How to run a crisis simulation exercise

What a crisis simulation is

The Cabinet Office’s UK Resilience Academy describes an exercise as “a process to train for, assess, practice and improve performance in an organisation”. Its 2024 guidance covers four kinds: tabletop exercises, discussion exercises, stress tests and live play. For a communications team the useful distinction is between talking through a crisis and living through one.

The Resilience Academy calls live play “the highest-level rehearsal” and notes it is often the most costly and time-consuming form. Many organisations start with a tabletop exercise, fix what it finds, and move to a live simulation once the plan has settled.

Start with the objectives

Both the Resilience Academy and the National Cyber Security Centre put objectives first. The Academy is blunt: “Any exercise that does not have a clear and agreed set of objectives has a very high risk of failing.” It recommends SMART objectives: specific, measurable, achievable, relevant and time-bound. The NCSC adds that an exercise should test the plans you already have, not write them.

Communications objectives that work well are concrete and timed. For example:

• Agree and publish a holding statement within 45 minutes of the first inject.
• Brief all staff before, or at the same time as, the first public statement.
• Put up a spokesperson for a recorded broadcast interview within two hours, using agreed lines.
• Keep one version of the facts across the website, social channels and customer service throughout.

Two or three objectives are plenty. Agree them with whoever sponsors the exercise, and decide in advance how you will tell whether each was met. The NCSC also suggests asking for senior backing for a programme of exercises rather than a one-off, so the lessons from the first have somewhere to go.

Write a scenario people believe

The scenario needs to be “realistic and credible”, in the Resilience Academy’s words. Start from your own risk register, or from the scenarios you have already drafted holding statements for. The NCSC suggests looking at recent incidents in your sector and using real news as background.

Aim between two failures. A scenario that is too gentle teaches nothing, and one that is too apocalyptic lets people dismiss it as unrealistic. The best scenarios start small and plausible, then escalate in ways the team did not quite expect: a second problem just as the first statement is approved, a detail that contradicts what has already been said, a journalist who knows more than the crisis team.

Give the exercise a name, so nobody mistakes it for the real thing, and start every exercise message with “EXERCISE – EXERCISE – EXERCISE”. Both the NCSC and the Resilience Academy recommend it, and it matters most when emails and phone calls are going to real inboxes and real phones.

Build the injects

An inject is a piece of new information fed to the players: a phone call, an email, a social media post, a news bulletin. The Resilience Academy describes the main events list (MEL) as the document that “captures pre-scripted and phased injects to develop the unfolding scenario”, and notes that injects can be added or held back to manage the pace. The NCSC’s advice is to be clear about what each inject is meant to prompt.

For a communications exercise, these are the injects that do the most work:

• A journalist calling with details you have not released, and a deadline
• A social media post spreading a claim that is half true
• A regulator asking what you knew, and when
• Staff asking whether they are safe, or whether they can talk to the press
• A leaked internal email or message
• A new development just as the first statement has been signed off
• A request for a live interview with the chief executive

Write each inject on its own sheet or card, with its purpose and what a good response looks like. The observers fill in the last line.

Who does what

The Resilience Academy’s guidance names a set of roles. Scaled down for a communications exercise, they are:

• Exercise director. Owns the exercise, agrees the objectives and signs off the report.
• Controller or facilitator. Runs the exercise on the day: releases injects, watches the pace and keeps it on track.
• Players. The people being exercised, doing what they would do for real.
• Role players. The journalists, regulators, customers and staff the players have to deal with. The guidance lists media and press among them. Journalists who interview for a living make the pressure real.
• Observers or evaluators. They watch, time and record what happens against the objectives, and say nothing during play.

One rule matters more than the rest: the people who designed the exercise should not also be playing in it. They know what is coming, and the exercise stops testing anything.

Running the day

• Brief the players in advance on the rules, timings and who to contact, without giving away the scenario. The NCSC suggests sending this a few days ahead.
• Tell the wider organisation that an exercise is running, and announce when it starts and ends, so nobody outside it acts on an inject.
• Run it against the clock. Time pressure is what turns a discussion into a rehearsal.
• Let players decide on incomplete information, as they would have to for real. The NCSC asks participants not to “fight the scenario”.
• Adjust the pace. If the team is coasting, release the next inject early. If it is overwhelmed to the point of learning nothing, hold one back.
• Keep senior leaders in the room. If the chief executive would sign off the statement in a real crisis, they need to sign it off in the exercise. A leader who drops in for the first half hour leaves the sign-off chain untested.

The debrief

Hold a short debrief before anyone leaves. The Resilience Academy calls it a “hot debrief” and the NCSC a “hot-wash”: what worked, what did not, while memories are fresh. Then hold a cold debrief in the days or weeks afterwards, when people have had time to think.

Write it up. The Resilience Academy says nearly every exercise needs a considered post-exercise report, signed off by the exercise director, and the NCSC suggests it covers the lessons, the recommendations and a named owner for each action, with the recommendations put in place before the next exercise. The Academy also makes a pointed observation: if an exercise produces no lessons at all, “the exercise objectives should be revisited”.

The tone of the debrief decides how honest it is. The guidance describes exercises as a relatively safe-to-fail environment, and they only work that way if mistakes are treated as findings rather than failures. The point of finding a gap in an exercise is that it costs nothing.

How often to exercise

Most organisations have no legal requirement to exercise, so it is easy to let it slide. A benchmark helps. NHS England’s core standards set minimums for NHS bodies: a communications exercise every six months, a tabletop exercise once a year, and a live exercise and a command post exercise every three years.

The Government Communication Service builds rehearsal into its crisis model, PRIMER: plan, rehearse, implement, maintain, evaluate, recover. Rehearsal comes straight after planning. A sensible pattern for most organisations is a tabletop exercise every year, a live simulation every two or three years, and another exercise after any big change: a new plan, a new chief executive, or a real incident.

Mistakes that waste an exercise

• No objectives, or too many. Nobody can say afterwards whether it worked.
• A scenario designed to be passed. The team leaves reassured and unprepared.
• Communications as an afterthought. The operational response is tested, but nobody has to write a statement, face a journalist or brief staff.
• No time pressure. Everything works when there is time to think.
• Missing decision-makers. Deputies stand in for leaders who would be there for real.
• A report nobody acts on. The same gaps turn up in the next exercise, or in the real thing.

Free help, and when to bring someone in

For cyber incidents, the National Cyber Security Centre’s free Exercise in a Box offers tabletop and short “micro” exercises, and includes, in its words, “everything needed to set up, plan, deliver, and identify post-exercise actions”. It is a good place to start if a cyber attack is near the top of your risk register.

Outside help earns its keep in three situations: when realism matters, because a journalist who interviews for a living asks harder questions than a colleague playing one; when you need an independent observer whose findings the board will accept; and when the people best placed to design the exercise are the same people who need to play in it. That is the work of our crisis simulations. To see where your organisation stands first, try the crisis readiness check, and for what to do on the day of a real incident, read the first hours of a crisis.