Most credible corporate TTX practice traces back to FEMA's Homeland Security Exercise and Evaluation Program (HSEEP) — the same doctrine the National Guard and many DoD-adjacent organizations use. HSEEP provides a set of guiding principles for exercise and evaluation programs, as well as a common approach to program management, design, conduct, evaluation, and improvement planning. The cycle is essentially the Army's plan–prepare–execute–assess loop with civilian terminology.
Translation for WOF: don't start with a full-scale. Run a seminar or workshop first so the executive team has shared vocabulary and a shared understanding of existing crisis playbooks before stress-testing them.
Everything else flows from this. Establish specific goals for the exercise, such as testing communication protocols or decision-making processes. Bad TTXs start with a cool scenario and reverse-engineer objectives. Good ones start with "what capability are we testing?"
Examples of executive-level objectives:
The most successful tabletop scenarios are those business leaders and stakeholders find relatable and realistic. Pick threats actually plausible for a Catholic media apostolate — reputational crisis around a public figure, donor data breach, sudden loss of a key principal, a viral content controversy, IRS/nonprofit compliance event — not generic Hollywood scenarios.
The Master Scenario Events List (MSEL) is the single most important design document and maps directly to CPX experience. The MSEL is a chronological timeline of expected actions and scripted events injected into exercise play by facilitators/controllers to generate or prompt player activity. It ensures necessary events happen so all exercise objectives can be met.
Information push, no action requested.
Request for Information.
Request for Assistance.
Held in reserve, deployed when players drift or stall.
Begin and end each inject with "This is an exercise" or "Exercise, Exercise, Exercise" — this is doctrine you'll already recognize. Same purpose as in live-fire: prevents real-world contamination.
Create segments that form logical, progressive phases (initial event recognition → initial actions → progressive analysis). The moderator tracks expected vs. actual behaviors at each phase for the post-exercise review.
Standard structure: T+0 (incident) → T+1 hour → T+24 hours → T+72 hours / one week. Each phase gets its own injects and decision points.
This is where most internal exercises fail. Executives talk in circles, defer to the CEO, or treat it as an academic discussion.
The facilitator's job is to keep the discussion focused and inject pressure when the room gets comfortable. For example: "You've been discussing options for fifteen minutes. The executive is asking for a decision now. What do you tell them?" A weak facilitator lets the team talk in circles. A strong one forces decisions, calls out deferral, and doesn't let the group bury hard questions under more information. This is the single most important facilitator skill — and it's exactly the muscle you built running CPXs.
Threats don't announce themselves with perfect clarity. Intelligence comes in fragments, initial reports conflict with later ones, and pressure to decide builds before the picture is complete. Effective scenarios build in that ambiguity and time compression. Give incomplete or conflicting information on purpose. Give one inject only to the COO and watch whether they share it.
At every step, ask probing questions and encourage participants to challenge each other. The goal is to review best practices, roles and responsibilities, areas for potential improvement, and new ideas that can be incorporated into response plans. The facilitator is a referee, not a teacher.
A technical TTX is typically 2–2.5 hours; an executive TTX is optimally 90 minutes. Senior people will mentally check out past 90 minutes unless the scenario is gripping. For a group of ~10 execs, plan two 90-minute sessions over a half-day rather than one 4-hour marathon.
Executive/C-suite tabletops should be performed in person to push for collaboration and relationship building. The non-verbal dynamics and side conversations are part of the value.
The CEO will distort the exercise if not actively managed. The whole team will defer. Two countermeasures:
This is straight Army, and you'll be in your wheelhouse.
Hot wash (immediately after exercise): a brief group discussion. It compiles the initial impressions and observations of players and controllers, identifying the key issues and findings that emerged.
After-Action Report (AAR): developed from hot wash notes plus controller observations, with prioritized improvement recommendations. The corporate world calls this an AAR/IP (Improvement Plan).
A tabletop exercise should never be a one-time event. Threats evolve and organizations change. Regularly revising your crisis scenarios keeps you prepared for changing threats. Personnel changes mean new team members need the chance to familiarize themselves.
A mature approach mirrors the Army training calendar: an annual hazard/risk assessment drives a multi-year exercise plan, with scenarios rotating across the major risk categories and increasing in complexity year over year.
JetBlue's approach is a useful model: "We conduct an annual hazard risk survey sent to directors-and-above and the crisis management team. In that survey we list 40 different crisis events that could happen to the company and allow them to score it by impact to life, business, and facility, and tell us how ready they feel. Once we get the results we score in priority order, and then that helps us guide what type of tabletops we should be running."
The participant group is roughly 10 people: Stephen Grunow (CEO) + 8 direct reports (Rozann Lee, John Barron, Sean Lee, Wes Murrell, Devin Dailey, Brandon Vogt, Jon Bator, Sean Davis, Matthew Petrusek) + Lucas Sykes (HR). Fits cleanly within the optimal exec TTX size.