CBCI study materials
CBCI study resources

CBCI (Other exams): The Exercise That Passed and Proved Nothing

CBCI · Put your knowledge to work in context.

All case studies

The Exercise That Passed and Proved Nothing

A logistics company runs an annual exercise program. Last year's exercise was a 90-minute walkthrough of the crisis communication plan in a conference room. It was rated 'successful' because all 14 attendees signed the attendance sheet and the call tree was read aloud. This year, the new BC manager wants to raise the maturity. The company has 2,400 staff across 6 sites, a 24/7 operations center, and a crisis management team of 9 executives. The last real incident - a warehouse fire - revealed that the crisis team took 5 hours to convene, the call tree had three outdated numbers, and no one knew who was authorized to talk to the media. The board has asked for 'a proper test' this year and wants evidence it was meaningful.

1. Design an exercise program that would actually surface the failures seen in the warehouse fire.

Read the worked answer

The prior exercise tested attendance, not capability. The design must create conditions where the real failure modes - slow convening, stale contacts, unclear authority - are forced to appear.

Design principles:

  1. Test the objective, not the document. The objective is 'crisis team convenes and communicates within 60 minutes.' The exercise must measure that, with a clock.
  2. No-notice or short-notice activation. A scheduled walkthrough cannot test convening speed. Use an unannounced or minimally announced activation of the call tree and measure time-to-convene.
  3. Inject the known failure modes. Include a media inquiry inject within the first 30 minutes to test who responds and under what authority.
  4. Use real systems. Call real numbers, use the real communication platform, use the real contact database - not a printed list.
  5. Multi-site and multi-level. Include site-level responders and the executive team so handoffs are tested.

Program structure (progressive):

  • Q1: Call tree and contact data validation (desk check) - verify every number and escalation path.
  • Q2: Functional exercise of the crisis team with a 60-minute convening target and media injects.
  • Q3: Full-scale simulation with site involvement and a simulated 24-hour incident.
  • Q4: Lessons-learned review and corrective action tracking.

Evidence for the board: Time-to-convene, percentage of contacts reached on first attempt, time-to-first-approved-statement, number of corrective actions closed versus opened, and a before/after comparison to the warehouse fire metrics.

2. How should the BC manager handle the finding that no one knew who was authorized to speak to the media?

Read the worked answer

This is a governance and authority gap, not a training gap. Training people to 'know' an authority that has never been defined will not fix it.

Steps:

  1. Define the authority. The crisis communication plan must name roles (not individuals) authorized to speak: primary spokesperson, alternates, and the approval chain for statements. Authority must be delegated in writing.
  2. Define the boundary. Specify what can be said without approval (acknowledgment, safety reassurance) versus what requires executive sign-off (cause, liability, financial impact).
  3. Build the approval path into the plan. A statement cannot wait for a meeting. Pre-agree a rapid approval mechanism (e.g., a designated approver plus one alternate reachable within 15 minutes).
  4. Train and exercise the authority. Spokesperson media training, plus injects in the next exercise that require a statement under time pressure.
  5. Record the corrective action. Log the finding, owner, due date, and verification method. Report closure to the board.

Judgement point: The instinct is to run a communications workshop. The correct response is to fix the delegation of authority first, then train against the defined authority. Otherwise the next incident repeats the same confusion with better-informed confused people.