Calibrating your crisis simulation for standards-based learning
“Crisis simulation” is a phrase that looks impressive in a board paper and a bit unsettling as a calendar invite.
At its grandest, it evokes images of mock military movements, coded briefings and cross-border manoeuvres; exercises that nation states use to test readiness and flex their muscle. At its most trite, it can mean a half-hour chinwag about something lifted from the risk register: “What if we have a data breach?” Cue sage mumbles and Subway sandwiches.
Is the fact that both are labelled as 'crisis simulations' a training problem today ?
I mean, the term spans a vast range of activity. On one end: complex, multi-layered war games involving real-world assets and geopolitical consequences. On the other: a 90-minute PowerPointer that superficially confirms the crisis plan’s likely robustness.
Somewhere between, lies a form of Crisis Simulation that should matter to large Australian corporates; organisations navigating cyber threats, regulatory scrutiny, reputation risk, ESG exposure, operational fragility or other realistic and damaging events.
A serious simulation should not be mere theatrical drama, slickly drafted media “holders” and debrief high-fives. It should be a disciplined stress test of Enterprise Risk Management (ERM) capability, decision-making quality and Operational Resilience.
At The Drill we believe effective crisis simulations do two things exceptionally well:
1. Test the quality of your risk triage.
2. Test the effectiveness of your pain-mitigating actions.
Risk Triage Under Pressure
In a genuine crisis, information is incomplete and contradictory. Time compresses. Emotions escalate. Stakeholders demand answers. Tasks accumulate. The ability to triage calmly - separating signal from noise and prioritising what matters now versus what can wait, determines whether crisis management stabilises or spirals.
A proper simulation should reveal whether leaders can:
Identify core risk drivers early
Allocate authority and resources appropriately
Escalate decisions at the right moment
Document and justify decisions taken
Consider ethical as well as political implications
if simulations lack ambiguity, depth, stakeholder pressure and realistic time compression, you're not testing crisis management capability. You are hosting a sandwich-based social.
Strong Cyber Crisis Response, Business Continuity, and incident response frameworks mean little if decision-makers cannot apply them under stress.
Mitigating the Pain
Every crisis brings consequences: operational disruption, reputation damage, regulatory inquiry, financial loss. The question is not whether pain occurs, but how quickly and intelligently you reduce it, particularly with stakeholder impact front of mind.
Many simulations dramatise “The media is calling!” or how AI will be your saviour, both without testing the operational, legal and governance mechanics underneath. You see a simulation worthy of the name surfaces friction. It exposes blind spots. It reveals cultural constraints and clashes of process and personality. It tests whether your Crisis Management structure actually functions.
Here at The Drill, we have long maintained that a simulation is not about proving competence. It is about discovering fallibility, in a pass-protected, safe portal.
Modern crisis simulation software allows scenarios to evolve dynamically based on participant decisions. It tracks timing, records decision pathways and highlights cultural alignment or misalignment. It provides tangible insight for Board Assurance and governance oversight.
Did the team over-focus on media optics while neglecting stakeholder impact? Was the Crisis Management Team inward-looking rather than impact-focused? Were warning signs dismissed as improbable or inconvenient in relation to the new quarterly earnings report ?These are practical questions, not theoretical ones.
For large Australian corporates especially ASX-listed companies, expectations around governance, regulatory compliance and Operational Resilience continue to rise. Boards increasingly want evidence and proof that management can handle volatility. A robust crisis simulation provides that assurance.
And yes, a sim can be a fun thing. Immersive, time-compressed problem-solving creates its own frisson. But that is a by-product, not the objective. The aim is crisis muscle memory !
Effective crisis management capability is built by experiencing threats in compressed time, making decisions with imperfect data, committing judgement to record and reflecting honestly afterwards. That's how ERM matures from policy to practice.
So when someone next proposes a “crisis simulation,” ask a few useful questions like:
Will this genuinely test our risk triage under pressure?
Will it examine how we'd reduce stakeholder impacts?
Will the tools used generate measurable insight and stronger governance?
What is the learning and training rubric used by the training provider?
At its biggest, crisis simulation may resemble a war game on a Nordic border. At its weakest, it is a water-cooler chat masquerading as risk revision. But at its best, it sharpens judgement, strengthens co-ordination and materially enhances operational resilience.
In a world where crisis is less a matter of IF and more a matter of WHEN, the only meaningful definition of crisis simulation is this:
Does it adequately and realistically test your people for the real-world decisions that matter?
/ends.