In this week’s bulletin, Charlie gives us an exciting insight into his new published book, ‘Practical Business Continuity Exercises: How to Test Your Organization’s Resilience‘, and discusses the takeaways from the book.
After a year of late nights, early mornings, and weekend work, at last I have a copy of my new book on exercises in my hand.
The book is aimed at anyone who delivers exercises for their organisation or a third party. It should be especially useful for those starting to run exercises and wanting a reference book on how to design, develop, deliver, and debrief an exercise; those who would like to deliver a SIMEX exercise and want some guidance on what to do; and experienced practitioners, who may find some of the hints and tips from my experience useful.
I wrote this book very much as a practical guide to planning and delivering exercises. When researching the market, I found that many of the books I came across were either short and superficial, overly complex, academic and of limited practical use, or focused on multi-agency emergency response exercises. I was unable to find a book that focused specifically on business continuity exercises.
What is in the book?
There are 19 chapters, taking the reader from the basic principles of exercising through to the complete process of designing, developing, delivering, and evaluating an exercise.
Chapter 1: Introduction to Business Continuity Exercises
The starting point defines what an exercise actually is and why we conduct them. This chapter looks at the difference between training and exercising, how exercising fits into the business continuity lifecycle, and how exercises validate plans, build individual and team capability, improve confidence, and strengthen organisational resilience.
Chapter 2: The Different Types of Business Continuity Exercises
There is no single type of exercise suitable for every situation. This chapter explains plan walkthroughs, technical tests, tabletop exercises, multi-team exercises, wargaming and stress testing, full and semi-SIMEX exercises, live exercises and drills, and blended training workshops. It also looks at the idea of progressing from simpler to more demanding exercises as capability develops.
Chapter 3: Building a Multi-Year Strategic Exercise Roadmap
Rather than choosing an exercise once a year and hoping it covers the right things, this chapter explains how to build a structured exercise programme over several years. The aim is to ensure that different risks, plans, recovery solutions, teams, and capabilities are systematically exercised and validated over time.
Chapter 4: Making Exercises Educational by Design
Exercises should be learning experiences, not simply events in the diary. This chapter explores individual, team and organisational learning, different learning preferences and theories, including experiential learning, situated learning, behavioural learning, cognitive learning and problem-based learning. The aim is to help practitioners deliberately design more effective learning into their exercises.
Chapter 5: Defining Individual and Team Capabilities to Build Organisational Response Capability
What does a competent incident responder actually need to know and be able to do? This chapter looks at the knowledge, skills, and behaviours required by individuals, the capabilities required from incident management teams, and how those elements combine to demonstrate that the organisation itself has a credible response capability.
Chapter 6: The 4Ds: A Four-Phase Framework for Designing and Delivering Effective Exercises
This chapter introduces the framework I use for exercise management: Design, Develop, Deliver and Debrief. It provides the overall structure for the rest of the book and a repeatable process that can be applied to anything, from a relatively simple tabletop exercise, to a complex SIMEX.
Chapter 7: Agreeing on the Exercise Logistics: When, Where, Who, and How Long
Some of the most important exercise decisions are also the most practical. This chapter covers the initial planning meeting, choosing dates and locations, deciding how long an exercise should last, understanding the organisation being exercised, reviewing its plans, and considering the practical risks associated with running the exercise.
Chapter 8: Writing the Purpose and Exercise Objectives
Good exercises start with a clear answer to the question: why are we doing this? The chapter looks at writing the exercise purpose and then developing objectives around five areas: Know, Do, Work, Check, and Feel. These cover knowledge, skills, teamwork and leadership, validation, confidence, and continual improvement.
Chapter 9: Deciding on the Scope of the Exercise
Who should actually take part? This chapter considers primary team members, deputies, wider staff groups, observers, Red Teams, external partners, and multiple levels of incident management. It also looks at deciding which plans, procedures, and parts of the organisation should be included.
Chapter 10: Designing the Scenario
The scenario needs to be credible and challenging, but it should serve the exercise objectives rather than become an end in itself. This chapter looks at selecting scenarios from organisational risks, industry threats, real incidents and emerging issues, as well as avoiding the common trap of creating something so complicated that participants spend their time arguing about the scenario, rather than practising their response.
Chapter 11: Determining the Type and Structure of the Exercise
Once you know what you are trying to achieve, you can select the most appropriate exercise format and structure. This chapter also encourages practitioners to mix different exercise methods where useful, rather than feeling constrained by rigid definitions of what a tabletop, SIMEX, or other exercise must look like.
Chapter 12: Developing the Storyboard
This is where the scenario becomes a story. The storyboard shows how the incident develops over time and how staff, customers, regulators, the media, and other stakeholders might react. It provides the framework from which tabletop questions or SIMEX injects can then be developed.
Chapter 13: Developing Injects or Tabletop Questions
Injects bring a SIMEX to life, while carefully written questions drive a tabletop exercise. This chapter explains how to write them, who they should come from, how they should be delivered, what response is expected, and how they should link directly back to the objectives and storyboard.
Chapter 14: Evaluating the Incident Team’s Performance and Assessing the Exercise
Running an exercise without evaluating what happened loses much of its value. This chapter looks at different approaches to evaluating performance, the role of the umpire, and how more structured or quantified assessment can be used where appropriate.
Chapter 15: Delivering the Exercise
This is about what happens when all the planning turns into reality. It covers the final preparations, rehearsals, room setup, participant briefing, managing the exercise itself, online exercises, knowing when to finish, and conducting the hot debrief. This chapter also emphasises that exercise staff should observe and facilitate, rather than take over the participants’ response.
Chapter 16: Cold Debrief and Follow-Up
Some learning emerges immediately, while other issues require time for reflection. This chapter looks at when a cold debrief is worthwhile, different ways of conducting one, and, most importantly, how to ensure that lessons and agreed actions are followed through after the exercise.
Chapter 17: Exercise Documentation
An exercise also needs an audit trail. This chapter covers the exercise instruction, supporting documentation, and the post-exercise report, including how to write clear observations and recommendations and the Exercise Director’s overall comment.
Chapter 18: From Umpires to Participants: Understanding Exercise Roles
Larger exercises involve far more people than those being exercised. This chapter explains the roles of the sponsor, participants, Exercise Director, design team, umpires, role players, role-player coordinator, software operators, observers, and safety staff. It also looks at the skills needed to run exercises and how to select and work effectively with external consultants.
Chapter 19: Verisimilitude: Making Your Exercise Come to Life
One of my favourite subjects is making an exercise feel real. This chapter looks at pictures, videos, news reports, avatars, radio clips, simulated media and social media, calls with regulators, media interviews, casualties, props, maps, and models. It also explores how AI tools can now help exercise planners create highly realistic visual and other materials much more easily than was possible in the past.
Practical guidance you can actually use
I also wanted the book to go beyond explaining the theory.
The appendices therefore provide practical guidance for particular exercise formats, including a basic three-hour tactical or operational exercise, detailed guidance on SIMEX, operational resilience exercises, and cyber incident management exercises. My hope is that readers will not necessarily read the book once and then put it on a shelf. I would like it to become the book they take down when somebody says: “We need to run an exercise. How are we going to do it?”.
If it helps someone run their first exercise, improve an exercise they already deliver, try a SIMEX for the first time, or simply pick up one or two ideas that make their next exercise better, then it will have achieved what I set out to do.
How to buy the book
My book is available to buy here from Kogan Page.
Special launch offer! Use the code PUBMON30 to receive 30% off the book until 3rd August 2026.
After 3rd August: Use the code KOGANPAGE25 to receive 25% off when ordering directly from Kogan Page.
My book is also available to buy here on Amazon.
