How to Run a Crisis Tabletop Exercise (With a Sample Scenario)

A tabletop exercise is a structured discussion in which your crisis team works through a realistic, made-up scenario as if it were happening, to find out whether your plan, roles and approvals hold up. You choose a scenario, feed in new developments (“injects”) at intervals, ask the team what they would do and say at each stage, and then debrief on what went wrong. A useful one takes two to three hours, needs no special software, and usually exposes gaps you would never find by reading the plan.

This guide goes further than the short version in our crisis communication plan guide. It covers how to design the scenario, write injects, assign roles, run the room and turn the debrief into real fixes, with a sample scenario at the end you can adapt.

Why run one

Crisis plans tend to fail in the same places: nobody knows who can approve a statement at night, the only person with the social media login is away, the holding statement was never agreed, or legal and marketing want opposite things. None of this shows up on paper. It shows up when people have to make decisions against a clock.

A tabletop exercise creates that pressure in a safe setting. Mistakes cost nothing, and everyone leaves with a clearer sense of their own role. It is also one of the few ways to see how your team behaves under stress before it matters.

Tabletop exercise vs other kinds of crisis drill

Type	What happens	Best for
Walkthrough	The team reads through the plan together, section by section.	A brand-new plan or a new team.
Tabletop exercise	The team discusses a scenario as it unfolds through injects, and decides what to do and say.	Testing decisions, roles and approvals. Most organizations start here.
Functional simulation	The team actually drafts and approves statements, uses real tools and works to real time limits, sometimes with role-players calling in as journalists.	Teams that have run tabletops and want more realism.
Full-scale exercise	Multiple departments and sometimes outside agencies respond as if live.	Large or regulated organizations with safety risks.

For most small and mid-size businesses, a tabletop once or twice a year is enough, with a short functional element such as drafting the first statement for real.

Roles in the room

Keep the group small enough to talk: usually five to ten people. Everyone should be someone who would genuinely be involved in a real incident.

• Facilitator: runs the session, reads the injects, asks questions and keeps time. Ideally someone who doesn’t have a decision-making role in the scenario, so they can push the team without defending their own choices.
• Players: the crisis team, typically the lead decision-maker, spokesperson, legal adviser, operations, the person who runs your channels, and HR or customer service if the scenario involves them.
• Note-taker: records decisions, timings, questions nobody could answer and gaps. This is essential. The debrief depends on it.
• Observers (optional): people who watch without playing, such as a board member or a new manager learning the process.
• Role-players (optional): someone who plays a journalist, an angry customer or a regulator when an inject calls for it.

How to plan a tabletop exercise, step by step

1. Set two or three objectives. For example: test whether the spokesperson can publish a holding statement within an hour, check that the approval chain works outside office hours, and confirm who contacts key customers. Objectives stop the session from drifting into general discussion.
2. Choose a plausible scenario. Pick something from your risk list that could realistically happen in the next year. A viral complaint, a data incident, an employee’s offensive post or a product problem works better than an earthquake.
3. Set the ground rules. It’s a no-blame exercise, people should answer as they would in reality, and “I’d check the plan” is fine as long as someone then checks it.
4. Write the starting situation. One short paragraph: what has happened, when, and what the team knows. Keep it incomplete, as real first information always is.
5. Write four to six injects. Each adds pressure or new facts. More on these below.
6. Prepare discussion questions for each inject. Who decides? What do we say, where and when? Who approves it? What are we doing to fix the underlying problem? Who else needs to know?
7. Prepare materials. Printed injects, a copy of the plan, mock social posts or emails, a whiteboard or shared doc for the timeline.
8. Book the time and protect it. Phones on silent except for anything the exercise needs. Senior people who drop in and out undermine the whole session.

How to write good injects

An inject is a new piece of information the facilitator introduces during the exercise. Good injects are specific, realistic and slightly uncomfortable.

• Escalate gradually. Start with something ambiguous and add pressure: more attention, a reporter’s call, a new fact that changes the picture.
• Test your weak points. If you suspect approvals are slow, write an inject where the usual approver can’t be reached.
• Include a surprise fact. Something that makes an earlier statement look incomplete, so the team has to decide whether to correct it.
• Bring in different audiences. Employees, customers, a partner, a regulator. Real crises don’t stay on one channel.
• Give a time stamp. “It’s now 9:40 p.m., 90 minutes after the first post” helps the team think in real time.
• Use realistic artifacts. A mock social post, a mock email from a journalist with a deadline, a mock one-star review. Keep them clearly marked as exercise material.

Running the session

A typical agenda for a two to three hour tabletop:

1. Introduction (10 minutes): objectives, ground rules, roles.
2. Starting situation (20 minutes): the facilitator reads it, and the team works through the first questions.
3. Injects (60 to 90 minutes): one at a time, with discussion after each. The facilitator keeps the pace up and asks follow-up questions: “Who is actually doing that? By when? Who signs it off?”
4. Draft the first statement for real (15 minutes): have the spokesperson write it and the approver approve it, and time how long that takes.
5. Hot debrief (20 to 30 minutes): immediate reactions while memories are fresh.

The facilitator’s job is to probe, not to lecture. When someone says “we’d put out a statement”, ask what it says, who writes it, where it goes and who approves it. Vague answers are where the gaps hide.

Sample scenario: a viral video and an unreachable approver

This is an illustrative scenario, not a real client. Adapt the details to your business.

Starting situation: It’s a Thursday at 7:15 p.m. A customer of a regional chain of fitness studios posts a video on social media showing a broken piece of equipment and a trainer telling her “it’s been like that for weeks”. The post says she was injured. It has a few hundred shares and is climbing. The studio’s operations manager saw it by chance.

Time	Inject	Questions for the team
+45 min	The post is being shared by local community groups. Comments call for the studio to be shut down. Several one-star reviews appear on the Google Business Profile.	Is this a crisis under our thresholds? Who is the lead tonight? Do we respond publicly now, or check facts first? What happens to our scheduled promotional posts?
+90 min	The owner, who must approve all public statements, is on a flight and unreachable for five hours.	Who can approve a holding statement? Does the plan say? What can the spokesperson post without sign-off?
+2 hrs	A local reporter emails asking for comment by 9 a.m. tomorrow, and asks whether the equipment had been reported before.	Who replies? What do we know? Do we need legal review given the injury claim?
Next morning	Maintenance logs show the fault was reported twice and not fixed. The holding statement said “we are investigating”.	Do we update the statement? What do we tell staff? How do we contact the customer privately?
+1 day	A former employee posts that safety complaints were routinely ignored.	How does this change our response? What internal review do we commit to?

In an exercise like this, teams often discover that there’s no backup approver, that nobody knows how to pause scheduled posts, and that nobody has decided who reaches out to the injured customer. Those are exactly the gaps worth finding. Our guide on how to write a holding statement helps with the first-response drafting.

The debrief: turning findings into fixes

The exercise is only worth running if the debrief leads to changes. Do a short hot debrief at the end of the session, then a written after-action report within a week.

1. What went well? Keep this honest and brief. It shows the team what to keep doing.
2. Where did we hesitate or disagree? Those moments usually point to unclear roles or thresholds.
3. What didn’t we know? Missing contacts, logins, policies or facts.
4. How long did approvals take? Compare against your target.
5. What will we change? Each fix gets an owner and a date: update the contact list, add a backup approver, pre-approve a new holding statement, set up access to scheduling tools.

Follow up on the action list at your next team meeting. A debrief whose actions never happen is the most common way tabletop exercises go to waste.

Common mistakes

• Making the scenario too dramatic. Unrealistic scenarios get unrealistic answers. Start with what’s likely.
• Letting the most senior person dominate. The facilitator should draw out everyone, especially the people who would actually do the work.
• Accepting vague answers. “We’d handle it” isn’t a decision.
• Blaming people for gaps. The point is to find weaknesses in the system. If people feel judged, they stop being candid.
• Skipping the written report. Without it, the same gaps turn up in the next exercise.
• Never changing the scenario. Rotate through your risk list so you test different parts of the plan.

Getting outside help

Most teams can run a basic tabletop themselves using this guide. An outside facilitator can be useful if your leadership team finds it hard to challenge each other, if you want a more realistic simulation with role-players, or if you’re preparing for a specific known risk. Our crisis management service can help design scenarios and review your plan afterward, and media training is a natural next step for your spokesperson.

Frequently asked questions

What is a tabletop exercise in crisis management?

It is a discussion-based rehearsal in which a crisis team talks through a realistic, fictional scenario as it unfolds, deciding what they would do and say at each stage. The aim is to test the plan, the roles and the approval process and to find gaps before a real incident.

How long should a tabletop exercise take?

Most run two to three hours, including a debrief. Shorter sessions can work for a single focused question, such as testing out-of-hours approvals, but they tend to skip the debrief, which is the most valuable part.

How often should we run one?

Once or twice a year is typical for smaller businesses, plus after any major change to the team or plan, and after a real incident to test the lessons you learned.

Who should facilitate?

Ideally someone who isn’t a key decision-maker in the scenario, so they can challenge the team freely. That can be a colleague from another part of the business or an outside facilitator.