Practice Areas

FAQ

Click any link below to jump to that question's answer.

  1. What is the difference between the CMT and BCT or DRT?
  2. Aren't they the same?
  3. How many people are required in total?
  4. I understand there are 6-8 role players who represent stakeholders (neighbours, customers etc) but how many people does the client need to have in their CMT and BCT/DRT for the exercise?
  5. Some companies may not even have a formal CMT or BCT/DRT?
  6. What happens in this case from the perspective of how the exercise works?
  7. Are high level managers involved to represent these parties?
  8. How long do projects last?
  9. Why should we use Truscott?
  10. Should the exercise scenario be kept close-hold?
  11. How long should an exercise be?
  12. How frequently should exercises take place?
  13. Does out-of-hours add any benefit?
  14. Does the Management Team need to be physically together?
  15. How do you test deputies and alternates?
  16. What is the benefit of live IT and ER drills?
  17. What are the benefits of desktops without role play?
  18. What is the value of a multilevel exercise compared with a single level exercise?
  19. How do you select Role Players?
  20. Should we involve 3rd parties or regulators?
  21. What is the output of a crisis exercise?
  22. What is the output of a Business Continuity exercise?
  23. How often should we physically go to a Recovery Site?
  24. How do you test governance?
  25. How often should the Board be involved?
  26. How do you measure performance?
  27. What is the best use of observers?
  28. Should exercises always end with success?
What is the difference between the CMT and BCT or DRT?
The Crisis Management Team (CMT) normally consists of the executive leadership. It is one step down from the Board, but one step up from Front Line management. Many companies have global CMT in addition to geographic country CMT or sometimes even Business Unit CMT. Many companies have a DRT with a solely IT recovery focus. These teams consist of front line managers. Many other companies take a far more holistic approach to BC and have contingency plans in place for a whole range of business interruptions outside IT. Product recalls or hostile takeovers or oil spills are some examples of triggers that require tailored BCT.
Aren't they the same?
Hardly ever.
How many people are required in total?
The company simply follows whatever plans it has in place. It depends whether the exercise is confined to one geographic locality or if multi-levels are to be practiced. It depends whether it is just an IT focus, or a much larger scenario.
I understand there are 6-8 role players who represent stakeholders (neighbours, customers etc) but how many people does the client need to have in their CMT and BCT/DRT for the exercise?

The numbers vary. In smaller exercise only 3-4 role players may be needed. Larger exercise may require 6-8 role players.

The CMT can be of any size. We comply with the plan. All of the best companies, certainly multi-nationals and publicly listed companies have detailed crisis plans.

The BCT and/or DRT can also be of any size. Again we comply with the plan. However there is no point testing a plan if they do not have one.

Exercises are about engendering success and not proving failure. At worse in raising issues and not always solving them.

Some companies may not even have a formal CMT or BCT/DRT?
In this instance, we have to write a plan first. This can take 3, 5, 7 or more days, depending upon the complexity of the task.
What happens in this case from the perspective of how the exercise works?
We have occasionally conducted exercises in the absence of a solid plan, in order to build an expedient capability. While plans are hardly ever looked at in true crisis simulations (the telephone directory is all important) they are needed to satisfy Corporate Governance as last-resort risk treatments. BC arrangements of course are now becoming subject to regulatory audit in the financial sector. Some Stock Exchanges will not allow new listing without Risk Management frameworks in place of which Crisis Plans are an element.
Are high level managers involved to represent these parties?
The CMT is the CEO/MD/GM and their immediate reports who have a focus on developing Business Continuity, financial and legal liability and reputation strategy. The BCT/DRT are tailored teams with the requisite skill sets to save life, protect property (including information) and minimize damage to the environment. The skills sets will vary according to their focus.
How long do projects last?

Plan writing projects maybe anything from 3-5-7-10 consultant-days.

Workshops are short duration 1-2 day tasks depending on the needs to train Support Teams.

Simulations are a one day task for 2-3 Crisis Practitioners depending upon complexity and geographical spread.

Workshops and exercises are best done back to back.

Why should we use Truscott?
You would use us if you do not have a Crisis Management plan or a Business Continuity plan at the corporate or Business Unit level, or if you need assistance to practise your plan, or simply to benchmark against best practices.
Should the exercise scenario be kept close-hold?
Wherever possible, yes. In the lead up to the exercise we create the scenario in conjunction with the company representative, usually virtually. While the date of the activity is normally promulgated to the participants in advance, the scenario and related matters are kept close hold to the planners with the Chief Executive making the decision to be briefed or not.
How long should an exercise be?
The duration depends on the number of levels being exercised but typically 2-3 hours enables most objectives to be met. A single layer emergency or crisis exercise can take between 2 to 5 hours including the hot debrief which may take from 30-60 minutes. Multi-layered exercises with several levels and locations will take from 3 to 5 hours including a virtual hot debrief. This timing may be adjusted if the exercise components are linked but staggered.
How frequently should exercises take place?
A 6-9 monthly interval allows a Management Team to maintain a core of experienced team members. Most companies with a mature CEM philosophy may benchmark and practice their capabilities for CM, and/or multilayer CEM within each 12 -18 month period. For EM the frequency will more often be set within 6-9 months while Emergency Response may be drilled as often as weekly depending on contingency plans.
Does out-of-hours add any benefit?
Yes as it generally means responding with limited resources. It also provides a more challenging environment for First Responders to operate and it can provide valuable learnings with regard to reaction times at night. Once a company has been able to practice its CEM plans to a reasonable level including deputies, out-of-hours training is another logical progression of capability. Without that depth of training experience however out-of-hours exercises can prove counter-productive to a constructive learning experience.
Does the Management Team need to be physically together?
Not necessarily at the CMT level but generally yes at EMT level. It is useful to have a small element of the CMT physically assembled but key members can contribute equally effectively by teleconference or video link. If the majority of designated team members are newly allocated or if the team generally is unpracticed, the Management Team should schedule exercises in the initial part of the cycle ensuring they work together. As the cycle and the team itself becomes well practiced, Management Teams will practice managing crises in part or full virtual mode, utilizing and testing real communications and procedures available to the company; that is, a more accurate reflection of real situations.
How do you test deputies and alternates?
Rotate your team members through the regular exercise program and also use deputies and alternates as role-players. The best companies do this as a matter of course as an integral part of their training style and regard such as an important part of leadership training-in-depth. Frequently in exercise simulations primary team members will be utilized in the important role of Role Players allowing the deputies/alternates to exercise their skills and leadership attributes
What is the benefit of live IT and ER drills?
They ensure that actual resources are thoroughly checked and tested. It is long proven that people perform as they train. Learning is engraved into the skills base of the participants through experience and leverage is gained through the opportunity for the coordinated participation of external resources such as Emergency Services and other allied providers, departments or contractors.
What are the benefits of desktops without role play?
They can allow a team to practice its operational rhythm and internal dynamics without being responsive to external pressures. When a company takes a strategic view of the building of competent CEM teams desktops become important in the early stages to build the foundations of procedures and even introduce leadership, integrity and ethics to bond and empower the team members. In teams who are practiced and experienced, efficient practice through comprehensive and innovative desktops will help to keep them mentally ready.
What is the value of a multilevel exercise compared with a single level exercise?
Multi-level exercises have the benefit of testing inter-team communications in real time and they can also be used to demonstrate the existence and effectiveness of the complete CEM system to all staff. They should not be overused though as single level exercises are often a more effective way of ensuring that specific teams are accurately targeted with key objectives. The most comprehensive value of multilayer exercises is that the reciprocal communications procedures and responsibilities between layers are illuminated for practice, building and testing. It will be seen that multi-layer exercises will be most useful when each of the participating layers are already practiced in their own layer.
How do you select Role Players?
Role-players should be selected from deputies or alternates where possible. Ideally they should be senior managers who have a thorough understanding of the company's operations and business methods. Role Players in simulation exercises are the engine room. Therefore it is very important to have an adequate number of senior company personnel who have an understanding of the company operations and all relevant stakeholders as Role Players. Companies with mature CEM procedures will often exercise the deputies/alternates on the Management Teams utilizing the primary members as Role Players to power the exercise.
Should we involve 3rd parties or regulators?
Yes if possible as this is a positive way of demonstrating that your company is taking CEM preparedness seriously. There are some operational and/or verification situations for some companies where 3rd parties such as JVP, contractors and regulators may be invited to participate in exercise simulations as observers.
What is the output of a crisis exercise?
It is the demonstrated ability to regain control of business and identify a clear strategy for taking the organization into the future. Importantly at an operational level, a well conducted exercise will effect a powerful bonding within the team members and the company at large as well as further building and defining of leadership qualities.
What is the output of a Business Continuity exercise?
A properly conducted exercise will confirm or establish early warning systems to overcome business interruptions and minimize loss. It can further identify and confirm alternate sites of operation, identify key processes, personnel and assets crucial to survival.
How often should we physically go to a Recovery Site?
Primary and alternate members of the team designated to handle BC issues should be personally familiar with all Recovery Sites, and indeed if possible should physically incorporate the sites into advanced simulation exercises. Visits to sites should be included into the BC induction of those team members. If there are any changes to the Recovery Site all team members must physically refamiliarize themselves and schedule another practical exercise at the soonest opportunity.
How do you test governance?
Corporate Governance can be framed by the ethos and commercial philosophy of the company, by legal stipulations from relevant government regulators and by the accepted social and commercial mores of the society in which the company is operating. All of these parameters can be well tested by exercise scenarios posing dilemmas at various levels of difficulty.
How often should the Board be involved?
It is useful to have some involvement of the Board whenever the CMT is exercised. This may simply be in a reporting capacity but it will ensure that communications are tested and that Board responsibilities are recognized.
How do you measure performance?
This is achieved through benchmarking against similar organizations or against predetermined training objectives. While the usual aim for desktop and simulation exercises is to build management capability and confidence, performance can be and often is measured across personnel and procedures.
What is the best use of observers?
Where possible observers should be positioned with each of the participating teams. They should be capable of facilitating and guiding where necessary to ensure that the exercise and team outcomes are achieved. Observers will be positioned for staff induction or hand over purposes or to overtly measure performance. In the latter case, the observer will necessarily be an experienced manager, at times even a team leader or a higher level manager.
Should exercises always end with success?
Yes but note that success can be defined in many ways. Typically a successful exercise is one in which the teams have demonstrated the ability to regain control and begin to plan for the future. While the usual successful outcome for a simulation exercise activity is one of building corporate management capability and confidence, it will often come through the sometimes uncomfortable process of exposing vulnerabilities and deficiencies in accepted procedures and at times even staff.

site design by scott young
valid xhtml 1.0 strict | designed for internet explorer 6/7, opera and firefox