SEC releases document on tabletop exercise best practices

When it comes to preparing for worst case scenarios, one thing that security managers across all industries stress is the importance of conducting risk assessments and practicing tabletop exercises. Tabletop exercises, which are scenarios developed around critical incidents such as workplace shootings or natural disasters, allow companies to gauge the preparedness of their security staffs and work force in handling and responding to such an event.

In an effort to stress the importance of these exercises, the Security Executive Council posted a document this month on its website written by SEC Emeritus Faculty members Rad Jones and Jerry Miller, which examines the value of tabletops and how they should be designed.

Despite their importance, Jones, a retired U.S. Secret Service agent and former manager of security and fire protection at Ford Motor Company, says that tabletops are underutilized by security executives.

"You hear a lot of talk about tabletop exercises, but what we find when we start working with a company is that their response is 'we aren't quite there' or 'we're in the process of working on that and developing it,'" Jones said. "My feeling is and my experience has been that the sooner you can conduct a tabletop exercise and put your management team through that, the better off they will be because what comes out of (the exercise) is the definition of their roles and responsibilities and how they need to mesh with other departments in the organization."

According to Jones, some security managers are apprehensive about tabletop exercises because they feel they are being put through a pass or fail exam, but he says that's simply not true.

"There really is no pass or fail in a tabletop exercise, it's a learning experience," Jones explained. "A tabletop exercise should be developed to meet some condition that's within that company. You want to make it simple, it doesn't have to be elaborate because if it's too involved, people can throw their hands up and say 'this is unmanageable.'"

Jones says that the exercises should be conducted about every six months and can range from a scenario that could take between an hour to an hour and a half to complete up to one that could take between three or four hours to finish. Organizations that develop and practice tabletop exercises regularly will see positive results from the employees that take part in them.

"When the exercise is completed, I can honestly say I never been involved in a tabletop where the people did not come out charged up and enthusiastic on a really high note," Jones said.

In his experience as a security manager, Jones said that there have been cases where the scenario practiced in the tabletop has come to fruition.

"When that does occur, support for your tabletop exercises just skyrockets. In fact, at Ford, we did tabletops with top management and lower management and we even participated in two functional exercises." he said.

In addition to the criteria that are discussed in the SEC document, Jones said that it's imperative that a tabletop be designed to be realistic.

"I think you really have to develop an exercise that is going to be germane to the processes and functions of that business and it involves all the participants," he explained. "You have to make sure it has a finance piece, a public affairs piece, HR, depending on who makes up their crisis management team. You have to make sure that your exercise is going to energize and work with each one of those people that are on the team."

For more information about tabletop exercises, visit the SEC's website to download a PDF copy of "The Value of Tabletop Exercises" document written by Jones and Miller.