A business continuity plan (BCP) is only as good as its last test. Tabletop exercises offer an accessible, low-disruption way to test your response plans, train your people, and identify gaps — all without needing to simulate a full-scale disaster.
This guide explains how to plan, facilitate, and review a tabletop exercise that’s proportionate, purposeful, and genuinely useful. It is designed for organisations that want to build confidence in their continuity arrangements without turning exercises into over-engineered productions.
What Is a Tabletop Exercise?
A tabletop exercise is a structured, scenario-based discussion that allows participants to walk through their roles, responsibilities, and decision-making in response to a simulated incident. It is not a live drill — no systems are shut down and no real operations are interrupted.
Instead, participants are given a realistic scenario and asked to talk through what they would do at each stage. The exercise tests the plan, not the people, and helps to reveal whether the organisation’s documented procedures are workable in practice.
Tabletops are especially valuable for:
- Validating new or updated BCPs
- Training senior staff and incident response teams
- Exploring interdependencies across departments
- Surfacing assumptions and misunderstandings
- Building organisational memory and preparedness
Choosing the Right Scenario
The effectiveness of any tabletop starts with choosing the right scenario. This does not mean reaching for the most dramatic situation possible — it means selecting an incident that tests the parts of your plan that matter most.
Options might include:
- Loss of building access due to flood or fire
- Widespread IT outage or cyber incident
- Reputational crisis due to a service failure
- Key supplier insolvency
- Illness affecting senior leadership
Choose a scenario that:
- Aligns with your most likely or highest impact risks
- Is specific enough to test real procedures
- Is relevant to the people in the room
- Has enough complexity to stimulate discussion, but not so much it overwhelms
Where possible, relate it to your business impact analysis or risk register.
Roles, Observers, and Facilitators
A well-run tabletop requires clear roles. You will typically need:
- Facilitator: Guides the session, introduces the scenario, poses questions, and manages time
- Participants: People with defined roles in the BCP — e.g. incident leads, department heads, communications staff
- Observers: Optional. These may include board members, auditors, or insurers, attending to learn or assess
- Note-taker: Captures decisions, gaps, timings, and learning points
The facilitator’s role is crucial. They should keep the conversation on track, ensure all voices are heard, and avoid dominating the discussion. If you’re running a multi-team exercise, consider co-facilitators.
What ‘Realistic’ Actually Means
Realism does not require props, costumes, or roleplay. It means the scenario reflects how the organisation would actually experience an incident — with credible timings, pressures, and constraints.
Avoid making things too easy or too linear. In real incidents:
- Information is often partial or delayed
- Decisions must be made under uncertainty
- Staff may be unavailable or under stress
- Communications may break down or misfire
Introducing these dynamics — sparingly and purposefully — creates more meaningful tests.
Creating Injects and Pressure Points
An inject is a piece of information introduced partway through the exercise to drive discussion or force a decision. Good injects challenge assumptions and reveal how plans hold up under stress.
Examples might include:
- “The phones are down – how do you communicate with customers?”
- “Local media have picked up the story – what’s your position?”
- “The backup site has limited capacity – who gets prioritised?”
- “A second, unrelated incident occurs – does this affect your response?”
Too many injects can overwhelm, but a few well-placed ones help bring the scenario to life and simulate the response and recovery phase of a real disruption.
Documenting Decisions and Actions
A key benefit of tabletop exercises is the learning they generate — but only if it is captured. Make sure the note-taker records:
- What actions participants would take
- Where plans were unclear or unworkable
- What assumptions were surfaced
- Who would need to be involved at each stage
- Any timing, dependency, or communication issues
Some organisations use structured observation forms or BCP validation checklists. Others rely on open notes and a follow-up meeting to confirm findings. Either approach is fine — what matters is having a documented trail that can inform plan revisions.
Lessons Learned: From Theory to Revision
After the session, circulate a short debrief or report. Include:
- What went well
- What gaps were identified
- Any issues with the scenario, facilitation, or engagement
- Recommended changes to the BCP
- Any follow-up training or tests required
Make it easy to link the findings to actual updates — whether that’s a revised contact list, clarified escalation procedure, or an updated disaster recovery plan checklist.
Exercises should feed into your broader business continuity management system and show evidence of your ongoing commitment to readiness and resilience.