Tabletop Exercises for Incident Response

Most organisations have an emergency or incident plan. Far fewer have checked that it works. A tabletop exercise is a guided discussion in which your team works through a realistic incident as it develops, decides what to do at each stage, and finds the gaps in the plan while nothing is at stake.

An exercise takes a few hours, needs no equipment and does not interrupt operations. It is one of the quickest ways to find out whether your people know their roles, whether information reaches the right person in time, and whether the plan still matches how you work today.

How an Exercise Works

1. Planning. We agree the aims with you and write a scenario based on your own sites, people and risks.
2. The exercise. A facilitator takes your team through the scenario in stages. New information arrives as the situation changes, and the group decides who acts, who is told, and what is said to staff, guests, families, the public and the authorities.
3. Debrief. We finish with an open discussion of what worked and what did not, while it is fresh.
4. Report. You receive a written report with findings and a short list of actions, each with an owner and a date.

Scenarios We Use

Each scenario is written for the client. Common starting points include:

• A fire in staff accommodation or a guest villa
• A serious injury on a remote island, with the nearest hospital hours away
• A boat accident or a guest missing at sea
• A power, water or communications failure
• A cyber attack or data breach that takes key systems offline
• A severe weather warning, an outbreak of illness, or an incident that draws media attention

Who Takes Part

Usually the people who would lead the response: senior managers, department heads, safety and security staff, HR and communications. For boards and senior leadership teams we run shorter exercises that focus on decisions, reporting lines and public statements.

Testing Your Plans

ISO 45001 asks organisations to test their emergency response periodically, and ISO 22301 sets out an exercise programme for business continuity. A documented tabletop exercise is a practical way to meet both, and the report gives you a record to show auditors, insurers and your board. It also supports the duties employers have to protect workers under the Workplace Safety and Health Act (Act No. 9/2023).

We can run an exercise on its own, or as part of emergency response and business continuity planning, an ISO 45001 system or a workplace safety audit.