[CM] Frequency of Crisis Management Exercises

Frequency of Crisis Management Exercises

Crisis management exercises should be conducted regularly and strategically to ensure preparedness.

The timing depends on organisational needs, risks, and triggers, but here are key situations when they should be scheduled.

Pre-reading for Participants Attending Module 4 of the CM-5000 Crisis Management Expert Implementer Course

Regular Intervals (Proactive Preparedness)

• Annually (Minimum): At least once a year to refresh skills and update plans.

• Quarterly/Biannually (High-Risk Industries): Crises can severely affect sectors like finance, healthcare, energy, or aviation.

After Significant Changes (Trigger-Based)

• Post-Incident: After a real crisis, to test updated procedures and lessons learned.

• After Major Organisational Changes:

  • Mergers, acquisitions, or restructuring.

  • New leadership or crisis team members.

  • Relocation, IT system upgrades, or supply chain shifts.

• When New Threats Emerge:

  • Changes in regulations (e.g., new compliance requirements).

  • Emerging risks (e.g., cyber threats, geopolitical instability, pandemics).

Before High-Risk Events (Preemptive Testing)

• Before Product/Service Launches: If the launch carries reputational or operational risks.

• Before Major Events:

  • Large public gatherings, corporate announcements, or IPO filings.

  • Seasonal risks (e.g., hurricane season for logistics companies).

Compliance & Audit Requirements

• Regulatory Mandates: Some industries (e.g., banking, critical infrastructure) require periodic testing.

• Internal/External Audits: To demonstrate due diligence in risk management.

When Performance Gaps Are Identified

• After risk assessments, tabletop exercises, or near-misses reveal weaknesses.

Best Practices for Timing

• Mix Exercise Types: Alternate between tabletops (frequent) and full-scale drills (less frequent).

• Align with Business Cycles: Avoid peak operational periods to minimise disruption.

• Post-Exercise Reviews: Schedule follow-ups to implement improvements (cyberattacks). 

Types of Crisis Management Exercises
Design and Develop Crisis Management Exercises