Exercises for Incident Teams

An incident team exercise rehearses the people who will actually manage a disruption: those who assess impact, coordinate the response, communicate with customers, liaise with suppliers, and record decisions. The test is coordination under pressure, not individual competence in isolation. A team can contain capable individuals and still fail if roles are unclear, if handovers lose information, or if decisions are made but never recorded. An exercise should therefore create pressure, incomplete information, and competing demands, and should observe how the team organises itself rather than how well it discusses a scenario. The debrief should focus on the team as a system, including its tools, its rotas, and its habits.

Roles are tested by giving each role a task that only that role can complete, and by removing or overloading a role to see how the team adapts. A coordinator who also tries to solve a technical problem may lose track of the overall picture. A communications lead who waits for perfect information may leave customers uninformed. A supplier liaison who has no contact route may delay a critical update. Consider an incident team for a payments service facing a data integrity problem. The exercise should force a division of labour: one person owns impact assessment, another owns supplier contact, another owns customer messaging, and another owns the decision log. If those boundaries blur, the exercise has revealed a real weakness, even if the scenario itself is eventually resolved.

Handovers matter because disruptions often last longer than a single shift, and because key people may become unavailable. A handover that passes on a list of actions without passing on reasoning, uncertainty and pending decisions leaves the incoming team to rediscover the incident. An exercise should include at least one handover, with the incoming team asked to state the current position, the decisions already made, and the next decisions required, without help from the outgoing team. That test is often revealing. Teams that keep a clear decision log hand over well; teams that rely on memory or chat messages hand over poorly. The exercise should therefore treat the log as a tool to be tested, not as paperwork to be completed afterwards.

A decision log should capture what was decided, who decided it, when, on what information, and what alternatives were considered. It should also capture decisions not to act, since inaction can be as consequential as action. During an exercise, the log should be kept in real time, using whatever tool would be used in a real incident, including a fallback if the normal tool is unavailable. Observers can check whether the log matches what actually happened, and whether a reader who was not present could reconstruct the incident from it. A log that is written up neatly after the exercise may look impressive, but it does not prove that the team could record decisions while under pressure, which is when the log matters most.

Fatigue and incomplete teams are realistic conditions that exercises often avoid. A team may need to operate with a member absent, with a second incident competing for attention, or after a long period of sustained work. An exercise can simulate those conditions by removing a participant, by introducing a second problem, or by extending the scenario across a handover. The point is not to exhaust participants, but to reveal whether procedures survive when the ideal team is not available. If a procedure only works when a particular person is present, it is not a procedure; it is a dependency on that person. Exercises that test for that dependency, kindly but firmly, help the firm build cover, cross training, and simpler procedures that survive absence.

Incident team exercises commonly fail when they test the scenario rather than the team. A scenario that is resolved by a technical fix, without requiring coordination, will not reveal role confusion. An exercise in which the facilitator answers questions that the team should answer itself will not reveal information gaps. An exercise with no observer will produce a debrief based on memory rather than evidence. The remedy is to design the exercise around team behaviour: require a decision log, require a handover, require customer and supplier messages, and observe each one. When those behaviours are tested, the findings are concrete, and the improvements that follow, such as clearer roles or a better log template, are concrete too.