[OR] [MAS] [E3] [C4] Incident and Crisis Management Exercises

eBook 3: Chapter 4

Incident and Crisis Management Exercises

Introduction

Incident and crisis management exercises are essential components of operational resilience testing.  

While scenario testing validates the ability to deliver Critical Business Services (CBS), incident and crisis exercises focus on how effectively an organisation detects, responds to, and manages disruptions in real time.

Under the expectations of the Monetary Authority of Singapore (MAS), financial institutions must demonstrate that their incident management and crisis management frameworks are operationally effective, well-coordinated, and capable of supporting timely decision-making during disruptions.

This aligns with BCM Institute’s definitions of incident management (tactical response) and crisis management (strategic leadership response), both of which are critical to sustaining operational resilience.

This chapter explores three key aspects of incident and crisis management exercises: command structure testing, communication and escalation, and stakeholder coordination.

Command Structure Testing

Establishing a Clear Command Structure

A well-defined command structure is fundamental to effective incident and crisis response.

It ensures that decisions are made quickly, responsibilities are clearly assigned, and actions are coordinated across the organisation.

Typical command structures include:

• Incident Management Team (IMT) – Handles operational and technical response
• Crisis Management Team (CMT) – Provides strategic direction and oversight
• Business Unit Response Teams – Execute recovery actions for specific CBS

Objectives of Command Structure Testing

Exercises should validate whether:

• Roles and responsibilities are clearly defined and understood
• Leadership can make timely and informed decisions under pressure
• Command hierarchy functions effectively during escalation
• Teams can transition smoothly from incident to crisis management

Key Testing Scenarios

• Escalation from a technical incident to a full-scale crisis
• Activation of crisis management structures during high-impact disruptions
• Decision-making under conditions of uncertainty and incomplete information

Common Challenges Identified

• Ambiguity in decision authority
• Delays in escalation and activation
• Over-reliance on specific individuals (key person risk)

By testing command structures, organisations ensure that leadership frameworks are not just documented, but operationally effective during real events.

Communication and Escalation

Importance of Effective Communication

Communication is one of the most critical success factors during incidents and crises. Ineffective communication can amplify disruption, delay response, and damage stakeholder trust.

MAS emphasises the need for timely, accurate, and coordinated communication, both internally and externally.

Key Elements of Communication Testing

Exercises should evaluate:

• Internal Communication
• Speed and clarity of information flow between teams
• Effectiveness of escalation protocols
• Accuracy of situation reporting
  
  
• External Communication
• Customer notifications and service updates
• Regulatory reporting requirements
• Media and public communications

• Escalation Triggers
• Are escalation thresholds clearly defined?
• Are incidents escalated at the appropriate time?

Testing Communication Under Stress

Scenario-based exercises should simulate:

• High-pressure environments with rapidly changing information
• Conflicting or incomplete data requiring judgement and prioritisation
• Simultaneous communication demands across multiple stakeholders

Common Communication Gaps

• Delayed or inconsistent messaging
• Lack of coordination between internal and external communications
• Unclear escalation criteria leading to late response

Testing helps organisations refine communication strategies to ensure clarity, consistency, and timeliness during crises.

Stakeholder Coordination

The Multi-Stakeholder Nature of Crises

Operational disruptions often involve a wide range of stakeholders, including:

• Internal business units and support functions
• Senior management and the Board
• Customers and counterparties
• Regulators (e.g., Monetary Authority of Singapore)
• Third-party service providers and vendors

Effective coordination across these stakeholders is critical to managing the impact of disruptions.

Objectives of Stakeholder Coordination Testing

Exercises should assess whether organisations can:

• Coordinate actions across multiple internal teams
• Engage and manage third-party dependencies
• Communicate effectively with regulators and customers
• Align responses across incident, crisis, and business continuity functions

Testing External Dependencies

Given the importance of third-party services, exercises should include:

• Vendor participation in testing scenarios
• Simulation of third-party failures or service degradation
• Validation of contractual obligations and response capabilities

Coordination with Regulators

MAS expects timely and transparent communication during disruptions. Exercises should therefore include:

• Simulated regulatory reporting and updates
• Testing of compliance with notification timelines
• Validation of information accuracy and completeness

Common Coordination Challenges

• Misalignment between internal and external stakeholders
• Limited visibility over third-party response capabilities
• Delays in regulatory communication

Through structured exercises, organisations can strengthen collaboration, alignment, and trust across stakeholders.

Integrating Incident and Crisis Exercises into Operational Resilience

Incident and crisis management exercises should not be conducted in isolation. They must be integrated into the broader operational resilience framework:

• Link to CBS Scenario Testing
  Ensure that incident and crisis exercises support the delivery and recovery of CBS.

• Align with Impact Tolerances
  Validate whether response actions enable recovery within acceptable thresholds.

• Incorporate Continuous Improvement
  Use exercise outcomes to enhance plans, processes, and capabilities.

• Ensure Governance and Oversight
  Report findings to senior management and the Board to drive accountability.

This integration ensures that incident and crisis management capabilities are aligned with overall resilience objectives.

Incident and crisis management exercises are vital for ensuring that organisations can respond effectively to disruptions.

In line with the expectations of the Monetary Authority of Singapore, financial institutions must validate their command structures, communication processes, and stakeholder coordination mechanisms through structured and realistic exercises.

By rigorously testing these elements, organisations can identify gaps, strengthen response capabilities, and ensure that they are prepared to manage incidents and crises with confidence.

Ultimately, effective incident and crisis management is not just about response—it is about maintaining control, minimising impact, and preserving trust during disruption.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.