Michael Gips, CPP, CSyP, Principal of Global Insights in Professional Security reveals why it might be time to table the tabletop and drop the weapon for crisis training.

A multibillion-dollar company that routinely works with hazardous materials recently conducted a crisis training tabletop exercise that ran through various scenarios, including fire response.

The participants talked through how they would respond in each case, figuratively checked those boxes and moved on.

When a real fire broke out, staff knew what to do: activate the fire suppression system. The problem was, the tabletop hadn’t called for anyone to actually physically check that system.

If it had done so, the company would have realized that the system was under lock and key. When the fire occurred, no one knew who had the key.

The incident caused major business disruption and millions of dollars of damage.

Tabletops: pros and cons

Tabletops for crisis training certainly have their place. Conducted with forethought and the right participants, they play a valuable role in creating awareness, introducing employees who may be unfamiliar with each other and promoting positive discussion.

Crisis training tabletop exercises also force organizations to focus on critical risks, test leaders’ critical thinking under stressful conditions and help to define specific roles.

However, they can only go so far. They often exclude the people most likely to deal with a crisis: front-line staff such as security officers, receptionists, janitors, parking attendants and shipping/receiving workers.

Tabletops often don’t stress-test specific elements of the plan, such as pushing a panic button to see whether it works or testing a facility’s lockdown system. They simply review existing policies, but rarely innovate. 

Tabletop crisis training can also devour large parts of the day, pulling staff away from revenue-generating operations.

The risks of scenario-based crisis training

Scenario-based crisis training, such as simulated active assailant attacks, offers verisimilitude and demands quick thinking, but may lead to staff trauma, injury or even death. It can trigger massive liability and damage corporate reputations.

Earlier this year, six employees and the parents of two children at a psychiatric children’s hospital in Michigan filed suit for trauma stemming from an unannounced active-shooter drill in December 2022.

The lawsuit alleges that the Hospital Director instructed a front-desk worker to announce the presence of an active shooter in the facility (there was none on site) and to sound frightened while doing so.

A second announcement added that the assailants were two men with AR-15s who had fired shots. According to the complaint, staff, patients and family members flew into a panic, desperately barricading doors and phoning friends and family to say goodbye.

Patients, already suffering psychiatric ailments, spiraled into despair.

Dozens of crisis trainings have gone similarly wrong in past years, in sites ranging from schools and nursing homes to hospitals and shopping centers.

Finding the sweet spot

How can organizations find the sweet spot between tabletops and realistic training scenarios, so that better response processes are in place before it is executed for real?

I spoke with Aric Mutchnick, Founder of a crisis training program called Red Ball Drills, about his approach, as well as specific findings that can help organizations of all types prepare for a crisis.

According to Mutchnick, Red Ball Drills, which has a DHS SAFETY Act designation, allows clients to conduct live crisis training exercises, on a normal workday, without any impact on operations.

Only pre-selected personnel receive a memo indicating that a Red Ball Drill is taking place. This means anyone who did not get the memo is not aware of the exercise at all. It consists of a moderator posing a scenario to a participant and having them think through the response process, which focuses on their actual physical response and following the path of communication for any incident.

The crisis training exercise typically draws in multiple participants, all who are free to pause the exercise if work demands intervene. No weapons are used, nor does the exercise generate fear.

Mutchnick has conducted hundreds of these crisis training exercises, including at the house of worship where I serve as head of the security committee. Following are several examples of key takeaways from these drills that can benefit many types of organizations.

Understand the culture

Culture can range from a continent or geographic region all the way down to a specific sub-department of an organization or floor in a facility. Mutchnick observes that many emergency management plans fail to take into account unique cultural nuances.

For example, a crisis training drill at an above-ground mine in Kenya presented 16 staff who were eating lunch nearby the mine with the following scenario: a pickup truck loaded with four men holding rifles, presumably members of Al-Shabaab, barrels past them. What should they do?

Mutchnick emphasizes that in each such exercise, participants are told that the crisis training is “a conversation, not a test.”

He makes them feel comfortable, tells them they can break off the exercise at any time for real work, states the scenario and lets them talk. The scenario is restated multiple times as the participants come up with new ideas or solutions.

One of the miners timidly offered that he would call the security command center at base camp, about a half kilometer away. His colleagues nodded in agreement.

Each had the command center number in their phone; at least one had even favorited it. When Mutchnick asked one of the men to call the the number he said he couldn’t; it wasn’t that he was afraid of getting in trouble, but rather he didn’t have minutes on his phone to make the call.

In fact, only two of the 16 miners had minutes on their phone to make a call.

“Their entire communications plan for this site was based on cellphone communications,” said Mutchnick, “yet no one could make a call.”

The first cultural lesson was to understand that much of the African population purchases time for cell use rather than having a monthly plan with a provider.

That information had never occurred to the Security Director, an expat who had lived in Africa for over ten years.

The key to such crisis training is to treat participants like the experts they are and have them contribute to, if not completely develop, solutions.

In this case, the open discussion emboldened the youngest miner to recommend that the security command center create a toll-free number. The mine immediately did so, at minimal cost. Staff hadn’t merely bought into the solution — they had created it.

Breaking down barriers

These sorts of crisis training drills often force dialogue between staff or departments that rarely communicate with one another. That’s critical, because communication is where so many plans break down.

At one major US arena, Mutchnick began the crisis training drill in the security command center during a police shift change.

On one side of the room sat a security officer monitoring video and other inputs. About 15 police officers were chatting on the other side of the room.

For the exercise, the security officer was told that he had received a report of an armed person in a specific section — what would he do? He said he would call 911.

Mutchnick looked at the police officers behind him and asked: “What about them?” The security officer did not know what he should do.

When Mutchnick drew a Police Sergeant into the drill, the Sergeant responded: “Why would we ever talk to him [the guard]?”

Eventually, the Sergeant said that the guard should notify him and his fellow police officers first, then call 911. When asked to go to the actual section where the hypothetical attacker was, the Sergeant admitted that he wasn’t sure how to get there. The security officer, on the other hand, knew instantly.

Had that been an actual active shooter, the lack of communication — the lack of any relationship — between security and law enforcement could have cost precious lives. The arena eventually formalized procedure for private security to work with police.

Who knows what?

Sometimes the problem isn’t communication, but figuring out who knows what and who has authority to carry out specific actions. A crisis training drill at the loading dock of a baseball stadium depicts this issue.

A security guard for the stadium was standing next to a contract dog handler, which was on hand to detect explosives. For the scenario, both men were told that the dog had indicated that there were explosives in a truck that had just pulled up. What now?

The guard said: “I have to get out of here.” But to where? After identifying a wall he could escape behind temporarily, the guard said he would call his supervisor in the command center.

However, he stopped himself and said he should run to the parking lot to prevent other vehicles from approaching the loading dock.

As part of the crisis training drill, the guard actually called his supervisor, who in turn called his supervisor, who then called his supervisor. They finally reached the Head of Security, who admitted that he did not know what to do either.

Soon, however, he said that he would move everyone away from the loading dock. The Security Director then realized that he had a phone number for a police officer in the EOD unit. Eventually, the stadium came up with new procedures for rules of engagement, chain of command and sealing off the area.

Clashing policies and procedures

Crises don’t play by the rules. They cross divisions, departments, facilities, organizations. Often they invoke multiple sets of policies and procedures, which may work at cross purposes, contradict one another or ignore other stakeholders.

For instance, in the baseball stadium crisis training exercise, multiple stakeholders had their own rules of engagement, documented or otherwise.

Among the stakeholders having distinct policies and procedures were the home team, the visiting team, the stadium, Major League Baseball, the contract guard company, concessionaires, local police and the K-9 team.

When the dog handler was asked how he would respond to his dog’s alert on the truck, he said he would open the driver’s door and yank the driver to the ground. He admitted that his company had no protocol for this situation — this is what he would have done while he was a Marine in Fallujah.

Had he done that in a real situation in which the alert had been false, he would not only have violated stadium procedures but likely would have opened the parties up to liability.

Other “aha” moments

When practicing response through crisis training, a common finding is that participants forget key details, codes or names because they never practiced them. Or if they did practice them, those details might have changed.

One drill tested a CEO on how he would respond to a notification of an active shooter in the building over the office PA system. After thinking for a bit, he realized that he could find refuge in his designated safe room. However, it would have been useless because he had forgotten the code to get in.

Another frequent lesson is that staff tend to tune out PA announcements. Hospitals are a primary demonstration of staff tuning out incessant announcements.

Security staff in one medical center worked with the Red Ball Drills moderator to develop a sound, which could be played over the PA that would unequivocally and immediately warn of an active assailant and the need to listen to directions from the PA.

Codes simply do not work for this. Staff had already grown numb to hearing code blues, reds and so on. One nurse said she probably wouldn’t even hear her own name if called.

The nurses then realized that one PA announcement unfailingly got everyone to stop and listen: a lullaby indicating a baby had just been born. Staff realized that a distinct sound or tune would immediately grab attention, as opposed to a simple announcement.

It had to be instantly recognizable but unique. The hospital chose a nuclear-warning siren.

Finally, it’s critical to have all relevant parties participate in these exercises. One professional sports team proudly responded to an active shooter exercise by discussing the procedure for getting the players into the locker room, protected by armed guards.

That was fine until one participant wondered how the athletes would respond to their protective custody when their family and friends were vulnerable in the crowd.

The organization had to create a new protocol for knowing exactly which invitees were on site and how to protect them.

These are but a few examples of critical “aha” moments and crisis training and management process improvement opportunities that come to light when organizations go beyond tabletop exercises, but not so far as to impede business operations or to endanger or traumatize staff, customers or the public.

While it might not be time to table the tabletop, crisis managers should definitely drop even fake weapons to approach training in the safest and most beneficial manner.

Michael Gips, CPP, CSyP is the Principal of Global Insights in Professional Security, a consulting firm specializing in thought leadership, business development, cutting-edge research and content creation. He has written more than a thousand articles covering every aspect of security.