What executive boards get wrong during tabletop crisis exercises
A polite conversation around a slide deck can leave a board more confident and less prepared. The common mistakes, and how to run a tabletop that genuinely tests leadership.
Most boards that run a tabletop exercise come away feeling reassured. That is often the problem. Having led crisis response in large organisations and designed exercises for executive teams, we see the same patterns repeat. The exercise feels productive, the plan is praised and the real weaknesses stay hidden until an actual incident finds them.
Treating the exercise as a presentation
The most common mistake is a scenario delivered as a narrated slide deck, with the board discussing what they would do in general terms. Nobody has to commit to a decision, so nobody discovers that they disagree. A useful tabletop forces specific choices at specific moments. Do we take the systems offline now? Who speaks to the regulator? What do we tell staff in the next thirty minutes?
No time pressure
Real crises compress time. Information arrives in fragments, often contradictory, while journalists, customers and regulators demand answers. A tabletop without timed injects removes the very pressure that breaks decision-making. Even in a discussion-based format, releasing new information on a clock and expecting decisions before the next inject changes how the room behaves.
Testing the plan instead of the people
Boards often walk through the plan to confirm it exists and reads well. The more valuable question is whether the people named in it can perform their roles. Does the chair know when to step back from operational detail? Does the board understand the difference between its role and the crisis management team's? Clarity about who decides what is usually the first thing to fail.
Forgetting the decision log
Every significant decision in a crisis should be recorded with the information available at the time and the rationale. After an incident, that record protects the organisation and its leaders when actions are scrutinised. Exercises are the right place to practise keeping it. Few boards do, and fewer check the log afterwards.
Avoiding uncomfortable scenarios
Scenarios are sometimes softened to avoid embarrassment, or chosen because the organisation already knows how it would respond. The value lies in plausible threats that stretch the team, such as ransomware with data exfiltration, an insider incident or a fast-moving reputational crisis across several countries.
No follow-through
An exercise without a debrief and a prioritised action plan is a missed opportunity. Lessons should be captured while they are fresh, assigned owners and tested again. Good practice in ISO 22301 and ISO 22361 expects exercising to be part of a continuing programme, not a single event.
Running a tabletop that works
Our crisis management exercising service designs scenarios around your own risks, sites and plans, delivered with timed injects and realistic pressure on our Crisis Room platform. For organisations that want to build capability over a year rather than a single day, CrisisReady™ provides a structured programme of exercising. Read our guide to choosing between tabletop and live simulation, or speak to an exercise designer about your next exercise.
More insights
Keep reading.
Related thinking from the Oakwood team.
Tabletop or live simulation? Choosing the right crisis exercise format
Tabletops, functional drills and full-scale simulations each pressure-test different muscles. Picking the wrong one wastes the rarest resource your leadership team has — time.
The anatomy of a crisis response team that actually performs
Most crisis teams fail in the first ninety minutes — not because the plan is wrong, but because the team has never been built to operate as one.
Mental Health First Aid: the quiet layer in your incident response
The first 72 hours after a serious incident are a welfare problem as much as an operational one. Most response plans don't reflect that.