Simulating Complex Crisis Response: Key Learnings for the Board

Operating in an environment of relentless “permacrisis” has boards and management teams focused on building resilience and seeking advantage amid the volatility. One practice that serves executives and directors alike in this regard is conducting crisis response tabletop exercises.

To help directors experience firsthand the value of these exercises, the EY Center for Board Matters ran an interactive workshop at the recent NACD Summit. Directors had the chance to step into the shoes of a board and senior management team as they responded to a series of significant, company-shaking events. I took part in the experience myself, teaming up with fellow directors to navigate the board’s role in complex crisis response.

I came away from this experience with practical takeaways for overseeing crisis management and building resiliency in today’s risk environment. I also learned some leading practices for crisis simulations to help directors and executives maximize the value of these exercises.

Crisis Simulation Leading Practices

Tabletop exercises are an excellent way to build organizational muscle that enables better crisis response. These exercises help management and boards test various protocols and response plans, allowing them to see how the company reacts under stress. Leading practices that companies can follow to optimize these exercises include the following:

• Don’t let crisis simulations become routine. Throw in some curveballs. While traditional tabletop exercises may focus on one scenario, usually a cyber breach, crises today are more rapid and interconnected. They rarely revolve around one issue. Our workshop had directors navigate multiple, simultaneous crisis events. Whether it’s a company incident going viral with negative impacts while an activist demands board seats or war breaking out, requiring the rerouting of global supply chains when a CEO is incapacitated, these types of simulations bring the complexity up a notch with multiple injects.
• Make it feel real. Create a level of tension that would exist in a real crisis by not notifying leaders of the exercise what’s coming. Simulate crisis events that are realistic threats based on the actual risks in the company’s value chain. Management should practice its response to how some of the biggest potential threats on the horizon—the “gray rhino” risks—may actually play out to road test current plans and organizational capabilities.
• Talk things through and work as a team to achieve the best collective thinking. This is a brainstorming exercise. It’s best to think out loud to spur others’ ideas, push the discussion forward and reach better answers collectively. As one director in our workshop aptly put it, “Working together as a team, we are more effective than we are as individuals: 1 + 1 = 3.”
• Incorporate lessons learned into the crisis response plan and relevant policies. An effective tabletop exercise may expose governance gaps that need to be closed or show where advance preparation needs to take place (e.g., the need to develop a robust emergency CEO succession plan or clarify the information escalation chain). Don’t let these important lessons go to waste.

Three Takeaways for Overseeing Crisis Management

My fellow directors and I came away from the workshop with tactical tips for board governance through crisis. These were most valuable for me:

1. Ask how management has identified and readied both the internal team and external advisors that will guide the company.  Allocating internal leaders to handle specific kinds of crises allows them to build the knowledge they’ll need and to be prepared to move quickly. But just looking internally is not sufficient as the list of external advisors that the company may need to tap into is a long one, covering all aspects of a crisis including: legal, regulatory, public relations, communications, and cyber forensics. These advisors should be vetted and engaged in advance. As one of my EY colleagues likes to say, “You don’t want to be exchanging business cards in a crisis.”
2. Learn whether decisions that can be preempted have been tackled in advance. For example, drafting press releases and public statements that address different scenarios, determining policies around paying ransomware, emergency CEO succession planning, making some advance decisions, and doing prework where possible can position the company for more agility and time while a crisis unfolds.
3. Ask about crisis simulation exercises and how management is incorporating key learnings into its response planning. Just as a company would do a postmortem to reflect on lessons learned from an actual crisis, tabletop exercises should be mined for opportunities to re-evaluate policies, close governance gaps, and strengthen communication protocols. Management reports to the board on the kinds of scenarios being tested and the key learnings being integrated into response plans can reinforce incremental improvement. 

Lessons in crisis management and governance are ones we are all continuing to learn and relearn in a world of ongoing volatility and dynamic, multidimensional risks. Thankfully, complex crisis simulations are an energizing, productive, and even fun way to help boards and management teams prepare for inevitable crises and build the resilience they need.

EY is an NACD partner, providing directors with critical and timely information, and perspectives. EY is a financial supporter of the NACD.

The views reflected in this article are the views of the author and do not necessarily reflect the views of the global EY organization or its member firms.