“That Would Never Happen”: Finding the Right Level of Challenge in Resilience Exercises
During a training session some time ago, I raised a scenario that had previously occurred at a local acute hospital.
The response from another colleague was immediate:
“That would never happen.”
Except it had.
It was not a hypothetical situation I'd invented to be difficult, nor was it an implausible chain of events created for dramatic effect. It was something that had already happened in a real healthcare system, with real operational consequences.
That exchange stayed with me because it highlighted one of the most common risks in resilience planning: the tendency to dismiss scenarios that feel unfamiliar, uncomfortable or outside our own experience.
But there is another risk at the opposite end of the spectrum...
Sometimes scenarios are not dismissed for being too difficult. Instead, exercises are escalated so quickly and so relentlessly that meaningful learning becomes almost impossible.
Good exercising sits somewhere between the two.
It should challenge assumptions without becoming implausible and create pressure without manufacturing inevitable failure. Most importantly, it should help organisations understand what works, where resilience begins to strain and what needs to improve.
The Problem With “That Would Never Happen”
When people respond to a scenario by saying it would never happen, they are often making a judgement based on familiarity rather than possibility.
They may mean:
“I have never seen that happen.”
“That has not happened in this organisation.”
“We have controls that should prevent it.”
“It sounds too extreme.”
“It would require too many things to go wrong.”
Unfortunately, incidents have a habit of ignoring what feels comfortable or familiar.
Controls can fail. Systems can behave in unexpected ways. Several smaller issues can combine into something much more serious. Existing operational pressures can reduce an organisation’s ability to absorb disruption.
Events do not become impossible simply because we have not personally experienced them. However, unfamiliarity alone is not a good enough reason to close down the discussion.
I'm not saying that every exercise needs to involve an extraordinary, once-in-a-generation catastrophe. Scenarios still need to be credible and relevant to the organisations taking part.
Sometimes the scenarios that receive the strongest initial resistance are the ones that reveal the most important assumptions.
Scenario Planning Is Not About Predicting the Future
Exercises are sometimes treated as though their value depends on whether the exact scenario could occur in precisely the way it has been written.
But scenario planning is not an exercise in fortune-telling. It is a vehicle for exploring capabilities.
It allows an organisation to examine how it would:
recognise and assess disruption;
communicate during uncertainty;
escalate concerns;
make decisions;
prioritise critical services;
manage dependencies;
implement workarounds;
maintain leadership and coordination;
recover normal operations.
The precise sequence of events may never occur.
The weaknesses exposed by the discussion may still be entirely real.
A scenario involving digital disruption, for example, may reveal that alternative communication methods are poorly understood, contact information is unavailable offline or decision-making responsibilities are unclear.
Those findings remain valuable even if the specific fictional outage never happens.
The value is often less about predicting the incident and more about understanding how the organisation responds when normal arrangements are no longer reliable.
When Exercises Go Too Far
While scenarios should not be dismissed simply because they are difficult, harder does not automatically mean better.
In another exercise, the opening inject involved intermittent issues in several IT systems.
This was a useful starting point.
It created an opportunity to explore how the problem would be identified, how staff would communicate, who would be informed, what alternative arrangements were available and when business continuity plans might be activated.
Then the second inject arrived.
The issue had become a national incident and effectively everything had failed. There was no in-between.
The escalation was so rapid that the exercise moved almost immediately from a manageable operational disruption to an overwhelming crisis.
At that point, it became difficult to understand what was actually being tested.
Participants had very little opportunity to demonstrate what their plans covered, where their arrangements worked or where a specific gap existed.
Instead, each possible response risked being defeated by the next development.
If every workaround is immediately taken away, the exercise no longer tests whether arrangements are effective.
It simply proves that any organisation can be overwhelmed.
Under the right circumstances, every organisation can.
That is not a particularly insightful finding.
Injects Should Leave a Trail to Follow
A useful exercise should give participants a clear enough trail to follow.
Each inject should act like a breadcrumb: providing new information, prompting a decision and allowing the consequences of that decision to be explored before the scenario moves on.
For example, an initial inject involving intermittent problems with IT systems might be followed by:
increasing numbers of staff reporting access issues;
uncertainty about the cause or likely duration;
pressure on alternative communication routes;
difficulty contacting a particular team;
conflicting updates from different sources;
a decision about whether to activate continuity arrangements.
That progression allows participants to assess the situation, apply existing plans, test workarounds and identify the point at which those arrangements begin to strain.
By contrast, jumping almost immediately from intermittent disruption to a national incident where everything has failed removes the trail altogether.
Participants are no longer able to follow the development of the incident or understand how one decision leads to the next. They are simply presented with a much larger problem.
This can quickly become disengaging.
If every proposed action is overtaken by another escalating inject, participants may begin to feel that there is little value in offering a response.
The exercise starts to feel predetermined: whatever they do, the scenario will simply become worse.
At that point, people can stop actively testing the plan and begin waiting for the exercise to end.
Engagement depends on participants believing that their decisions matter.
Disengagement is not necessarily evidence that participants lack resilience or understanding. Sometimes it is a sign that the exercise has stopped giving them meaningful decisions to make.
Good injects should create momentum, not confusion.
They should allow participants to follow the thread of the incident, see the effect of their decisions and understand where their arrangements remain effective and where the breadcrumbs finally lead to a genuine gap.
Exercises Should Test Plans, Not Defeat Participants
There can sometimes be an unspoken assumption that an exercise has only been successful if participants struggle.
A smooth response may be interpreted as evidence that the scenario was too easy.
Facilitators may then be tempted to introduce increasingly severe injects until something breaks.
But the purpose of an exercise is not to make participants look incapable.
It is to create useful evidence.
A valuable exercise outcome might be:
“Our existing plan covered the initial disruption well, but we identified a weakness in how alternative communication arrangements are shared.”
Or:
“The escalation process worked, but the decision-making authority during prolonged disruption was unclear.”
Or even:
“The plan worked as intended, and staff were able to apply it confidently.”
That is not a failed exercise.
Demonstrating that arrangements are effective is also a legitimate form of assurance.
The goal should be to understand where resilience holds and where it begins to weaken, not to keep increasing the pressure until everyone is left with no credible options.
An exercise should create constructive pressure, not engineer helplessness.
The Importance of Exercise Objectives
Well-designed exercises should begin with clear objectives.
Before creating the scenario, planners should understand what they are trying to learn.
The objectives might be to test:
activation of a business continuity plan;
alternative communication arrangements;
senior decision-making;
incident command structures;
coordination between teams;
loss of a critical supplier;
service prioritisation;
recovery following prolonged disruption.
Injects should then be designed to explore those objectives, with each development serving a purpose: prompting a decision, testing an assumption, exposing a dependency or requiring participants to use part of the plan.
Using IT disruption as an example, a progressive exercise might begin with intermittent problems, with later injects introducing:
uncertainty about the cause and expected duration;
increasing pressure on alternative communication channels;
difficulty contacting a key group;
conflicting information from different sources;
a need to prioritise limited technical support;
a decision about whether to activate formal continuity arrangements;
an extended recovery period.
This still creates escalation.
It still places participants under pressure.
But it allows the organisation to follow the response through in a logical way and identify where its arrangements genuinely begin to struggle.
By contrast, moving almost immediately to total national failure may generate drama, but not necessarily insight.
Finding the Productive Middle Ground
Exercises need challenge.
A scenario that is too simple, too predictable or too closely aligned with existing plans may only confirm what the organisation already believes.
It may allow participants to move through familiar actions without confronting difficult decisions or hidden dependencies.
But an exercise can also become so extreme that the learning is lost.
The productive middle ground is a scenario that is:
Credible: Participants should be able to understand how the situation could arise, even if it is unusual.
Relevant: The scenario should connect to an organisation’s services, risks, dependencies and operating environment.
Stretching: It should create uncertainty, pressure and difficult decisions rather than simply rehearsing routine actions.
Purposeful: Every inject should relate to an agreed exercise objective.
Progressive: Escalation should allow participants to respond and make decisions before the situation changes again.
Constructive: The exercise should help identify improvements rather than simply demonstrate that failure is possible.
A good exercise should create enough discomfort to encourage honest reflection, but not so much chaos that the only conclusion is that everything is broken and we may as well give up.
Better Questions for Exercise Planners
When developing or facilitating an exercise, it may be useful to move away from asking:
“How can we make this harder?”
“What else can we take away?”
“How can we catch participants out?”
Instead, ask:
“What are we trying to learn?”
“What decision should this inject prompt?”
“Which part of the plan are we testing?”
“Does this escalation remain credible?”
“Have participants had time to respond to the previous inject?”
“Are we allowing the organisation to demonstrate what already works?”
“Will this produce a specific and actionable finding?”
These questions keep the exercise focused on learning rather than performance.
They also help create a safer environment for participants to be honest.
People are more likely to identify gaps, question assumptions and acknowledge uncertainty when they do not feel that the exercise has been designed to make them look incompetent.
Challenge Assumptions, But Do It With Purpose
“That would never happen” can be a dangerous phrase in resilience planning.
It can prevent organisations from exploring credible risks simply because they sit outside previous experience.
But the answer is not to create scenarios where every system fails, every workaround is removed and every decision is overtaken by another increasingly severe inject.
Both approaches shut down useful learning.
One refuses to explore the challenge.
The other overwhelms it.
Good exercises should challenge confidence without destroying it. They should test plans without deliberately defeating them. They should expose gaps without manufacturing helplessness.
The aim is not to prove that an organisation can fail. Given enough pressure, any organisation can.
The aim is to understand where its resilience holds, where it begins to strain and what needs to improve before a real incident finds the answer for us.
Because “that would never happen” is rarely a conclusion.
More often, it is an assumption waiting to be tested.
Need Support With Exercise Planning?
If your organisation needs support designing, facilitating or reviewing a resilience exercise, Horizon Planning & Resilience can help.
Get in touch to discuss an exercise that tests what matters, without losing the people taking part.
