Board tabletop
A focused session for directors on governance, decision rights, disclosure and accountability during a crisis.
Services · Operational Resilience & Crisis Readiness
Board & Executive Tabletop Exercises
Find out how your leadership team decides under pressure, before it matters.
Arrange a meetingWhy it matters
A bank's incident response plans may look complete on paper. A well-designed exercise shows whether leaders know their roles, have the information they need and can make difficult decisions quickly. We design and facilitate realistic scenarios built around your essential services, your suppliers and your regulatory obligations.
Questions this engagement answers
- 01Who decides whether to pay, shut down a service or notify the regulator?
- 02How quickly would we know which customers are affected?
- 03What would we say publicly in the first hours, and who approves it?
- 04Can we operate if a critical supplier is unavailable?
What the engagement can include
Executive simulation
A more detailed, time-pressured exercise with injects, for the executive crisis team.
Scenario design
Plausible scenarios built from your services, threats, suppliers and recent incidents in your sector.
Plan review
Review of incident response and crisis plans before or after the exercise.
How we work
- 1
Scope
Agree objectives, participants and the services or risks the exercise should test.
- 2
Design
Build a realistic scenario with injects and decision points, without giving the answers away.
- 3
Deliver
Facilitate the session, keeping pressure realistic and discussion focused on decisions.
- 4
Debrief
Report what worked, what did not and the actions needed, with owners and timescales.
What you receive
- A tailored scenario and exercise materials
- Facilitation by an experienced crisis and cyber leader
- Post-exercise report with observations and prioritised actions
- Evidence suitable for board records and regulatory testing requirements
Illustrative scenario
A late-night ransomware call
At 23:00 the operations team reports encrypted servers and a ransom note. The exercise moves through the night: the payment platform is down, a journalist calls, a supplier cannot confirm whether its connection was the route in, and the regulator expects notification. Participants must decide what to shut down, what to say and who has authority, revealing gaps that no document review would find.
Buck's view
“The most valuable outcome of an exercise is rarely the scenario itself. It is discovering, in a safe setting, the decision nobody realised they would have to make.”
Professor Buck Rogers, Poro Advisory