Tabletop Exercise without a Business Continuity Plan

Should an organization hold a tabletop exercise if they don’t have a business continuity plan organized?

If the management team are really excited about holding an exercise, and that’s where their passion lies, then I say go for it!

You can use the exercise as a gap analysis and the basis for writing the first draft of their plan.

Here is some feedback from BCP Builder Community on this topic – taken from LinkedIn.

Team Building

Any opportunity to learn by doing should be taken when it comes to any level of emergency planning. Not enough organisations realize the importance of planning and honing this craft, let alone the resilience and team building that is achieved throughout this process.
The first exercise – with a business continuity plan in hand, is usually focused on the roles and responsibilities and the mock disaster impacts to the organization, horizon scanning for future impacts, and knowing that while they have the checklists to follow in the plan- the value is in the dialogue and critical decision making.

Documentation

If you do conduct a tabletop exercise before having a plan, it would be critical that someone is properly documenting everything discussed. If they do not capture it during the exercise the odds are they will not remember everything discussed. They should then look to schedule another exercise to ensure they documented everything correctly, as well as to see if anything changed now that they had time to think about it.
I always try to hold a tabletop exercise as the first step when coming on board a new company. It goes against ‘conventional planning wisdom’ but can provide significant insight in making a quantum leap with respect to a well designed process/program. It’s a great way to get to know management (their abilities/personalities) and understand the current capabilities and thought processes around an existing plan or how to create new plans that will fit the expectations and culture of company. Test first and test often has been my mantra for over 12 years.

Planning Workshop

You can also view it as a workshop. You are trying to come out with a draft plan concept through the use of a scenario.
The tabletop exercise should be the first step in the planning process, not one of the last steps. All organizations have a business continuity plan. It’s just that many of them are not formally established or documented. Lacking a formal process to organize and document the business continuity plan, the unstated and unapproved strategy is to respond to the disaster as it occurs. Accepting that that is your default plan, organizations should still practice (via a tabletop exercise) how that would work. It is during this exercise that the light bulbs should start to go off and help the would be planner to justify the need for plans and introduce what value a plan and pre-established capabilities would bring to the organization. A well-developed and well facilitated tabletop exercise in an organization that has not yet formally organized and document their business continuity plan is a better selling tool and justifier for the need to do so than any other tool or presentation.

Scope and Objectives

A tabletop exercise holds no risk for the business. It’s always a good idea to have an incident response mechanism even when this not backed up – initially – by a solid or documented business continuity plan. In order to have a real added value, the exercise should be conducted with only a handful of key stakeholders, pick a realistic and probable type of incident, have a clear scope and objectives and decide upon the success criteria and how to measure it.
The slightly mistranslated term you are looking for is “carpe diem”. My first thoughts when I listened to this post was that the organisation needs to see the challenges ahead so they can commit fully to a planning process. While this may start as an exercise, it may become an intelligence gathering opportunity to understand how the organisation operates, talks, listens and does. Lots of organisations see an exercise as a form of scoping study, a great way to see just how much time and effort they need/want to put into a plan.
I agree that an exercise should be done. The key is that management has to be engaged and have an open mind to any gaps. This is a great opportunity to advance an organization in the right direction and possibly refocus an area of the business.

Example

Aim: To explore how we might respond to and recover from denial of access to our primary office location. Objectives:
1. Identify how the Executive Team might be notified of the event and what their actions may be in the ‘Golden Hour’ immediately after notification
2. Discuss what the Executive Team would have to consider when developing their likely recovery strategies
3. Identify the critical business processes that would be impacted and the consequence to the business
4. Identify the internal/external stakeholders who would have to be informed and the messaging required.
The above would give you a strong base to engage with and inform your Executive without making them feel embarrassed because of their lack of knowledge. I do this sort of thing a lot with lots of group participation, getting them to record their individual group thoughts on flip charts. Each group does show and tell to encourage debate in a non judgmental environment and the flip charts form the basis of the business impact analysis and business continuity plan. This methodology is more akin to the Adaptive BC approach which I’m a big fan of because it gets the business involved and they ‘own’ the result

Innate Capability

Even if a company doesn’t have a plan, they will have some level of business continuity capability, even if they don’t call or know it as that. Using a good scenario will show you who your business continuity advocates will be at that company. Make sure you have note takers/observers on hand.

“Done is better than Perfect”

If you are going to wait until you have your “ducks in a row” for making a disaster plan, it may never happen. Just do something to kick start the plan. If a tabletop exercise gets people to look at the gaps in their disaster planning, then do it.
While a tabletop without a plan may seem like a cart before a horse, it most certainly can generate conversations. This can help with the business impact analysis and risk assessment — lots of “what if” should come out of it.
Disaster doesn’t wait on you to write a plan or exercise it.

If you want to increase your Organizational Resilience, start with preparing a Business Continuity Plan and check out BCP Builder’s Business Continuity Planning Templates.