Tabletop exercise scenario: loss of a critical supplier

1. Overview and how to use this scenario

This document provides everything needed to run a tabletop exercise on the unavailability of a critical supplier. A tabletop exercise is a guided discussion of a scenario by the people who would have to decide in a real situation, with no real action: nobody is called, no system is switched over, nothing is signed. Players say what they would do, and why. The scenario is built on Norvane, the course’s fictitious organisation, but a facilitator who has not followed the course can run it as it stands.

How to use this scenario

1. At least 15 days beforehand, adapt the scenario (see below) and agree the objectives (section 3) with the sponsor.
2. On the day, follow the timeline (section 6), deliver the injects (section 7) and prompt with the decision questions (section 8).
3. Close with the hot debrief (section 9), then write up the post-exercise review and action plan (section 10) within two weeks.

Adapting the scenario to another organisation and another supplier

Keep the mechanics (sudden loss of a critical supplier, unknown duration, sensitive customers, a back-up solution to decide on quickly, an absent key person, outside pressure, costs, partial recovery), then:

• replace Altéo with your own critical supplier: a carrier, a SaaS software provider, a managed IT service provider, a subcontractor, a sole supplier of a component;
• recalibrate the time frames using your own BIA (MTPD, RTO, MBCO); without a BIA, the objective “decide within the time frames” becomes “identify the time frames to set”;
• replace Norvane’s continuity solutions with those your plan actually provides for: the exercise tests your arrangements, not ideal ones;
• rewrite the injects with your own senders, keeping their purpose;
• keep the cause plausible and light on detail: the exercise is about the consequences, not the investigation.

2. Background

Norvane is a fictitious organisation, created for this course; any resemblance to an existing company is coincidental. Altéo Transport is also fictitious.

Norvane distributes medical and hygiene consumables to around 1,400 professional customers: pharmacies, community nursing practices, care homes for older people and five private clinics. It employs 140 people, has a single warehouse and handles around 6,200 order lines a day. Any order placed before 16:00 is delivered the next day; the five clinics’ urgent orders are delivered within 4 hours, under a contractual commitment. Care homes keep 3 to 5 days of stock on average.

Altéo Transport, a subcontracted carrier, handles 85% of deliveries: the daily rounds and the urgent runs to the clinics. Its rounds are planned overnight by its own system, using a file sent automatically by Norvane’s ERP. The remaining 15% are collections on site and ad hoc shipments.

Norvane’s continuity arrangements

For the activity “pick and deliver orders”, management has approved the following objectives, drawn from the BIA.

The business continuity plan (BCP) provides, among other things, for a crisis team and its contact directory, a framework agreement with a back-up carrier, a buffer stock of critical items for urgent customers, an automatic daily export of customers, stock and open orders to an offline workstation, and picking from paper lists. Thomas Weber, operations manager, is the continuity coordinator.

Starting situation

Monday, 07:15. Friday’s orders have been picked and are waiting at the loading bays. All 34 order pickers are at work, customer service opens at 08:00, and the ERP and the portal are working normally. Altéo’s drivers are expected at 07:30.

This text is read to the players at the start of play; they know nothing of what follows.

3. Exercise objectives

A good objective can be checked at the end of the session with a yes, a no or a recorded time. Select 4 to 6 with the sponsor.

4. Participants and roles

Each player takes the role they actually hold. With fewer than seven players, combine roles (purchasing and finance, for example); with more, add a person to keep the log, the time-stamped record of information and decisions.

5. Rules of play and exercise safety

The facilitator reads these rules during the introduction.

• Confidentiality. What is said stays in the room. The post-exercise review describes situations, never individuals.
• Freedom to make mistakes. The aim is to find weaknesses in the arrangements, not to assess people. A mistake during an exercise is useful information, not a failing.
• No real action. Players describe what they would do. Only read-only checks are allowed, with the facilitator’s agreement: consulting the plan, the directory, a contract or the date of a file, without changing anything or contacting anyone outside.
• Compressed time. The facilitator announces the simulated time and every time jump. A decision that has been announced is deemed carried out, unless the facilitator introduces a constraint.
• The scenario stands. Its plausibility is discussed at the debrief, not during play.
• “Out of exercise”. Any sentence beginning with “out of exercise” concerns real life (someone feeling unwell, a real incident, a practical question). If a real incident occurs, the facilitator stops the exercise.

6. Scenario timeline

Play covers six simulated days in 1 h 45.

Deadlines to display on the wall, in simulated time: urgent flow RTO, Monday 09:30; urgent flow MTPD, Monday 11:30; overall flow RTO, Tuesday 07:30; overall flow MTPD, Wednesday 07:30.

7. Injected events

The controller reads each message aloud or hands it on paper to its recipient, who chooses whether to share it with the crisis team: the way information circulates is part of what is observed. Play times are indicative; let a decision in progress conclude rather than cutting it short.

Inject 1: Altéo can no longer plan its rounds

• Simulated time: Monday 07:30 (T0), at 0:15 of play
• Sender: Altéo’s duty operations manager, by phone, to Norvane’s operations manager

“This is Altéo’s duty operations manager. We were hit by a cyber attack overnight. Our systems are down: we can no longer plan rounds. No lorry will leave this morning and urgent runs are suspended. I have no restoration date. I will call you back as soon as I know more.”

Expected response: management is alerted immediately. The group recognises a crisis rather than an ordinary incident: without transport, the urgent flow will exceed its MTPD at 11:30. Crisis team convened using the directory, BCP opened, log started. IT starts asking questions about file exchanges with Altéo.

Inject 2: a clinic is waiting for an urgent order

• Simulated time: Monday 08:05, at 0:25 of play
• Sender: the nurse in charge of the operating theatre at one of the five clinics, by phone, to customer service

“I have just placed an urgent order: sterile gloves, swabs and dressing kits for theatre. Our operations start at 13:00. Your commitment is 4 hours: can you confirm delivery before noon?”

Expected response: customer service promises nothing without a confirmed solution, but sets a time to call back. The crisis team looks for a solution without Altéo before 09:30, the urgent flow RTO: the buffer stock, collection by the clinic, a local courier, a hired van driven by an employee. It decides who will contact the other four clinics before they call.

Inject 3: a key person is absent

• Simulated time: Monday 08:45, at 0:35 of play
• Sender: the purchasing manager’s automatic email reply, handed to the “purchasing” player

“I am on leave until Wednesday inclusive, with no access to my email or phone. For any query, please contact the purchasing department.”

Instruction for the facilitator: the “purchasing” player now plays the deputy, who knows a framework agreement exists with the back-up carrier but has never used it.

Expected response: the group looks for the deputy named in the plan, or finds that there is none. It checks where the framework agreement is kept, who the contact at the back-up carrier is and, above all, who can commit Norvane in an emergency.

Inject 4: the back-up carrier asks for a signed commitment

• Simulated time: Monday 09:30, at 0:45 of play
• Sender: the back-up carrier’s account manager, by phone, to purchasing

“Several of Altéo’s customers have been calling us since this morning. Under our framework agreement, I can reserve 4 vehicles with drivers from 13:00, then 6 from tomorrow. I need a signed purchase order before 11:00, with a minimum commitment of 5 days at the agreement’s emergency rate, which is a 40% surcharge, and your delivery file before noon. After 11:00, I cannot guarantee anything.”

Guidance for the facilitator (exercise figures): 4 vehicles cover about a third of Altéo’s usual deliveries, 6 about half. The group will not be able to deliver everything: this is intentional.

Expected response: a decision before 11:00. The group establishes who signs (an existing delegation, the chief executive, or a crisis team decision recorded in the log) and derives a priority rule. IT prepares the delivery file and chooses a secure channel to send it.

Inject 5: a care home is running low on stock

• Simulated time: Monday 10:30, at 0:58 of play
• Sender: the manager of an 80-resident care home, part of the group of 30 care homes that recently asked Norvane about its continuity arrangements, by phone, to customer service

“We were expecting our delivery this morning. We have two days of incontinence products left and less than two days of gloves. Without a firm delivery time by this evening, I will order elsewhere and inform the group’s management.”

Expected response: the MBCO is applied (100% of care home orders). The crisis team identifies the lowest stocks, puts those homes at the front of the back-up rounds or arranges a partial shipment of critical items. It prepares a message for all care homes and appoints a single point of contact for the group.

Inject 6: Altéo gives an update, with no recovery date

• Simulated time: Monday 16:00, at 1:10 of play
• Sender: Altéo’s chief executive, by phone, to Norvane’s chief executive

“We are rebuilding our systems with specialists. I cannot give you a recovery date for several days. As a precaution, suspend all automatic file exchanges with us and do not open attachments received from us since Friday without checking them. We will give you an update every day at 16:00.”

Expected response: a shift to organising for several days: extending the back-up solutions, setting the rhythm of crisis team meetings, planning handovers. IT suspends the interface with Altéo and checks the files received. A useful prompt: if the ERP also had to be isolated, which list of customers and emergency contacts would you work from, and how old is it?

Inject 7: a rumour spreads on social media

• Simulated time: Tuesday 09:00 (D+1), at 1:20 of play
• Sender: a post flagged by the person in charge of communication, handed over on paper

A pharmacist’s message in an online professional group, shared around forty times: “Norvane has been hacked, no deliveries since yesterday and they are saying nothing. Order elsewhere!”

Expected response: separate fact from fiction: it was the carrier that was attacked, which IT confirms before anything is said publicly. No online arguments, but a factual message to all customers: what is happening, what is being delivered, how to reach customer service.

Inject 8: a local journalist calls

• Simulated time: Tuesday 14:00, at 1:28 of play
• Sender: a journalist from a local media outlet, by phone, to the switchboard; the “customer service” player answers

“I am preparing an article for tomorrow. I am told that care homes in the area may run short of care supplies because of you. How many homes are affected? My deadline is 17:00.”

Expected response: no comment on the spot: the journalist’s details and deadline are taken and the call is referred to the spokesperson. The crisis team approves a short, factual statement (situation, measures taken, priority given to healthcare customers), with no unverified figures and no comment on the attack on Altéo.

Inject 9: additional costs mount up

• Simulated time: Wednesday 11:00 (D+2), at 1:37 of play
• Sender: a note from the accounts department to the finance and administration director

“Extra costs to date (exercise figures): the emergency transport surcharge, overtime and couriers amount to around €9,000 a day. The back-up carrier offers to guarantee 6 vehicles for 10 days instead of 5, in return for a firm commitment over the whole period. Answer needed this evening.”

Expected response: management weighs this cost against the impacts avoided as described in the BIA (penalties, lost customers, consequences for residents), sets a spending ceiling and a commitment period consistent with the uncertainty, and records its decision and rationale. Costs are tracked for a later discussion with Altéo or the insurer.

Inject 10: Altéo announces a partial recovery

• Simulated time: Thursday 08:00 (D+3), at 1:45 of play
• Sender: Altéo’s duty operations manager, by phone, to Norvane’s operations manager

“We are restarting in degraded mode: about half of your rounds from tomorrow, planned by hand, without delivery tracking. Urgent runs will not resume before next week. Can you send us your files by email again, as before?”

Expected response: no rush. IT sets the conditions for resuming exchanges: channel, file checks, confirmation that Altéo has cleaned up its systems. Operations split the rounds between Altéo and the back-up carrier, keeping the urgent flow on the back-up solution. The crisis team defines its criteria for standing down.

End of play

At 1:58 of play, the facilitator reads: “Saturday, D+5. Altéo confirms that all its rounds and urgent runs will fully resume next Monday. End of exercise.”

8. Decision questions by phase

These questions restart the group when it gets stuck or misses a topic; choose those that serve the objectives. A good prompt asks: who decides, on what basis, by what time?

Phase 1: detection, alert and mobilisation

To be decided:

• Incident or crisis? Who decides, on which criterion in the plan?
• Who convenes the crisis team, by what means, and where does it meet?
• What happens to the clinics’ urgent orders between now and 09:30?

Useful discussion points:

• What do we know, and what are we assuming? Have facts and assumptions recorded separately.
• Ask each player to check, without calling, their own number and their deputy’s in the crisis directory.
• Should IT exchanges with Altéo be suspended now?

Phase 2: decisions and back-up solutions

To be decided:

• Do we sign with the back-up carrier? For how long, for what volume, and who signs?
• What priority rule applies between customers, and does it allow the MBCO to be met?
• Do we keep picking orders that will not leave, or redeploy pickers to priority orders?

Useful discussion points:

• What exactly does the framework agreement say: lead time, capacity, rate, contact?
• Through which secure channel is delivery data sent to the back-up carrier?

Phase 3: holding on over time

To be decided:

• What rhythm for the crisis team: fixed meetings, handovers, team working hours?
• Who is the spokesperson, and what is said publicly?
• Do we extend the commitment with the back-up carrier, and with what spending ceiling?

Useful discussion points:

• Is the overall flow MTPD (Wednesday 07:30) being met, at least at MBCO level?
• What do we say about Altéo externally, without blaming it or disclosing what is not ours to share?

Phase 4: partial recovery and return to normal

To be decided:

• Under what conditions do we resume exchanges and rounds with Altéo?
• When, and on what criteria, do we stand down the crisis arrangements?

Useful discussion points:

• Should the 85% share entrusted to Altéo be reduced?
• What records should be kept for the post-exercise review: decisions, costs, complaints?
• Who tells customers that service is back to normal, and when?

9. Lessons learned grid

Observers complete the “observed” and “comments” columns during play, then give the score before the debrief. Record facts timed in simulated time (“crisis team convened at 08:10”), never judgements about individuals.

Scale: 1 = not achieved; 2 = partly achieved, significant gaps; 3 = achieved, minor gaps; 4 = achieved as planned. The score is used to identify improvement priorities, not to rank participants.

Hot debrief questions

Thirty minutes, straight after the end of play. Players speak first, then observers, then the facilitator. The discussion is about the arrangements; nobody is blamed.

1. What worked well and should be kept?
2. At what point were you missing information, a tool or a decision?
3. Did the BCP help you? Where did you have to improvise?
4. Would the urgent flow and overall flow time frames have been met?
5. Did you know in advance who could decide and sign what?
6. What would the clinics and care homes have experienced?
7. If this happened tomorrow, what would be the first three things to fix?

10. Action plan template

Each finding leads to an action, with a named owner, a deadline and a priority. Management approves the plan and tracks its progress; the next exercise checks that the gaps have been fixed.

Example: Norvane’s action plan

Norvane rated the last finding as medium priority because a message already exists for an ERP outage and can be adapted in the meantime. Set your own priority criteria and apply them to every action.

11. Appendices for the facilitator

Equipment list

• A quiet, closed room, available 30 minutes before and after the session.
• The BCP, the crisis directory, the back-up framework agreement and the priority customer list, as they actually exist.
• The inject cards, printed, numbered and marked EXERCISE.
• A flip chart for the situation and decisions, a simulated-time clock and the MTPD and RTO deadlines on display.
• One grid per observer, a stopwatch for the controller, name cards showing the roles.

Preparation checklist

D-15

• Agree the objectives, the date and the list of players and their deputies with the sponsor.
• Adapt the scenario and have it reviewed by someone who will not be playing.
• Invite the players, stating the format and duration without revealing the scenario.

D-1

• Hold a 30-minute rehearsal with the exercise team: timings, outside roles, the “out of exercise” signal.
• Print documents, cards and grids; confirm attendance and arrange substitutes.
• Check the room and equipment.

On the day

• Set up the room 30 minutes beforehand, read the rules and the starting situation, start on time.
• After the session, collect the grids, notes and log.
• Set a date for the post-exercise review report, no later than two weeks afterwards.

Common facilitation mistakes

• Trapping the players. Piling on disasters makes the scenario implausible and discourages people. Stay plausible.
• Giving the answer. The facilitator asks questions; if they answer on the group’s behalf, the exercise no longer measures anything.
• Letting the debate focus on the cause. The attack on Altéo is not the subject: bring the group back to consequences and decisions.
• Losing track of time. Without announced time jumps, the time frames lose their meaning. Keep to the timings, even if it means cutting a discussion short.
• Letting one voice dominate the room. Invite the quieter functions by name, often IT and finance.
• Sacrificing the debrief. The last 30 minutes are protected: without a debrief, the exercise loses most of its value.