by: David Greb, CBCP & Rosemary Davis, CBCP

Is having a plan enough? NO!

In late 1997, as Corporate Contingency Professionals (CCP) we were charged with exercising recovery plans of diverse business units covering multiple states for a regional corporation. Our experience to date underscored an important fact. Although everyone talks about the need for recovery plan exercise, little is available on how to prepare for and conduct exercises.

Hearing industry buzzwords about exercises (plan review, tabletop, component, on-site, off-site, etc.) does not provide a roadmap. The question was where to start, how does one develop realistic scenarios and credible questions to exercise the plan document in a format of benefit to participants. It was a big challenge!

The critical elements of required information included definition and benefits of exercise types; practical approaches with limited resources; determing how each type was utilized; what was needed to start.

We quickly determined that a plan review was inadequate to address recovery requirements in event of an interruption. We were not knowledgeable about business unit resources, and they did not know how to prepare for a disaster. For those reasons, we focused our development time on use of a tabletop exercise.

This article provides a brief description of a tabletop exercise, a number of the format advantages and finally our suggestions for a successful project.

A tabletop exercise, also known as "structured walkthrough" or "tabletop," is a staged event where business unit management and staff meet in an open forum to discuss actions for response to a specific business interruption scenario. Though the informal format facilitates participation, it is highly structured to direct the discussion to explore emergency procedures, recovery plan detail, standard operating procedures and personnel resources to recover critical functions.

Prior to scheduling the first exercise, we created a realistic natural disaster scenario. For the opening segment of the exercise, a videotaped news clip from the local television station is shown to set the stage.

Once the disaster scenario was defined, we developed a basic timeline of events that could easily be modified based on the business unit and/or location’s critical functions to add realism.

Next we identified the categories of participants to be included: facilitator, recovery team player, business unit player, evaluator, observer, or observer-evaluator. Business unit participation is determined by senior management. The player is the most active role throughout the entire exercise. The evaluator is to take notes and make comments at the completion of the exercise. The CCP facilitator is responsible for the overall exercise process. Everyone is encouraged to take notes.

Each exercise is scheduled for a minimum of three, maximum of four hours. At the beginning of the exercise, the disaster scenario is presented to the participants. The participants then verbally "walk through" their plan, from life safety procedures and first response steps to recovery of critical functions.

A tabletop exercise, while only one of many ways to exercise or test a business recovery plan format, has a number of advantages. The tabletop can have a broad or narrow focus, is economical, flexible, and most important, presents a very real scenario in a nonthreatening way to the participants. Our tabletop exercise was designed to achieve three primary objectives:

1. Determine if participants could realistically "talk through" the recovery of their critical functions.

2. Help them become more aware of "people" issues.

3. Acquaint them more thoroughly with their plan contents as well as what needs to be included.

A tabletop is economical in terms of both dollars and time from the business unit perspective. The actual cost to contingency planning takes place during the preparation. Costs for CCP vary due to travel to participant location, number of participants, treats, props, etc. The demands on the participants’ time for the actual exercise is minimal since little preparation is required. A tabletop can occur even if the business unit has no plan! Use the exercise as a vehicle to start the process.

A tabletop is nonthreatening as the format is conducive to a relaxed environment which leads to frank and open discussion. Participants are not required to race the clock, make snap decisions, or memorize their recovery plans. They are encouraged to draw upon their own knowledge and expertise to find creative solutions that can be noted prior to an event. Many recovery solutions are just expanded versions of what is used daily to resolve operational problems. Various recovery options can be considered; time can be taken to discuss questions, or participants can surface new issues as they come to mind.

A tabletop is nondisruptive as it simulates a disaster without interrupting normal business operations. The exercise can be scheduled around the participants’ other work. It can occur outside of normal business hours including weekends. As contingency professionals, we must recognize that although disaster planning is a priority to us, it is usually an "other duty as assigned" for business unit personnel.

A tabletop is flexible because the scenario can be structured to exercise particular recovery plan aspects. If a business unit has multiple departments and/or locations, the disaster can target specific functions or locations. This flexibility also allows the contingency professional to target suspected weak areas in the recovery plan. Keep in mind, however, the point of the target is not to "ambush" the participants but rather let them discover that when it comes to disaster recovery exercises "failure is success". You want them to find plan weaknesses now rather than during a real disaster.

As part of bringing the exercise scenario into the project, we developed an exercise strategy which was based on having:

· Realistic scenario.

· Good timeline.

· Pre-exercise briefing.

· Care of the body as well as the mind.

· Formal exercise critique by participants.

· "This is not a test."

· CCP follow-up.

Realistic scenario. Do your homework on potential disasters for the location involved. Become aware of the type of incidents occuring every day. Is the site near rail lines or a major highway (hazardous materials or chemical spill)? Is the site in a flood plain, near a river, or downstream from a dam (flooding, site inaccessible)? Is it in a seismic zone (earthquake, tremors)? Is it near a restaurant (fire, explosion)? Is it in an old part of town (aging infrastructure leading to power outages, ruptured water lines, collapsing buildings)? Looking at a map may suggest possible scenarios. Create an outline with enough details to give it local impact and credibility. We use short (8-12 minutes) news videotape segments about a real disaster of the same type. The video helps participants mentally disengage from daily tasks to focus on the exercise.

Good timeline. The timeline is a map to guide the exercise. Ours is printed landscape on 8.5 x 11 paper using the four-column headings of "real time" (actual time); "exercise time" (time of the scenario); "event" (what is going on in the scenario, i.e. what players should be doing or talking about). We use the "event" column to bring in additional details or new developments as the exercise progresses which gives greater realism and believability to their discussion. The fourth column is used for "facilitator’s action" (questions that can be raised or relevant items for consideration).

As CCP, your homework is to prepare the timeline including study of the business unit’s recovery plan. If possible, it is helpful to walk through the unit’s work area. Within the timeline, we include references and questions about their plan with page numbers to prompt them as to the importance of keeping the plan current and complete.

The timeline is an important guide, but be flexible. What players bring up on their own is more valuable to them than prepared issues and questions. One major facilitator challenge is directing the exercise to assure important issues are addressed while encouraging spontaneity, creativity and flexibility. In this respect, we model the tabletop similar to what participants would do in an actual disaster: draw from a well-prepared plan and adapt it to the situation. The goal of recovery plans is recovery, not adhering strictly to written documentation. The plan is only a tool. The end result is what counts. In a disaster, the only valid result is recovery. In a tabletop, the only valid result is enhanced recovery capability.

Pre-exercise briefing. This briefing (allow 30 minutes or less) serves many purposes. First, the facilitator has a chance to explain the format, structure and objectives. In addition, participants have time to ask questions and voice concerns. In our case, participants had never taken part in any type of recovery exercise. Fear of the unknown creates anxiety. The briefing is helpful to defuse that anxiety. Third, the briefing allows the facilitator to establish a relationship with participants prior to the exercise. Without these briefings, we would have been strangers to the participants, adding stress to the process. If the exercise is out of town, a conference call can substitute for the meeting. A concise handout is provided with the objectives of the exercise, a description of the various roles (facilitator, player, observer/evaluator) and exercise logistics (time, date, place, participant list). The briefing is generally a week before the exercise.

Care of the body as well as the mind. Provide participants a comfortable work environment if possible. Tabletops in rooms too hot, too cold, improperly lit, too big, too small or inappropriately furnished can hinder discussion. While such conditions may simulate actual recovery conditions, that is beside the point. The tabletop’s purpose is to stimulate discussion and ideas, not nerve endings. As mentioned earlier, our exercises run three-four hours during which refreshments are provided. An additional consideration for early morning sessions is to offer cold drinks as well as coffee and tea. Non-coffee drinkers need their caffeine too. Snacks or lunch is provided if the exercise runs into the lunch hour (e.g., 8:30 a.m.-12:30 p.m. or 10 a.m.-2 p.m.). The only schedule rule is no formal breaks during the exercise. Going to use the phone, use the restroom or get more coffee (just like in a disaster) has to be initiated by the participant.

Formal exercise critique by participants. During the last 15 minutes of the exercise, participants critique the process and evaluate the exercise by completing a questionnaire before they leave. At this time, we hold an immediate debriefing letting everyone participate (including observers and evaluators who until then have been seen and not heard).

"This is not a test." Emphasize the tabletop is an exercise, not a "test." This change in terminology helps participants relax. Common wisdom advocates avoiding the term "test" because of its negative connotation. While that may be valid, it misses an important point. In a true test, the object is to achieve a certain score, to measure up to some standard. Once that standard has been attained, we are "done"; further growth is not needed or possible. Nothing is greater than 100 percent. All motivational sports hype notwithstanding, the idea of "giving 110 percent" is pure rhetoric, nothing more. However, any disaster recovery plan can be improved and is always subject to update. Once participants understand their plan is not being compared to a hypothetical standard or to any other plan, the atmosphere is cooperative rather than competitive. This helps assure optimum cooperation and achieve the most beneficial results.

CCP follow-up procedure. Follow-up is critical to the ongoing activities required for contingency planning. Within the following week, the business unit receives an exercise report with our observations and recommendations. Business units are also required to submit an exercise report to CCP. This is not to be confused with submission of plan updates. Their report is both a response to the CCP report and any additional comments they wish to make about the process. Invariably, the participants have been pleasantly surprised to find the exercise interesting and worthwhile. Good follow-up assures their ongoing commitment.

Our 20 tabletop exercises have included more than one hundred business unit participants. Group sizes have ranged from two to twenty-four. By establishing a standard (our exercise strategy) we enhanced our ability to secure active business unit participation, resulting in improved recovery plans. After all, gaining business unit support and helping them improve their plan are the goals of any exercise.

Return to Main Index I Send Email to DRJ

Copyright (c) 1999 Systems Support Inc.  All rights reserved.  Reproduction in whole or in part

in any form or medium without the express written permission of System Support Inc. is prohibited.

Page designed by David-Glen Smith

Last updated-- Jan. 15, 1999.