Putting your plan through its paces

Kathleen Kimball-Baker and Natasha Rotstein

Conducting tabletops and other exercises

(CIDRAP Source Weekly Briefing) – Exercises—whether simple or complex—can greatly help a business prepare, regardless of its stage of pandemic planning.

Whatever stage your pandemic plan is in, from nonexistent to sketchy to full-blown, conducting carefully chosen exercises can strengthen your company's ability to endure a catastrophic event unlike anything it has ever experienced.

Exercises run the gamut from staff orientation to tabletop scenarios to extensive (often expensive) drills, explains Jill DeBoer, MPH, an expert educator in business continuity and associate director at the Center for Infectious Disease Research and Policy (CIDRAP) at the University of Minnesota. With tight or no budgets for most pandemic preparedness activities, planners must choose wisely from the options. In February, DeBoer and colleague Kristine Moore, MD, MPH, CIDRAP medical director, worked to meet that demand with two workshops packed with Fortune 500 planners—and no shortage of questions.

The benefits of putting your plan through a reality check are indisputable, DeBoer and Moore say. Exercises help you locate critical gaps and flaws in assumptions, allow employees to interact and practice assigned roles, and give you valuable feedback and time to revise and refine your plans—before the urgency of a pandemic unfolds. But for employees tasked with pandemic planning for the first time or for planners combating the fatigue of years of preparations, what's the right exercise to choose to make best use of limited dollars and ensure best results?

Know where you are

DeBoer and Moore stress the importance of knowing your company's stage of readiness, even before selecting the type of exercise. Business continuity planning requires certain steps, but pandemics, because of their duration and the high levels of absenteeism they cause, call for extra considerations. Companies will be forced to make decisions with limited and changing information, the impact will be global but you won't be able to rely on mutual-aid agreements, and you can anticipate a certain level of panic in the public.

DeBoer and Moore suggest that you:

Conduct a risk assessment. Identify internal and external threats, hazards, and company vulnerabilities. Pandemic influenza is a hazard with potentially high severity and, at some point, high probability.
Conduct a business impact analysis. Define how pandemic influenza can affect your business. Identify critical job functions and operations, and know what assets you can use to respond. Think about what the minimal requirements are for continuing to run your business.
Develop a business continuity plan. Develop policies and procedures that address the unique stresses that a pandemic poses. (For more information on this, see CIDRAP's 10-Point Framework for Pandemic Influenza Business Contingency Planning.)
Implement the business continuity plan. Educate staff, conduct training, and take the steps necessary to implement pandemic-specific policies and procedures.

Regardless of your company's planning stage, says DeBoer, an exercise is warranted. Timing may depend on such triggers as changes in key personnel, shifts in trends that affect your industry, new regulatory requirements, or changes in information technology systems. "Most people think of exercises as the end of the planning process, but they can be used at any point. Think of them in a cycle. Each exercise needs to inform the plan, which then informs the next exercise," says DeBoer.

Exercises, according to DeBoer and Moore, fit into five categories:

Orientation. Usually more educational in nature, this exercise is especially useful before a plan is developed. It familiarizes staff with current emergency response plans, what's different about a pandemic, and how information and procedures could change. An orientation builds awareness and is good for brainstorming and gathering ideas.
Drill. The focus of this exercise is usually on one part of a response plan and is useful for testing staff training, response time, interdepartmental cooperation and resources, and the capabilities of human resources and equipment. Examples include testing your emergency operations center or your information technology recovery abilities.
Tabletop. A facilitated, scenario-based discussion, this exercise focuses on constructive problem solving as a group and works well to test a comprehensive plan. Your ideal list of participants depends on what you're trying to test. If your goal is to test decision making, for example, then invite key decision makers. Tabletop discussions are guided by a moderator or facilitator. In basic tabletops, participants discuss problems as a group, and the leader summarizes conclusions. During advanced tabletops, participants must rapidly respond to a series of messages.
Functional exercise. A full simulation that involves moving people, this exercise has participants gathering in whatever emergency operations center or room you would normally use and may include briefing them immediately before. It tests multiple functions and coordinated response in a time-pressured, realistic way, unfolding over time.
Full-scale exercise. Used to test the comprehensive response capacity of multiple groups, this exercise simulates a real event as closely as possible and involves moving assets, which can be costly. In a community setting, these exercises usually involve ambulances, healthcare workers, and simulated patients.

Imperfect, but worthwhile

No exercise or drill will provide a full-scale sense of what a 6- to 12-month pandemic is going to be like, say Moore and DeBoer. "All the exercises are artificial but can clarify roles and responsibilities. They have an educational value, because people get a much better sense of how the pandemic can affect their workflow," DeBoer says.

Von Roebuck, a spokesperson at the Centers for Disease Control and Prevention (CDC) who specializes in emergency risk communications, says exercises may never provide a perfect picture of what a pandemic—or any other disaster—is going to be like. But conducting exercises is still helpful, Roebuck says.

When the CDC began conducting tabletop exercises, it discovered that many employees did not know what roles different agencies within the organization would play in an emergency such as a pandemic. "That is the reason for these exercises," Roebuck says. "We are supportive of businesses and the community doing these exercises so you know how to act during a pandemic."

If you are choosing an external consultant to help your company conduct an exercise, DeBoer says she'd opt for someone with experience in the setting, knowledge of the topic, and good references, which you should always check.

A Feb 14 report published by the Business Continuity Institute, "Business Continuity Management: Good Practice Guidelines 2007," says business continuity management capability cannot be considered reliable until it has been exercised. The report advises companies to test business continuity plans at least once every 12 months. The institute, based in the United Kingdom, aims to help members obtain guidance and support from other business continuity practitioners.

"Time and resources spent exercising business continuity management strategies and business continuity plans are crucial parts of the overall process as they develop competence, instill confidence, and impart knowledge that is essential at times of crisis," the report says.

DeBoer agrees. Conducting exercises can help a company strategize around each unique aspect of a pandemic and can help executive leadership see how a pandemic may affect the business. She adds: "It's a luxury that allows employees to engage with people in a way that may not otherwise be possible. Exercises are incredible learning experiences for people involved. So often we tend not to run to our plans when we have an emergency. We tend to use our instincts rather than our plans. Conducting an exercise makes us live them."