In this blog – part of a series from PlanB and Databarracks’ business resilience consultants – Gavin Watt explores the value of a SIMEX and the best practices for planning and running one. 

Exercising is one of the most critical elements in an effective Business Continuity Management System (BCMS). While this is hardly new or surprising information, it’s very easy to underestimate its importance. 

Having worked as a business continuity consultant for many years and conducted numerous styles of exercises, I understand that some exercise planners and participants can feel they are simply “ticking a box” to keep auditors satisfied. But when exercises are seen only in this way, their true value and purpose are lost. 

Moving beyond compliance: the true value of exercising 

Exercising is not simply something that should be done (although it does fulfil compliance requirements). It’s the best way to ensure your incident team structure is suitable, the results from your Business Impact Analysis are accurate and your BC strategies and BC Plans (PP3, PP4, PP5) from GPG 7.0 lead to effective validation (PP6). 

Most organisations start with plan walkthroughs and tabletop exercises, and these are highly effective methods of exercising BC capabilities and organisational resilience. They provide an ideal means of exercising differing levels of teams throughout an organisation and testing plans and response structures. They can also involve a deep dive into some of the key risks facing the organisation. One shortcoming, though, is that teams may experience exercise fatigue. Running a similarly structured tabletop or walkthrough exercise year after year can feel repetitive, and results aren’t always as strong as they should be.  

The next step: simulated exercises (SIMEX) 

If an incident team is experienced enough, the next step to further drive resilience is participating in a simulated exercise (SIMEX). This phrase can mean different things to different people, but what is clear is that the exercise moves beyond a discussion-based tabletop as the SIMEX injects urgency and realism to the scenario by challenging the team to react and make decisions as they would in a genuine crisis.  

How do you plan and structure a SIMEX? 

A SIMEX requires careful planning, bringing together an exercise team to develop a storyboard and produce the required elements of the exercise.  

At the outset, it’s key to identify all the participants – observers, role players and facilitators – and confirm the availability of senior leaders, whose involvement is crucial. 

The SIMEX can be based on the initial stages of an incident, start part of the way through the response or include multiple stages using time jumps to focus on different response phases. 

Time jumps can be useful, but they rely on assumptions about how people or teams would have acted in the intervening periods. It’s important to account for this during planning so skipped periods don’t leave gaps in preparation or understanding. 

The scenario itself can be based on any risk pertinent to the organisation, identified through the risk assessment as part of the BIA process. 

When planning, there are several key factors to consider: 

• Creating realistic pressure and urgency – using injects, media and role players to replicate the pace of a real incident 

• Optimal team configuration – keeping the right group in the room, and calling in others only when needed 

• Designing realistic response structures – mirroring how the organisation would actually respond 

• Maintaining authenticity – treating the exercise as if it were real, with the right people in the right roles 

Each of these elements contributes to making the exercise credible and valuable, so the lessons learned carry through to real-world incidents. 

Creating realistic pressure and urgency 

The key element is bringing the team together and having them work through a series of injects delivered through phone calls, emails, media stories and social media posts, so they feel the weight of time pressure and must act as if the scenario were real. 

Role players can add further realism to the scenario by having a genuine understanding of the organisation and being able to react to the unfolding situation. Role players from within an organisation can also know exactly what “buttons to push” and can target areas of the business that truly need to be challenged. 

Optimal team configuration 

It’s best to exercise one team at a time, with only them in the room. Having too many participants can create delays in decision-making and lead to less effective exercise outcomes. This is not to say other teams can’t be involved, but they should only be called in at specific points during the exercise when their expertise is required. 

Subject matter experts, for example, may not be involved in actual incident team meetings, but their experience and expertise will be vital to gaining an understanding of the scenario at play. 

Designing realistic response structures 

How the SIMEX is structured should mirror how the organisation would work through a real crisis, ensuring that the team understands the exact requirements of the incident response. Where possible, the exercise should take place in the same location a real response would be managed – for example, a boardroom or control centre. However, in today’s work environment, it’s also important to consider the reality of where staff are based. A hybrid format can be considered as this represents a more likely response, albeit one that’s more difficult to manage for exercise purposes.  

It’s easy for participants online to feel removed from the action onsite, however with effective monitoring this can be avoided – again showing how the organisation of a SIMEX is key to its success. 

To provide even an even greater level of authenticity, the organisation can also invite key suppliers, auditors, safety officers, PR companies or whoever else may play a role within the response to a major incident.  This can ultimately help to build an even greater level of resilience by understanding how the different parties will work together in a safe environment. If aspects of the response need adjustment, it’s better to find out in a SIMEX than during a real-life crisis.   

Maintaining authenticity 

It’s important to treat the exercise as if it were a real event, having the actual response team at the table. If a Gold level team is being exercised, they should be the only ones in the room (if onsite), but there can be a supporting cast in other rooms or on Teams chat, ready to be called on if required. This may include Silver or Bronze team members, subject matter experts or other required support. Maintaining authenticity in this way ensures all teams can focus clearly on their own areas of responsibility, as they would have to in a real event.  

What makes a SIMEX transformative? 

When the SIMEX concludes, the team should feel as though they have been involved in a real incident – discovering gaps and areas requiring improvement, testing decision-making under pressure and improving coordination.  

A well-run SIMEX doesn’t just measure performance; it also builds confidence and helps embed continuity best practices throughout the organisation.  

A SIMEX provides an opportunity for organisations to take BC beyond box-ticking. In my experience, it helps turn exercises from what sometimes feels like a compliance activity into a meaningful experience that changes how teams think, decide and act under pressure. By simulating the reality of a crisis, a SIMEX exposes weaknesses while giving teams the practice, confidence and resilience they need to face the next real incident. 

If you have an experienced incident team who have conducted multiple desktop exercises, a SIMEX will provide the ideal opportunity to not only challenge the team with an effective scenario but also help to further enhance their and the organisation’s resilience. And hopefully, they will have some fun in the process too.