking personnel in your exercise as either observers or as members of the recovery team you must guard against “group think.” Many employees have a hard time taking the lead in a meeting when someone from their chain of command is in the room. At the same time, the highest ranking person in the room inevitably feels a compulsion to appear as if they are in charge. One or both of these phenomena can lead to a one way conversation with the executive doing most of the talking. A facilitator can approach the executive before the meeting starts and express their concern about this and ask that they allow the participants to ask questions and provide input. Obviously, professional decorum is called for in this instance but the ultimate goal is to improve the plan to protect the organization. Most executives are willing to leave their rank outside the conference room to meet this very important goal. If the executive is unwilling to jettison the ego one could always write their unavailability into the scenario, rendering them unable to provide direction during the exercise.
3) Post Exercise Activities
The tabletop exercise is completed, everyone has left the room. All the ideas, gaps in the plan, questions and actionable ‘take-aways’ have been documented. Now what? Here are a few ideas to effectively wrap up the exercise process.
a. First off, any activities that are required to be completed or issues to be researched should be created in a matrix. This matrix should note: a) the owner of the activity (either a team or individual), b) the action to be taken or research completed, c) a brief description as to why this item is important, and d) a date when this action might be completed. This information should actually be gathered and agreed to by the team members that attended the exercise before the conclusion of the exercise. Professional decorum must again rule the day with this piece of the puzzle. In most cases the business partners will not be direct reports of the BCP professional, so any documentation delivered back to them should be crisp, clear and with all expectations clearly defined beforehand. Every organization is different but in most cases the BCP professional will be “riding herd” over this process, ensuring that all items are completed and the business continuity plan is revised.
b. A post exercise survey to the participants asking for feedback about the exercise is a good way to keep the exercises fresh and find out what is and isn’t working. Questions like: “Did the exercise help you understand your role in a crisis?” or “Is the format of the exercise effective?” can help plan the next exercise and make it meaningful for the business partners. Whether you share those results or not are dependent on the culture of your organization.
c. A note to the participants thanking them for their time and effort and copying this to appropriate management is a good way to extend good will to the business partner. It also may get them the credit they deserve for their participation in this important company event.
d. Finally, a status report to the BCP management and appropriate staff outlining the exercise, who participated and what was accomplished, will put the finishing touches on the exercise.
The maintenance of a business continuity plan is the lifeblood of a successful recovery. No activity is more important in a maintenance program than the tabletop exercise. Hopefully the points noted above will allow you to execute a successful tabletop exercise in any business environment. As an effective presenter who is respectful of the time commitment of your business partners and uses the resources at hand, you will win over the business managers that control the budget and assure yourself of full commitment for the next tabletop.
Mick Koch is a certified business continuity planner (DRII) and holds a master’s degree in business administration from Avila University in Kansas City, Mo. He was a business continuity planner for American Century Investments and previously was co-founder of Data Security Systems, Inc. He is currently a principal of Business Resiliency Solutions, LLC a business continuity planning consulting firm in Kansas City, Mo.