By Jennifer Beckage & Myriah Jaworski, originally published in Buffalo Law Journal on 3/2/17.
The value of tabletop exercises to crisis response
By now, most companies understand the value of having a Crisis Response Plan. As most businesses face crises of some kind during the course of their operations, having an effective plan is the first line of defense against an inadequate response to a complex problem.
But how does a business know if its Crisis Response Plan is truly effective? And what can it do to evaluate whether staff members are familiar with the core tenets of the response and confident in their crisis response roles?
In our experience, a great way to vet the effectiveness of a Crisis Response Plan is to run a series of tabletop exercises and simulations to rehearse crisis response methods and evaluate performance.
What is a tabletop exercise?
A tabletop exercise can be performed to mimic any number of scenarios, from active shooter or critical power failure to chemical accident and cyberattack, or some hybrid of the same.
It is critical to identify the appropriate consultant to help facilitate a tabletop exercise designed specifically for the needs of your business. An effective tabletop exercise will allow for ongoing evaluation by the third-party facilitator in real time, who can then offer findings in a format that will improve the business’s emergency response plans.
Running an effective exercise
Generally, a tabletop exercise begins with an introduction by the facilitator and participants. Next, the objectives of the tabletop exercise are defined, with an emphasis on the improvisational nature of the exercise.
Advance coordination with local emergency managers and/or law enforcement is recommended to encourage a realistic response and allow for public involvement in crises which involve potential fatalities, hospitalizations, evacuations or otherwise endanger the health and welfare of the community.
Once objectives are defined, the exercise will commence by activating the crisis. Notice of the crisis can be in the form of a scripted statement by the facilitator describing the scope and substance of the event, followed by interactive videos and “breaking news” reports covering the crisis.
Similarly, mock social media accounts can provide updates on the reaction of the local community, and scripted statements read by the facilitator can reflect the actions of federal and state agencies, if appropriate. Where systems are damaged by the crisis, participants will be limited in their response options accordingly.
Together, the crisis team will identify and “implement” crisis response, recovery and mitigation actions.
For environmental crises such as chemical spills and explosions, the crisis team will simulate steps to ensure employee safety and respond to urgent questions such as whether to direct employees to shelter in place or evacuate.
The team will work to mitigate migration health risks and economic impacts associated with the spill, and will need to determine whether the business should provide medical services and alternative shelter locations to those in the surrounding areas.
Under rapidly changing circumstances, the team may also need to respond to media inquiries and government investigators and secure consultants to fence off or isolate affected areas and conduct field investigations and remedial actions.
For a data breach scenario, the crisis team will endeavor to determine the incident type and how to respond in order to mitigate riskand get the business back on its feet. Technical consultants may be required and government notification may be necessary. The business also will need to quickly determine whether notice to consumers and governmental agencies is required.
Remember the Crisis Response Plan
A company’s Crisis Response Plan will be the lodestar guiding the crisis response effort. The tabletop exercise is an opportunity for the team to internalize the crisis policies and principles while also appreciating firsthand the roles that flexibility and on-the-spot analysis play in a moment of crisis.
Following the exercise, which can last for several hours and up to a full day, participants meet for an open discussion conducted by the facilitator to discuss lessons learned. With an eye toward improving the Crisis Response Plan, participants are encouraged to discuss any weaknesses or gaps observed in the response process and to work collaboratively to identify followup actions to overcome any operational challenges.
Facilitators provide their own observations and an analysis of the crisis response efforts in the form of a verbal assessment and may follow up with specific suggested revisions to the Crisis Response Plan.
When properly executed, a tabletop exercise may reveal and remedy unforeseen weaknesses in crisis response while also empowering staff in their readiness to respond to future crises.
JENNIFER BECKAGE is a partner at Phillips Lytle LLP and co-leader of the crisis response and management practice team: firstname.lastname@example.org. MYRIAH JAWORSKI is a senior associate who focuses on environmental law and white-collar government investigations: email@example.com.