You Can’t Plan for Everything — But You Can Plan for the Right Things: How to Choose Crisis Scenarios That Actually Prepare Your Teams
When the “Unlikely” Happens on a Tuesday
Picture this.
It’s 8:42 a.m. on a normal Tuesday. Your operations director has just taken a sip of coffee. Emails are flowing, systems are humming — and then, suddenly, they’re not.
Finance systems lock. Customer support lines light up. A breaking news tweet tags your company in a data-leak claim. Legal wants answers. The CEO texts: “Is this real?” Communications draft a statement — and delete it. Someone says, “We trained for this, right?”
Silence.
I’ve seen that silence in real war rooms. It’s not caused by panic — it’s caused by misalignment. Teams thought they were prepared, but they rehearsed the comfortable scenarios, not the consequential ones.
And that’s the heart of the issue: crisis preparedness starts with choosing the right scenarios — not the most dramatic ones.
Why Scenario Selection Matters More Than Ever
According to PwC’s 2023 survey, 90% of organizations have faced multiple major disruptions — yet three-quarters say at least one of those had a medium-to-high operational impact.
While ~70% of leaders say they feel ready to recover from disruption, many still lack key resilience foundations.
Cyber drills are clearly popular (53% of organizations say they’ve practiced them) but only a third have formally tested industrial accidents or natural disasters — even though major reports flag those threats as growing.
Yet many organizations are still pulling scenarios from last year’s tabletop playbook.
Selecting the right scenarios isn’t a creative writing exercise — it’s strategic risk prioritization. It’s how you build organizational muscle memory before chaos hits.
The Questions Leaders Keep Asking Me (and Maybe You’re Asking Too)
Where do we even start?
Start with material risk — not fantasy scenarios or trendy buzz topics.
Should we practice everything?
No — you’ll burn people out and dilute focus. Pick the crisis events that will have true impact.
What if we choose wrong?
That’s why we update annually. Risk landscapes evolve — so should exercise plans.
Do we pick disasters that are likely or catastrophic?
Both — but weigh toward events that would meaningfully disrupt your operations and brand.
How do we avoid making the scenario too technical or too vague?
Focus on objectives for each exercise. Ask who’s the audience is and what’s the goals are for that exercise and make sure they are aligned with the program.
Choosing the Right Scenarios: A Practical Framework
Let’s break this into something you can take to your next planning meeting.
1. Anchor Scenarios to Strategic Risks
If it keeps your board awake, it should be on the exercise schedule.
Examples:
- Ransomware with customer-impact (because regulatory and reputational stakes are high)
- Supply-chain blockade affecting core product delivery
- Executive misconduct leak and media pressure
- Natural disaster shutting down a primary facility
- Third-party SaaS breach exposing client PII
Ask yourself:
If this happened, would our brand, customers, or operations be impacted for more than 72 hours?
If it’s a yes, that’s a candidate.
2. Map People + Decisions, Not Just Hazards
People don’t panic because a storm hits; they panic because they don’t know who’s doing what when the storm hits.
For each scenario, identify:
| Element | Ask Yourself |
| What decisions are required? | “Who calls legal? Who informs customers?” |
| What cross-functional tensions might arise? | “Security wants quiet, comms wants transparency.” |
| What time pressure exists? | “Regulator expects notice in 72 hours.” |
| What assets or systems are impacted? | “Finance ops, CRM portal, call centers” |
Crisis exercises aren’t about predicting the hazard — they’re about practicing the decisions and current capabilities.
3. Layer Complexity: Don’t Jump Straight to Apocalypse
Think of scenarios like building fitness:
| Exercise Tier | Example |
| Warm-Up | Small system outage + social media rumor |
| Mid-Level | Regional extreme weather + employee injuries + media interest |
| Full-Scale | Coordinated ransomware + data exfiltration + public leak site + regulator demand |
You don’t run a marathon without finishing a 10K first. Same for crisis practice.
4. Look Outside Your Industry — Then Customize
- A banking breach might teach lessons to a healthcare team.
A chemical spill crisis might inform a tech company about regulatory engagement.
Use others’ crises as training fuel, but translate them into your operating reality, cultural context, and risk environment.
A five-hospital nonprofit won’t respond like a Fortune 50 investment bank — and shouldn’t.
The “We Only Trained for Cyber” Approach (and How It Failed)
Based on lessons from real organizations.
One organization invested heavily in cyber readiness — tabletop exercises, vendor-led incident response drills, even dark-web monitoring. But when we conducted an enterprise-wide resilience review, physical disruptions were also high on the risk register list: severe weather, facility shutdowns, and workplace incidents.
Then reality hit.
A powerful tornado tore through one of the company’s primary manufacturing sites, forcing a full shutdown. Because there was no business continuity plan in place, teams scrambled to make decisions on the fly — locating backup suppliers, determining production priorities, and figuring out how to communicate with stakeholders. The result? It took weeks just to restore partial operations.
Lesson: With a tested continuity strategy, that recovery could have been significantly faster, potentially saving the company millions in lost revenue and market share.
The “Balanced Risk Training” Example
Modeled on multiple successful resilience-focused client programs
Another company had a similar risk profile: cyber threats were a major concern — but so were severe weather events, facility outages, and supply-chain disruptions. Instead of preparing only for digital incidents, leadership built a blended exercise program that included:
- Ransomware impacting production systems
- Tornado warning and facility evacuation exercise
- Workplace violence incident with media interest
- Supplier shutdown during critical production period
So, when a powerful tornado struck one of their major manufacturing sites, the team didn’t freeze. Crisis leadership activated immediately. Employee accountability procedures kicked in. A business continuity playbook guided decisions on alternative production routes and customer communication.
Within days, critical operations were shifted to another facility, and customers were kept informed — reducing downtime and protecting trust.
Outcome: They didn’t need to predict a tornado — they prepared for physical disruption with the same discipline as cyber risk. That preparation kept the business moving when it mattered most.
Related: The Real Cost of a Tabletop Exercise: What Goes Into Creating a Successful One
Common Mistake to Avoid
Don’t pick scenarios because they’re “sexy.”
Terror attacks are dramatic — but vendor outages take down businesses more often.
Hollywood disasters make good headlines — but payroll system failures make real crises.
Select scenarios based on impact + likelihood + maturity gap, not adrenaline.
Quick Checklist: Build Your Scenario Plan
Your Crisis Scenario Readiness Checklist
✅ Identify your top five (there might be more) mission-critical risks
✅ Prioritize scenarios that stress leadership decisions, not tech troubleshooting
✅ Run at least one cross-functional scenario per quarter
✅ Validate assumptions: roles, comms, escalation paths, external stakeholders
✅ Debrief honestly — lessons aren’t learned until they’re validated (yes, “Lessons-to-be-Learned” matters!)
Do that consistently and you’re 80% ahead of your competitors.
Final Thought: Crisis Planning Isn’t About Fear — It’s About Confidence
Here’s something I tell every executive team:
You don’t train for the disaster; you train for the uncertainty.
The world will keep throwing curveballs. Prepared organizations don’t predict — they respond with clarity, trust, and speed.
And that begins with choosing the right scenarios to rehearse.
Want to Go Deeper?
If you’re building or refreshing your exercise program, or you’d like a curated scenario playbook — reach out. Our team at PreparedEx has spent two decades helping organizations stress-test their programs through realistic, decision-focused scenarios.
Curious how your current exercise program compares to industry-leading practice?
✅ Connect with us
✅ Download our free Crisis Exercise Guide
✅ Join the conversation at the International Crisis Management Conference
No hard selling just insight, lessons, and better preparedness.
Ready to pressure-test your preparedness? Let’s make sure your next crisis is a rehearsed one.
