We recently conducted a mock-disaster exercise for a large credit union in the southeast U.S. in which everything went like clockwork. Read on to learn some of the lessons of one of the most satisfying and productive exercises MHA has been involved in for some time.
Related: Overdoing It: People Who Overplan
Their Mock Disaster Exercises
Business continuity consultants are like coaches: We give the best advice we can, but the final results depend on our clients. Recently, we were privileged to conduct an exercise with a long-time client whose team absolutely nailed it.
From senior management on down, everyone involved brought their A-game. They took the scenario seriously, worked together well, and were open-minded about coming up with solutions to the problems we put before them.
The eventual result will be a playbook of validated manual workarounds that will serve their organization far into the future.
For us as their long-term partner and the designers and facilitators of the exercise, the results were deeply gratifying.
Here's how it all went down.
Every exercise starts with a scenario, and the best ones are custom-tailored to the organization.
In this case we intentionally set out to make these folks sweat. We decided to hit this client—a leading credit union with some 40 branches in its home region and customers nationwide—with an extended outage of their core banking system caused by a cyberattack.
To make things even more interesting, we set the outage in early December, right before Christmas, when the customers’ need to access their money would be at its highest.
The exercise was six hours long but covered a simulated four-week period, with each phase presenting new information and challenges.
Significantly, the exercise took place in person: everyone involved was in the same room, so—some 40 people from the credit union plus myself, the exercise’s designer and facilitator.
Represented were senior leadership, the crisis team, the BC office, IT, and the members of business departments ranging from HR and communications to digital banking, retail banking, collections, and lending.
We also gave special thought to the room layout. Senior leadership and the BC and crisis teams were up front. Most of the participants sat at round tables with other members of their department. The core business units were toward the front. Supporting units were in the back. Smack in the middle, we put IT, since they need to talk to everyone, and everyone needs to talk to them.
The participants didn’t know the contours of the scenario ahead of time. We hit them with twist after twist, and they had to work together within and across teams to come up with solutions.
The goal was to get the participants to think creatively about how they could continue serving their members in the absence of normal technology. How could customers check their balances and access their money? How could the credit union run payroll, send wire transfers, and provide other essential services? How could they resume normal operations once their systems were restored?
Each team was required to complete detailed incident action plans documenting the solutions they hit on as the exercise progressed. The solutions hit upon included using Excel for certain tasks, creating banking ledgers, and turning to partner banks.
At this point, it won’t exactly come as a spoiler if I say the exercise was a great success.
All credit to the client’s extremely capable team. Their commitment, focus, collaboration, and creativity were exceptional. So was their success in coming up with solutions to keep their operations going.
As their long-term continuity coach and the facilitator of the exercise, I could not have been more proud of their performance or gratified by the outcome.
We’re still working on converting the workarounds they documented on their action plans into a playbook to support them in future events. I already know from watching them work and reading the action plans that the contents of the playbook will be very solid and highly actionable.
So what was unique about this exercise that made it so successful? I’ve already mentioned a few of the things that contributed to the positive results, but let’s break it down, item by item:
From the top down, leadership made it clear that this exercise mattered. They put their money where their mouth was by bringing in the most important people at the organization for six solid hours. Management’s commitment set the tone and ensured everyone treated it as a priority.
Every participant brought focus and energy. They treated the scenario as if it were real, which made the exercise realistic and productive. At the end, many participants told me they had experienced high levels of stress while trying to figure out how they were going to accomplish tasks without their usual technology. That’s commitment, and commitment pays.
In previous exercises with the same organization, I had noticed a tendency for people to shoot down unconventional suggestions. Unfortunately, this tendency is prevalent at most companies. This time around the participants were unusually open-minded. I was glad to see it. Being flexible and creative is the best way to come up with good workarounds.
Having everyone in the same room made a huge difference. The energy, collaboration, and quality of discussion were far better than in virtual exercises. I often tell clients, “Once an event reaches a certain level of seriousness, you’ll be much better off if you can bring everyone together physically.” The ability of the participants in this exercise to easily circulate and consult each other was key to its success.
The arrangement of the room contributed significantly to the positive results. The leaders’ position up front enabled them to easily manage and monitor the team’s work. IT’s place in the center facilitated communication between them and the business units, a key dynamic in every recovery—and one that is usually less than optimal.
Many exercises stop short of recovery, but this group planned all the way to reopening—how to bring systems back, handle angry members, and resume normal hours. It’s common for companies to underestimate the difficulties of resuming normal operations. By tackling that in the exercise, the credit union developed insights and procedures that will be invaluable if and when they have to come back online after a real event.
Each team’s handwritten incident action plans captured their real-time thinking. The teams continuously updated these as the exercise unfolded. We declined people’s offers to take their plans away and type them up, knowing from experience that if they did we might never see them again. The action plans—and the workarounds they document—will eventually form the foundation of the credit union’s extended technology outage playbook.
The final output will be a book of workarounds that the company can turn to if and when it experiences an extended technology outage of its core banking systems. These workarounds, which will be drawn from the incident action plans prepared by the various teams, will explain how to perform key processes manually. Before being incorporated in the playbook, each workaround will be carefully refined and validated.
A big part of this exercise’s success came down to its design. It wasn’t a canned, one-size-fits-all scenario such as AI might generate. It was built specifically around the credit union’s systems, vulnerabilities, and culture. We tailored the challenges to hit real pain points and test real capabilities. Adding stressors like a pre-Christmas outage and periodic “resets” (“It’s now Week 3—systems are coming back up, what’s next?”) kept the team on its toes.
As this exercise’s facilitator, I was tempted to leave this one off of the list, but doing so would be a disservice. Good facilitation contributed to the exercise’s success. What does that involve? For starters, setting the tone, telling the story, and guiding the participants through the scenario. A good facilitator alternately addresses the entire group and circulates through the room. Good facilitators need storytelling ability, deep BC knowledge, knowledge of common exercise stumbling blocks, and strong leadership and coaching skills. Any organization that wishes to replicate the success of the credit union’s exercise would be well-advised to give serious thought to its choice of facilitator.
When you put all these elements together—management commitment, engaged participants, a tailored scenario, a well-designed environment, and the rest—you get what every BC consultant hopes for: an exercise where everything clicks.
The credit union’s outstanding performance in this exercise was no accident. It reflected years of steady investment in business continuity, a culture that values preparedness, and a leadership team that understands the importance of practicing for adversity before it strikes.
For us, it was deeply gratifying to see a long-time client demonstrate such mastery under pressure. Exercises like this remind us why we do this work: to help organizations protect their people, serve their customers, and keep moving forward no matter what comes their way.
If you’d like help designing or facilitating a business continuity exercise that gets real engagement and produces actionable results, contact MHA today. We’d love to work with your team to make sure your next exercise is as productive and satisfying as the one described here.
Further Reading