[BCM] [TE] [Haze] Exercise Injects for Severe Haze Scenario

Injects for Walk-through (Tabletop) Exercise for Exercise HAZE SHIELD

Scenario: Severe Haze Crisis Attributed to a Super El Niño and the Indian Ocean Dipole

The following injects adapt Exercise HAZE SHIELD for a bank’s senior management and Board of Directors.

They focus on protecting people, maintaining critical banking services, managing financial and operational risk, and exercising effective oversight.

The scenario assumes renewed deterioration following Singapore’s October 2026 haze episode.

All readings, disruptions, financial impacts and messages below are fictional exercise inputs. They do not represent actual developments or regulatory instructions.

Run the exercise over approximately three hours, compressing seven incident days.

Release the initial injects to senior management, then introduce Board injects through a simulated emergency Board meeting.

Senior Management (SM) Injects

No. / simulated time	Inject provided to participants	Decisions and discussion required	Expected output
SM1 — Day 1, 7:30 a.m.	Renewed deterioration. The simulated 24-hour PSI is 220, with further deterioration forecast. Branches open in 90 minutes. Employees, security contractors and cash-delivery personnel seek instructions.	Who leads the response? Should the bank activate its crisis management and business continuity arrangements? What immediate protective measures apply across branches, offices and outdoor activities? When should the CEO and Board Chair be informed?	Activation decision; incident leader and deputy; initial priorities; first situation report; Board notification decision.
SM2 — Day 1, 9:00 a.m.	Staff availability falls. 25% of branch staff are unavailable. Several employees request alternative duties because of health concerns. Two branches cannot meet the bank’s approved staffing and control requirements.	Which branches remain open, consolidate services or temporarily close? How will the bank preserve segregation of duties, security and customer access? What support and alternative work arrangements are appropriate?	Branch operating plan; staff redeployment; control assessment; employee advisory.
SM3 — Day 1, 10:30 a.m.	Premises become unsuitable. The building manager reports filtration problems at the main operations centre. Staff report discomfort. The alternate site is also affected by haze, and its indoor conditions have not been verified.	Should staff remain, relocate or work remotely? Who determines premises suitability? Which processing activities must move first? What evidence is needed before occupying the alternate site?	Premises decision; relocation priorities; verification requirements; accountable owners.
SM4 — Day 1, noon	Remote-working constraints. Concurrent remote access approaches capacity. Privileged access for some payment operations is available only from approved locations. A manager proposes using personal email to move processing files.	Which services receive access priority? What secure alternatives are available? Who can approve temporary arrangements? Which proposed workarounds must be rejected or redesigned?	Access allocation; approved secure workarounds; control exceptions register; remediation actions.
SM5 — Day 1, 2:00 p.m.	Payment processing at risk. Absenteeism and relocation delays create a backlog in high-value and corporate payments. Forecast completion approaches internal escalation thresholds and payment-system cut-offs.	How will the bank prioritise payments and mobilise qualified staff? When must it escalate to counterparties, payment-system operators or authorities, as applicable? What should affected customers be told?	Payment prioritisation plan; cut-off contingency; escalation and communication decisions.
SM6 — Day 1, 3:30 p.m.	Cash distribution disruption. A cash-in-transit provider suspends selected routes following its safety assessment. Several ATMs may run out of cash within 12 hours. Queues form at nearby branches.	Which locations require priority replenishment? Are alternative providers and routes feasible and safe? How will the bank support customers who cannot readily use digital channels?	Cash-access plan; provider contingency; customer alternatives; security arrangements.
SM7 — Day 2, 8:00 a.m.	Critical provider loses capacity. An outsourced contact centre reports 50% staff availability. Its recovery location is affected by the same haze episode. Customer waiting times exceed the bank’s internal target.	What minimum service can the provider sustain? Should the bank insource selected enquiries or activate another provider? How will it handle fraud reports, vulnerable customers and urgent complaints?	Supplier recovery decision; priority call routing; capacity forecast; service monitoring.
SM8 — Day 2, 10:00 a.m.	Digital demand and cyber pressure. Branch disruption increases digital traffic sharply. Customers experience intermittent login failures. Fraudsters circulate messages claiming that customers must use a “haze emergency banking portal”.	How will Operations, IT, Cybersecurity and Communications coordinate? Which services receive restoration priority? What customer protection actions and fraud controls are needed?	Joint response plan; digital-service priorities; scam warning; fraud monitoring actions.
SM9 — Day 2, noon	Regulatory information request. The controller, acting as MAS, requests an update on affected services, customer impact, continuity measures and recovery outlook. Internal reports contain inconsistent figures.	Who validates the facts and approves the response? Which actual notification obligations must Compliance assess? How will uncertainties and subsequent corrections be communicated?	Approved simulated response; verified impact figures; notification assessment; next reporting time.
SM10 — Day 2, 2:00 p.m.	Reputational escalation. A video alleges that the bank forced a contractor to work in unsafe conditions. A journalist requests comment within 30 minutes. The contractor disputes the allegation.	What facts can be confirmed? Who investigates and speaks for the bank? What immediate welfare action is warranted? When should the Board be updated?	Holding statement; investigation owner; welfare response; Board briefing.

Board (B) of Directors injects

Board participants should challenge management’s recommendations, approve matters within reserved authority and oversee risk. Management retains responsibility for operational execution.

No. / simulated time	Inject provided to the Board	Board challenge and decisions required	Expected output
B1 — Day 2, 4:00 p.m.	Emergency Board briefing. Management reports widespread haze impacts, reduced staffing and disruption to selected banking services. Its recovery estimate assumes significant improvement within 48 hours, but the outlook remains uncertain.	Is management’s strategy credible under a longer disruption? Are priorities clear? Does the Board have enough evidence on people, customers, critical services and control effectiveness?	Recorded the challenge; endorsed strategic priorities; revised planning assumptions; set a reporting cadence.
B2 — Day 2, 4:15 p.m.	Service limits under pressure. Management forecasts that two critical services may breach the bank’s approved disruption tolerances or continuity targets within 24 hours. It requests temporary acceptance of reduced service.	What harm could arise, and to whom? What alternatives have been exhausted? Is the request within Board authority? Which legal, regulatory and contractual obligations remain binding?	Time-limited decision within authority; conditions; mitigation requirements; escalation triggers.
B3 — Day 2, 4:30 p.m.	Health versus service availability. Management proposes keeping selected branches open to preserve access. WSH and HR advise that some locations cannot yet demonstrate suitable working conditions.	What evidence is required before opening? How will the bank provide essential access through safer alternatives? Is management giving sufficient weight to employees, contractors and customers?	Direction on operating conditions; required evidence; alternative-access expectations; review time.
B4 — Day 2, 4:45 p.m.	Emergency expenditure. Management seeks an illustrative S$5 million emergency budget for suitable temporary premises, filtration improvements, secure technology capacity, transport and supplier support. Some commitments exceed delegated limits.	Are expenditure priorities linked to critical services and safety? Which commitments need Board approval? What procurement safeguards and subsequent reporting should apply?	Funding decision; revised delegated authority where appropriate; spending controls; reporting requirements.
B5 — Day 3, 9:00 a.m.	Liquidity and confidence pressure. False online claims suggest cash-access problems mean the bank is financially distressed. Withdrawals increase above normal patterns. Treasury reports adequate current liquidity but uncertainty over further outflows.	Does the Board have a credible stress assessment? What triggers would activate contingency funding arrangements? How will the bank coordinate liquidity management, customer communication and regulatory engagement?	Liquidity oversight decision; stress assumptions; monitoring thresholds; communication direction.
B6 — Day 3, 10:00 a.m.	Control weakening. Management proposes temporarily reducing selected payment checks and manual reconciliations to clear backlogs. Risk and Compliance warn of increased fraud, error and compliance exposure.	Which changes are permissible? What compensating controls, approval limits and expiry dates are necessary? Which obligations cannot be waived by the Board?	Decision on each proposed exception; prohibited changes; compensating controls; independent monitoring.
B7 — Day 4, 9:00 a.m.	Leadership continuity. The CEO becomes unavailable for 48 hours, and the designated deputy is already managing a major operational recovery workstream. A significant external update is due shortly.	Are succession and emergency authorities workable? Who assumes executive leadership and external representation? Is the Board’s own quorum and decision-making continuity secure?	Acting leadership arrangement; confirmed authorities; Board continuity arrangements; communication ownership.
B8 — Day 4, 11:00 a.m.	Prolonged disruption and customer harm. Haze may persist for another week. Complaints include delayed salary payments, difficulty accessing cash and inability to obtain urgent assistance. Management proposes service restrictions and customer relief measures.	Are restrictions proportionate and clearly communicated? How will the bank identify and support vulnerable customers? Are proposed fee waivers or other relief measures fair, feasible and controlled?	Approved customer-protection principles; relief authority; harm indicators; escalation requirements.
B9 — Day 6, 9:00 a.m.	Pressure to reopen. Air quality improves temporarily. Management recommends full reopening, but staff fatigue, incomplete premises checks and reconciliation backlogs remain.	What evidence supports safe and controlled restoration? Should reopening be phased? What residual risks require explicit acceptance, and what would trigger reactivation?	Phased restoration decision; readiness criteria; residual-risk owners; reactivation triggers.
B10 — Day 7, 3:00 p.m.	Assurance and accountability. Preliminary review identifies outdated supplier assumptions, insufficient remote capacity and an earlier exercise finding that was never closed.	Why were known weaknesses unresolved? Is independent assurance required? Who owns remediation, and how will the Board verify effectiveness?	Commissioned review; accountable executives; funded remediation deadlines; retest and closure requirements.

Facilitator Follow-up Injects

Use these selectively when participants resolve an issue too quickly or rely on unsupported assumptions.

Participant assumption	Follow-up inject
“We will move everyone to the alternate site.”	The site has only 40% of the required workstations; its filtration maintenance records are unavailable.
“Everyone can work from home.”	Several essential roles require approved premises, and some employees lack a suitable home working environment.
“Our supplier will activate its BCP.”	The supplier confirms that its plan relies on the same building, transport network or affected workforce.
“We will ask staff to work longer shifts.”	HR reports fatigue, increasing processing errors and limited availability of qualified relief staff.
“We will notify the regulator.”	The controller asks for the applicable notification basis, accountable approver, verified facts and next update time.
“The Board has approved the risk.”	Compliance asks participants to identify which obligations remain binding and whether the decision falls within the Board’s authority.
“Conditions have improved, so we can stand down.”	The improvement is temporary; premises checks and operational reconciliations remain incomplete.

For every inject, require participants to record the decision, rationale, accountable owner, deadline, customer and staff impact, control implications, escalation needs and evidence required.

Evaluate senior management on executable responses and the Board on effective challenge, clear authority, risk oversight and follow-through.

Supplementary Blogs to Elaborate Haze-Specific Details

Refer to the table of contents above. The additional blogs highlighted in green elaborate on the selected section. Click the icon below to access the additional readings for the specific section.

Project Management	Risk Analysis and Review	Plan Development
[PM] Objective and Scope of Plan	[RAR] Haze Scenario Overview	[PD] Preparedness Measures
1.1 to 1.2	2.1	5.1 to 5.7

Plan Development
[PD] Incident Response and Recovery		Back to Table of Contents
5.8 to 5.13

Learn more about BCM-5000 [B-5] and BCM-

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].