It was a quiet Tuesday morning at St. James Medical Center when an unexpected crisis shook the leadership team. An anonymous call came through the hospital’s switchboard: “There’s an active shooter in the lobby.”
The administrator on duty froze for a second before springing into action, flipping through the hospital’s emergency plan. Staff members scrambled to lock down patient wings and notify law enforcement. But as the situation played out, gaps became painfully clear—confusion over who was in charge, delays in communicating with staff, and uncertainty about whether all entrances were secured.
Fortunately, this wasn’t a real emergency. It was a tabletop exercise—a carefully planned scenario designed to test the hospital’s readiness. By the end of the session, leaders had identified critical weaknesses and revised their protocols. Weeks later, when an actual security threat emerged, their improved response plan helped them act decisively, preventing potential harm.
This is the power of tabletop exercises (TTX): they reveal vulnerabilities in a low-risk environment and prepare organizations to act when it truly matters.
In this post, we’ll explore the best practices for conducting effective tabletop exercises, covering preparation, execution, and follow-up. Along the way, we’ll share insights from real-world exercises that made a difference.
A successful tabletop exercise starts with a well-defined purpose. What do you want to achieve? Common objectives include:
In 2022, a regional healthcare system conducted a TTX to test their response to a ransomware attack. Their objective was clear: evaluate how long it would take to restore critical patient records if the system were locked down. During the exercise, teams realized they lacked a clear downtime workflow for emergency department admissions. This revelation led to immediate improvements, including updated protocols and additional training for frontline staff.
Key Takeaway: Clearly define what success looks like before you start.
A great exercise immerses participants in a plausible, detailed scenario that mirrors real-life crises. It should include:
A coastal emergency management team ran a hurricane preparedness TTX just months before a major storm hit. By simulating conditions—power outages, overwhelmed hospitals, and supply chain disruptions—participants were forced to confront tough decisions. When Hurricane Ian struck later that year, their earlier exercise paid off: response teams coordinated more effectively, having already navigated similar challenges in their drill.
Key Takeaway: Make your scenario realistic enough to engage participants but flexible enough to adapt as the discussion unfolds.
Tabletop exercises work best when they include the right mix of stakeholders. Identify who needs to be at the table based on your objectives. Consider including:
During the exercise, each participant should play their actual role to mimic real decision-making dynamics.
During a fire response TTX, a hospital realized they had neglected to invite maintenance staff—the very people responsible for shutting down air circulation and ensuring fire doors locked properly. This oversight highlighted a major weakness in their emergency planning. Moving forward, all TTXs included facility management personnel.
Key Takeaway: Include all relevant stakeholders, not just leadership.
Unlike full-scale drills, tabletop exercises emphasize discussion over action. The facilitator should create an environment where participants feel comfortable identifying weaknesses and proposing solutions.
Tips for Effective Facilitation:
A hospital emergency response TTX revealed that nurses and security staff had vastly different assumptions about lockdown procedures. Security assumed all patient wings would lock automatically—while nurses believed they had to manually secure each entry. Clarifying these discrepancies in a low-pressure environment helped avoid chaos during an actual lockdown weeks later.
Key Takeaway: Tabletop exercises should encourage honest discussion and problem-solving, not just highlight what’s already working.
A tabletop exercise is only as valuable as the improvements it drives. After each session, conduct a structured After-Action Review (AAR) to document key findings and create an action plan.
Components of a Strong AAR:
During a hospital mass casualty incident TTX, participants realized their patient triage tags were outdated and lacked clear priority codes. This small but critical oversight was corrected immediately. Months later, when a real bus crash sent dozens of injured patients to the ER, staff were able to triage efficiently with their updated system, saving precious time.
Key Takeaway: Don’t just run exercises—act on what you learn from them.
Tabletop exercises are not just hypothetical discussions. When executed well, they expose weaknesses, refine response strategies, and ultimately save lives. By following these best practices—defining clear objectives, crafting realistic scenarios, assembling the right players, fostering open discussion, and implementing lessons learned—your organization can ensure that when a crisis hits, you’re ready.
Emergencies don’t wait for perfect conditions. The time to prepare is now.
For additional guidance on running effective tabletop exercises, visit FEMA’s Exercise Toolkit.
Sources