The stadiums I helped build ran evacuation drills before a single paying customer walked in. The airports rehearsed system failures on quiet nights. The data centres pulled the plug on things deliberately, on a schedule, to prove the failover worked. None of these organisations was guessing about their bad day - they’d already had it, on purpose, with a stopwatch running.

Then I look at small businesses, where the entire continuity plan is usually a feeling. Asked directly, the owner says "we'd manage", and believes it, and has never once tested the belief. The gap between "we'd manage" and what actually happens is where businesses get hurt - and you can measure that gap for the cost of two coffees.

The drill: a tabletop exercise without the lanyard

In a small business, a tabletop exercise needs none of the enterprise apparatus - no facilitators, no injects, no lanyard. Yours needs two people, thirty minutes, a notepad, and four scenarios. No tools, no systems, nothing gets touched - you talk each one through and write down where you stall.

One: your laptop was stolen overnight. From a borrowed computer, talk through getting back into email, accounting and banking. Where's the first dead end? Every time I run this with an owner, the stall arrives faster than they predicted - usually at a recovery code that lives on the machine that's gone.

Two: your phone is destroyed. Not lost - destroyed, this morning, before work. Which logins stop working? Who can't reach you? What does the authenticator app being gone actually mean for the next 48 hours?

Three: the office floods. You have whatever you carried out. What records exist nowhere else? What equipment dies, and what's it worth to the insurer - can you even list it? What would you be doing at 9am tomorrow, and from where?

Four: the internet is dead for three days. Pit flooded, restoration "in progress". Talk through Tuesday, Wednesday, Thursday: payments, quotes, email, the accounting package. What limps along and what simply stops?

The output is a list, not a feeling

Run honestly, the drill produces something specific: a short written list of stall points. The recovery email nobody can access. The backup that's never been restored. The supplier whose support number exists only in a dead phone. The insurance policy nobody can lay hands on a copy of. The spare laptop that turned out to be a hope.

That list is the whole prize. Each stall point converts into an hour or two of unglamorous fixing - printing recovery codes, writing the run book, testing a restore - and unlike generic security advice, every item on it is proven relevant to your business, because you just watched yourself fail at it on paper. A tabletop exercise is the cheapest consultant you'll ever hire: it bills nothing and only finds real problems.

There's a quieter benefit, too. The first time someone other than you walks through these scenarios, knowledge starts moving out of your head and into the business. The drill doesn't just find broken processes; it finds the places where the process is you, which is its own kind of single point of failure.

Why paper beats products

Your instinct, after reading something like this, will be to go shopping - continuity software, a template pack, something with a dashboard. Resist it for one more week. A paper drill costs nothing precisely because it tests the thing no product can supply: whether your recovery steps actually connect end to end. Buy tools after the paper run tells you which gap is real. Most owners discover the first three fixes are a printed page, a phone call and a calendar entry.

How often? Twice a year is honest; once a year is the floor. The same four scenarios, the same notepad. The drill that took thirty minutes and found nothing - that's not wasted time, that's the day you learn your last six months of small fixes actually worked. The fire alarm that gets tested is annoying. The one that doesn't is decoration.

Your bad day is already scheduled; you just haven't seen the calendar. When it arrives, you'll run it exactly once, live, with customers watching. Wouldn't you rather have rehearsed?

Sources