Reputation teams usually find out whether their crisis plan works in the middle of a real crisis, which is the worst time to learn that the legal reviewer is on holiday and nobody has the password to the brand’s X account. Tabletop exercises for reputation teams fix this. They are structured crisis drills where people walk through a simulated incident around a table or on a video call and make decisions under realistic time pressure. This article covers how to design one, how to run it in 2-3 hours, which mistakes make drills useless, and how to turn what you learn into a better response.
Why Crisis Drills Pay Off Before the Real Incident
A written crisis plan is only a guess about how people will behave. A drill tests that guess. Teams that run 2-4 tabletop exercises a year typically cut their first public response time from 6-8 hours to under 90 minutes. They don’t type faster. They just stop arguing about who signs off.
Drills also expose gaps that a document review never will. Common examples are an escalation path that depends on one person’s mobile number, a holding statement template nobody can find in SharePoint, or a social media manager who doesn’t know whether they’re allowed to post without legal approval.
The format is borrowed from emergency management. FEMA’s Homeland Security Exercise and Evaluation Program (HSEEP) and NIST SP 800-84 both describe tabletop exercises as discussion-based drills. Reputation teams can use the same structure without the government paperwork.
Designing a Tabletop Exercise for Reputation Teams
An experienced communications lead starts with one question: which scenario would hurt us most in the next 12 months? That’s the question to drill, not the most dramatic one. For a SaaS company, the answer might be a data exposure that surfaces on Reddit before the security team confirms it. For a restaurant group, it could be a food safety video spreading on TikTok. For a B2B manufacturer, it’s often a negative trade press article that picks up a former employee’s Glassdoor claims.
A workable scenario has a starting trigger, three to five “injects” (new pieces of information released during the exercise), and a clear end point. Injects should escalate. A typical sequence starts with a single angry post at 0:00, a journalist emails for comment at 0:20, a competitor’s sales team shares the story at 0:45, and a spoofed email using your domain starts circulating to customers at 1:10.
That last inject matters. Many reputation crises now combine a communications problem with a technical one, like phishing campaigns that exploit the news or a typosquatted domain posing as your “official statement” page. A drill that ignores the technical side won’t prepare the team for the incidents that actually happen.
Running the Drill Step by Step
The session itself works best with a fixed structure:
1. Brief (15 minutes): The facilitator explains the rules. This is a no-fault exercise, decisions happen in real time, and “I’d check with legal” only counts if legal is in the room.
2. Initial trigger (20 minutes): The team decides whether this is a crisis, who owns it, and what happens in the first hour.
3. Injects (60-80 minutes): The facilitator releases new information on a timer. The team drafts an actual holding statement, an actual internal message, and an actual review response, not descriptions of them.
4. Hotwash (20-30 minutes): The group discusses what worked, what stalled, and where people hesitated.
5. After-action report (within 5 working days): The facilitator writes up 3-7 specific findings, each with an owner and a deadline.
The facilitator shouldn’t be a participant. If the head of communications runs the drill, nobody tests whether the team works without them. In real crises that person is often stuck in a board call for the first two hours.
Compare your drill timeline with a proven structure like the hour-by-hour crisis response guide. If the drill shows the team needs 3 hours to publish a first statement and the playbook assumes 60 minutes, then either the plan or the process has to change.
Common Mistakes That Make Crisis Drills Useless
The most common mistake is scripting a scenario the team already knows how to handle. If last year’s real incident was a wave of negative reviews and this year’s drill is also a wave of negative reviews, people will perform well and learn nothing. Pick something uncomfortable.
The second mistake is drilling only the spokesperson layer. Leaders rehearse their media lines, but nobody checks who actually detects the problem. Your monitoring setup is part of the response. If alerts go to a shared inbox that nobody reads on weekends, the drill should expose that. A good inject is “it’s Saturday, 23:40 – who sees this first?”
The third is skipping internal communication. Employees learn about the crisis from LinkedIn, then post supportive comments that make things worse. Drafting the staff message should be a required output of every drill. The principles in internal communications during a reputation crisis make a useful checklist for scoring it.
The Myth That Drills Are Only for Large Companies
A persistent misconception is that tabletop exercises need a dedicated crisis team, an outside consultant, and a full day. They don’t. A team of four can run a meaningful 90-minute drill with a shared document, a timer, and a facilitator who has prepared five injects in advance.
Small teams arguably need drills more. With 5-10 people, one absence can stop the whole response. Running the exercise with a key person deliberately “unavailable” is the fastest way to find single points of failure.
Some cases need a different approach. Regulated industries such as healthcare, financial services and legal services need compliance and privacy counsel in every drill, because statements may trigger disclosure obligations under GDPR’s 72-hour breach notification rule or sector-specific rules. Companies in non-English markets should run injects in the local language, since translation delays are a real bottleneck. Franchise and multi-location brands should include at least one local manager, because local staff often respond on Google reviews before headquarters knows anything is wrong.
Turning Findings Into Lasting Improvements
A drill without follow-up is just theatre. The after-action report should lead to concrete changes, such as an updated escalation contact sheet, pre-approved holding statements stored where everyone can reach them, admin access to every social account held by at least two people, and alert routing that reaches someone 24/7.
Use the drill results to shape team structure, too. If the same two people made every decision, the team is too dependent on them. Guidance on building an internal crisis response team helps you assign backup roles. Schedule the next drill before you leave the room. Teams that wait for a “good time” usually never run a second one.
FAQ
How often should a reputation team run tabletop exercises?
Two to four times a year works for most organizations. Run an extra drill after major changes, such as a new spokesperson, a product launch, a merger, or a significant turnover in the communications team.
Who should participate in a crisis drill?
Include communications, social media, customer service, legal or compliance, and at least one senior decision-maker. Add IT or security whenever the scenario involves email spoofing, phishing or website compromise. Keep the group to 6-12 people so everyone contributes.
Should drills ever be unannounced?
Experienced teams can benefit from a short unannounced drill once a year, for example a 30-minute after-hours alert test. For teams running their first exercises, announce them in advance so people focus on learning rather than feeling ambushed.
Summary: Practice the Response Before You Need It
Crisis drills show the gap between the plan on paper and how the team actually behaves under pressure. Choose the scenario that would hurt your brand most, escalate it with timed injects, make people produce real outputs, and turn every finding into a named owner and a deadline. Start small with 90 minutes, four people, and five injects. A modest drill run this quarter is worth more than an elaborate one planned for next year.