How to Run a Tabletop Exercise in 6 Steps + Examples

What Is a Tabletop Exercise?

A tabletop exercise—or table top exercise—is an interactive, discussion-based session that prepares key team members for an emergency, disaster, or crisis. In this exercise, participants will review their roles, procedures, and responses during a critical event while walking through example situations.

A facilitator guides participants through the discussion in an informal, meeting-like setting—ideally a collaborative one that encourages exploration and asking questions. Depending on the objectives and scope of a tabletop drill, they may last anywhere from a few hours to multiple days.

A tabletop drill or exercise helps participants get familiar with the emergency response process and allows safety leaders to assess the organization’s emergency preparedness in a risk-free environment. The most basic goal of a tabletop exercise is to ensure your team members know exactly what to do in an emergency.

According to the Homeland Security Exercise Evaluation Program (HSEEP), a tabletop exercise is just one of four different types of exercises used to evaluate emergency plans and procedures:

• Walkthroughs
• Tabletop exercises
• Functional exercises
• Full-scale exercises

Each of these exercises builds off the one above it in the list. Walkthroughs are the least comprehensive, focusing on basic familiarization with roles and responsibilities. Tabletop exercises are a more in-depth discussion and review, including role-playing reactions to hypothetical situations and unexpected complications (also known as injects). In functional exercises, emergency teams test specific procedures in a controlled setting. Full-scale exercises are the most comprehensive, simulating crisis conditions for maximum realism, and often include external contributors such as first responders or community members.

Together, these practices help organizations hone quick decision-making and problem-solving skills, build up their incident response muscles, and strengthen emergency operations and business continuity plans.

Proactive planning is a strategic advantage. Tabletop exercises are a low-cost, high-reward strategy to prepare for the unexpected.

— Isabel (@IsabelMgarcia45) June 14, 2024

Top Benefits of Tabletop Training Exercises

Tabletop drills and exercises are a cost-effective, high-impact way for employee safety and business continuity leaders to clarify and act on emergency preparedness measures before a crisis occurs.

Plus, you can tailor the exercises to any situation based on your organization’s risk profile and specific threats. For example, a tabletop exercise for cyber threats will be very different from one meant to test hurricane response tactics.

In general, tabletops are an effective way to:

• Evaluate emergency plans and preparedness
• Clarify roles and responsibilities (e.g., make sure everyone knows what to do)
• Identify problem areas in existing plans and procedures
• Resolve issues and document best practices
• Evaluate current resources and identify needs
• Test new procedures or plans
• Collect feedback and recommendations
• Measure improvement against performance goals
• Enhance coordination between team members and departments
• Provide peace of mind and confidence among key stakeholders
• Validate training and education
• Raise awareness of hazards and their impacts
• Eliminate confusion during a real-life emergency
• Improve crisis response times
• Potentially save lives and protect the business from significant losses

Of course, tabletop exercises have limitations—they’re not a catch-all for every situation. For example, they don’t provide measurable data or replicate real-time urgency the way full-scale exercises do. Additionally, the meeting-like structure may lull some participants into thinking emergency responses are always straightforward, which can be risky.

Lastly, while the goal is to explore all potential scenarios and plan for contingencies, a hypothetical discussion may fail to reveal unexpected challenges to the extent that an actual event or rehearsal would. If a stairwell’s small size would hinder an emergency evacuation, this might be overlooked in a simple tabletop exercise.

Consider all available options (e.g., walkthroughs, tabletop exercises, functional exercises, full-scale exercises) and choose the right approach for your situation.

How to Conduct a Tabletop Exercise in 6 Steps

Now that you know what tabletop exercises are and why they’re useful, here’s a blueprint for how to go about actually performing one.

1. Establish goals and objectives

The first step in any tabletop exercise is determining what you want to test. What needs working on? Which parts of your current business continuity or emergency response plan are outdated or misaligned?

It can be helpful to develop an objective statement (or statements) that define what you hope to accomplish. For example, “We will”:

• Assess the communication plan during a data security breach.
• Practice resource allocation and decision-making during a natural disaster.
• Identify gaps in the business continuity plan following a power outage.
• Evaluate the effectiveness of the evacuation plan in response to a fire alarm.
• Improve collaboration among departments in a product recall scenario.

Nailing down clear objectives will help you build a strong scenario for your tabletop exercise and judge how well it went afterward. Keep objectives focused to make sure you can hit them all within the time you have.

2. Select the participants

The next step is to decide who should be involved in a tabletop exercise. Is it a larger-scale effort that requires company-wide participation? Is it more focused, involving only certain departments or response teams? Consider who you might need to involve among:

• Managers
• Operators
• Executives
• Administrators
• Finance
• Customer service
• IT
• Vendors
• Contractors
• Other key decision-makers

Tabletop exercises are a great way to strengthen key relationships before a crisis occurs. As Bob Smith, Director of Service Assurance and Compliance at GCI Communication Corporation, told us in a recent podcast, “You have to have great working relationships with your business partners, human resources, and corporate communications. They all have a role to play, so make sure you’ve got those relationships built ahead of time.”

Smith also recommends engaging remote and hybrid employees in your exercises. “If you’ve got 100 employees working remotely that are running the most critical pieces of your network…make sure that you’ve got the planning in place to take care of each one of those pieces just like you would your headquarters … because any one of them could potentially go offline in an earthquake situation or any type of disaster.”

Once you know who’s involved, decide their roles in the exercise. Below are the four most common roles assigned to individuals at the table.

3. Design the exercise

In this critical step, you’ll prepare all the details and materials needed for the exercise. This includes choosing a specific example or scenario to discuss and developing the script.

Tailor your role-playing exercises to the specific vulnerabilities your organization faces. For example, a California-based firm might rehearse earthquake drills, while a Florida company focuses on hurricane response. You can also choose to cover workplace violence, a data breach, or any other potential crisis.

Include discussion questions and focus on critical decisions. Ask leading and open-ended questions that will spark conversation, such as, “How will you take care of people and get them help? How will you communicate with employees during emergencies?”

Don’t just rehearse actions; have participants grapple with tough choices. For example, a flood could cause a power outage leading to other consequences. A data breach scenario could involve deciding when to inform customers or law enforcement.

Smith also recommends building potential contingencies into an exercise scenario, such as removing one critical person during a real-world incident. His example: “The person that owns that piece of the business is stuck in the metro and it’s shut down because the power is out. So how do you handle that?”

The more realistic your script is, the better. Our free Tabletop Exercise Template provides a structure for developing your TTX, including example scenarios, questions to ask, and hypothetical disruptions you could inject into the script.

Preview of the Tabletop Exercise Template

4. Run the exercise

Once you’ve outlined your objectives, created your script, and chosen your participants, it’s time to run the exercise. Have participants imagine what would happen if this particular emergency or incident occurred in real life. Talk about details of the scenario and go through every step of your plan.

A few tips:

• Maintain a relaxed, open environment so everyone feels comfortable asking questions.
• Keep participants actively involved and moving forward, keeping an eye on the time.
• Follow the script during the exercise, but also be prepared to improvise.
• Capture issues and lessons as you go along using recording software or AI note-takers.

5. Do a hot wash to review the exercise

After almost three decades in emergency management, one of Smith’s biggest takeaways is “Never stop learning.” Indeed, continuous improvement is a key tenet of risk management.

Emergency preparedness experts recommend an after-action review or hot wash to analyze:

• What was intended to happen versus what actually happened?
• Why were there differences between the intention and the actual?
• What can be improved for next time?

These reviews can be formal or informal. The goal is to capture key insights and takeaways you can use to improve your efforts.

Do the review after the exercise while the details are still fresh. The facilitator can gather immediate observations and then ask participants what they thought went well, what went wrong, and what changes to make for next time.

6. Use the after-action report to improve your process

You put everything that comes out of the hot wash or after-action review into an after-action report. This report describes the exercise in detail, including what was discussed, participant takeaways, best practices, and concerns.

Finally, the report will include an improvement plan based on what you learned. The improvement plan should outline specific action items, who’s responsible for what, and by when.

Documenting and updating all your emergency response processes, procedures, and plans takes time, but it’s worth it to avoid making the same mistake twice.

More Resources on Tabletop Exercises

Additional Considerations for Effective Tabletop Exercises

Scenario information

Leaders should prepare detailed scenario information with position-specific waypoints ahead of time to guide everyone through their responsibilities during the emergency. Make sure your team has access to this packet ahead of time.

Communicate with employees during emergencies

Consider leveraging a modern emergency communication solution with event pages to simulate a communication exercise during the tabletop.

We recommend using a mass notification system from a provider such as AlertMedia to reach employees on any device through various channels. Options such as app push notifications, text, voice, email, and social media ensure maximum deliverability. Two-way messaging ensures employers can stay in touch with employees and that employees can share their own information with safety leaders.

Stay on top of events as they happen

Of course, you’ll also need to document your processes for reporting emergencies, unplanned business disruptions, and other critical events. Combining analyst-verified threat intelligence with location data for your people, facilities, and assets will help you identify incidents faster and minimize response times as you implement your plans.

Plan for Any Potential Situation

The heat of the moment is not the time for people to be questioning what to do and when. From natural disasters to cybersecurity incidents or workplace violence, a TTX helps you prepare your organization for any emergency. If you’ve planned and practiced ahead of time, you’ll be able to communicate faster and take swift, confident action during critical events, when every second matters.