1. The Tabletop Exercise Planning Process: From Conception to Action

2. Business Continuity Preparedness Train, Test, Evaluate, Revise Planning Recovery Response Prevention

3. Key Steps in the Exercise Planning Process 1.Review the Business Continuity Plan/Pandemic Plans 2.Define a Goal for the Exercise 3.Form an Exercise Design Team 4.Develop Exercise Objectives

4. Key Steps in the Exercise Planning Process (cont.) 5. Develop the Scenario 6. Identify Players 7. Decide on a Format 8. Develop Scripts and Data Injects 9. Address Facilitation Issues 10. Consider the After Action Report/ Improvement Plan

5. Step 1: Review the Business Continuity Plan/Pandemic Plans

6. Plan Review Keep in mind that exercises have multiple utilities: –Test existing plans –Assess decision-making –Brainstorm/identify issues –Educate –Provide experience –Enhance communication –Build relationships –Identify gaps in planning

7. Plan Review Consider the following: –When was the plan last exercised? What were the recommendations? What changes were made? How successful was it? –Have other significant changes occurred that warrant an exercise? –What are the key areas that should be exercised at this point? (Review the CIDRAP 10-point Framework.)

8. Step 2: Define a Goal for the Exercise

9. The Exercise Goal Clarifies the overall reason for conducting the exercise. Sets the stage for developing the exercise objectives. May test a completed plan or may be exploratory. May relate to one business unit or to multiple units. An exercise may have more than one goal.

10. Review Workshop Notes: Exercise Goals

11. Step 3: Form a Design Team

12. Form a Design Team: What to Consider Identify a Team Leader or Coordinator. Identify potential team members: –Expertise –Representation from involved units/departments –Experience with exercises (if possible) Keep the size of the Design Team manageable.

13. The Team Leader Will be responsible for all phases of the exercise. Should be able to: –Devote adequate time to the exercise design. –Understand the exercise process. –Be familiar with the business continuity plan.

14. Design Team: Role of Members Provide input into objectives. Agree upon the scenario and topics for modules. Review content for accuracy and completeness. Serve as technical resources. Get “buy in” from the business units that will participate in the exercise.

15. Design Team: Role of Members (cont.) Provide input into the format and flow of the exercise. Identify/recommend players. Provide input into exercise facilitation issues. Generally not players in the exercise.

16. Before the First Meeting of the Design Team Develop a set of expectations for members. Develop a list of issues for the first meeting. Draft basic materials if possible. Develop a work plan/timeline.

17. Review Workshop Notes: Initial Design Team Meeting

18. Step 4: Develop Exercise Objectives

19. Objectives: Help to define the scenario. Assure that players have a common understanding of what to accomplish. Provide a way to organize the modules. Provide a basis for the After Action Report/Improvement Plan.

20. Review Workshop Notes: Exercise Objectives

21. Step 5: Develop the Scenario

22. The Scenario: General Considerations Use the exercise goal (or goals) and objectives in crafting the scenario. Make the scenario plausible. Be accurate and factual. Make the scenario industry-specific. Be sure the scenario involves all business areas that will be participating in the exercise.

23. Review Workshop Notes: Scenarios

24. Step 6: Identify Players

25. Players Cover appropriate units/departments/ teams. Get the “right level” of people at the table: –Operational staff –Decision makers Decide whether or not to brief the players ahead of time (if so, decide to what level).

26. Players (cont.) Decide whether or not to invite observers (if applicable). To test redundancy or back-ups, consider “eliminating” some key players during the course of the exercise.

27. Potential Participants Individuals: –Chief Executive Officer –Chief Operating Officers –Chief Financial Officer –Crisis Management Team Members –EOC (Emergency Operations Center) Coordinator

28. Potential Participants Departments: –Business Continuity –Communications –Facilities Management –Finance –Human Resources –Information Technology –Legal –Risk Management

29. Potential Participants Departments: –Operations –Public Relations –Safety –Sales and Marketing –Security –Technology –Training

30. Potential Participants Others (as indicated): –Contractors –Supply chain partners –Vendors –Government contacts (local public health, local emergency management)

31. Step 7: Decide on the Format

32. Format: Issues to Consider Physical lay out of the exercise Organizational structure –Facilitator –Controllers –Simulators –Scribe/recorder –Evaluators Agenda

33. Format: Lay Out All players at one table (15 to 25 is optimal; 50 is the maximum). Key players at one table with supporting players behind them. Players at multiple tables (e.g., by business unit or incident command structure).

34. Format: Lay Out (cont.) Players in different rooms (e.g., simulate a crisis management center in one room with other players elsewhere). Observers usually sit around the perimeter of the room and are clearly delineated from the players.

35. Logistics Planning Operations Finances Incident Command

36. Senior Management BU *BU: Business Unit

37. Crisis Management Team RT Screen RT *RT: Response Team

38. Risk Management Information Technology Human Resources Operations Finance Public Relations

39. Format: Organization With one large table, use a large group discussion. If multiple tables, consider using a combination of large/small group discussions. Break out rooms may be useful for small group discussions (particularly for large events). Consider using more than one track, based on functional response area.

40. Format: Organization (cont.) Facilitator –Presents the scenario. –Keeps the discussions on topic. –Makes sure that key issues are addressed. –Prioritizes issues. Controllers –Assist facilitator. –Keep the exercise on track.

41. Format: Organization (cont.) Simulators –Represent other organizations who may interact with players. –Add events/injects to the scenario. –May be used as “patients” or “victims.” Scribe/recorder –Documents key ideas/action items.

42. Format: Organization (cont.) Evaluators –Observe the exercise. –May be members of the Design Team. –Record observations (may use an evaluation form).

43. Format: Organization (cont.) Use flip charts for certain discussions (large or small group): –To brainstorm ideas. –To identify assets, gaps in resources, training needs. –Identify action items. –As an effective way to track the discussion.

44. Format: Agenda Registration Opening remarks Background information Introduction to the exercise –Ground rules –Assumptions Modules with discussion time “Hot wash”/debrief Complete evaluations Adjourn

45. Step 8: Develop Modules and Data Injects

46. Modules Modules “tell the story” of the scenario. Each exercise usually has several modules. Use “real-time” and use a virtual clock. Create a “live” environment. May want to use “roadblocks” or unplanned events in the modules.

47. Table of Modules Each module can focus on: ─An issue, set of objectives, or an event. ─A time period. Develop a table as an outline. –Provides a mechanism to plan out the exercise. –Takes into consideration the time to allot to each module. –Organizes key issues.

48. Table of Modules (cont.) TopicSummary of events Key issues Injects/ activities Time allotted

49. Review Workshop Notes: Table of Modules

50. Examples of Data Injects News reports Data summaries Maps Photos Diagrams Event summaries Case reports Videos Phone calls Recommendations

51. Data Injects Use injects to: Provide critical information necessary for decision-making. Provide actionable information. Add color to the scripts. “Fill out” the scenario. Add a sense of realism to the story.

52. Step 9: Address Facilitation Issues

53. Step 10: Think Ahead to the After Action Report

54. Common Pitfalls in Planning Pre-existing plans that the exercise is designed to test are not well developed or documented. Participants have not thought through the issues that the exercise is trying to address; poor timing for the exercise. Appropriate changes/ improvements have not occurred since the last exercise.

55. Common Pitfalls in Planning (cont.) The “right people” are not at the table. The exercise moves to slowly and people get bored. Not enough time for discussions to really address the issues. The facilitator is not familiar with the group or the issues.

56. The Key to Success: Remember that “the devil is in the details!”