Exercise Program That Never Finds Anything
A mid-size hospital network has run the same tabletop exercise for three consecutive years. Each year, 22 participants from facilities, IT, and nursing walk through a 'loss of primary data center' scenario, score 92-96% on the post-exercise survey, and the after-action report lists only minor action items (update call trees, refresh contact lists). The continuity manager is proud of the consistently high scores. Meanwhile, a real 5-hour outage of the electronic medication administration system six months ago exposed that the downtime procedure required a printed formulary that had not been updated in two years, and that night-shift nurses had never been trained on the procedure at all. The exercise had never surfaced either issue because the scenario always assumed daytime staffing and never touched the medication system. The board asks why the exercise program did not predict the failure.
1. Diagnose why the exercise program failed to surface the real weaknesses, and prescribe concrete changes.
Read the worked answer
Diagnosis: The program optimized for smooth execution rather than for discovery.
- Scenario stagnation: Repeating one scenario for three years tests the same assumptions and produces diminishing returns. It never exercised the medication system, the actual failure mode that occurred.
- Favorable conditions baked in: Daytime staffing, familiar participants, and a data-center scenario excluded the night shift, the printed-formulary dependency, and system-specific downtime procedures.
- Metrics reward the wrong thing: High satisfaction scores and short action lists signal a comfortable exercise, not a rigorous one. A mature program expects to find uncomfortable gaps.
- No linkage to real incidents: The 5-hour outage was not fed back into scenario design.
Prescribed changes:
- Rotate scenarios annually and include at least one derived from a real incident or near-miss.
- Vary conditions deliberately: off-hours, reduced staffing, key-person absent, degraded (not total) loss.
- Add system-specific functional/downtime drills (e.g., medication administration downtime procedure) with actual frontline staff, including night shift.
- Replace satisfaction surveys with objective capability measures (time to execute downtime procedure, error count, formulary currency check).
- Require a minimum number of substantive findings and track action-item closure to completion, reporting closure rates to the board.
2. How should the continuity manager report this to the board without undermining confidence in the program?
Read the worked answer
Frame it as program maturation and honest assurance, not confession.
- State what the program did and did not do. The tabletop validated coordination and call-tree mechanics; it was not designed to test system-specific downtime procedures or off-hours execution. That scope gap is now identified.
- Show the corrective loop closing. The real outage is being used as a scenario input; the formulary and night-shift training gaps are logged with owners and dates; exercise metrics are being changed to capability-based measures.
- Distinguish assurance levels. Be explicit that tabletop exercises provide discussion-based assurance, while functional drills provide demonstrated capability. The board should know which level each control has reached.
- Report residual risk transparently. Name the gaps not yet closed and the interim mitigations, with a date for re-test.
This preserves credibility because it demonstrates the program detects and corrects its own blind spots - the core purpose of exercise and maintenance.