Master of Disaster: Designing Exercises That Stick - A conversation with Tim Klaassen

Introduction to Crisis Exercises

0:00mechanism that you want to trigger there, create realism in the exercise, therefore it feels realistic. And because it feels realistic, people are immersed. And when people are immersed, it's basically just smooth sailing from there. Hello, everyone. This is Belen Santaolalla from the Conductor Crisis Exercise Platform.

Crisis Designer Podcast Introduction

0:31And you're listening to the Crisis Designer Podcast. This show is where we explore ideas, practices, and tools that help you design meaningful crisis exercises. So if you work in crisis management, business continuity, cyber resilience, or organizational preparedness, this podcast is for you. Today, we're joined by Tim Klassen, Senior Crisis Management and Business

1:01Continuity Consultant at PwC Netherlands, part of PwC's Cyber, Forensics, and Privacy practice. His organization supports organizations across sectors in strengthening their resilience from crisis management frameworks and business continuity planning to cyber incident preparedness and simulation exercises. Tim works closely with clients to design and deliver crisis simulations, helping teams not only respond effectively under pressure, but also understand how the decisions

1:33impact the wider organization. Tim, welcome to the Crisis Designer Podcast. How are you today?

Guest Introduction

1:40Thank you. Doing well. Thanks for having me. I was really looking forward to having this discussion with you. Nice. Okay, well, let's start then. Can you describe what is your role and how you support organizations in building crisis readiness? Yeah, sure. So it varies. You've already covered quite a bit in that introduction there. Looking at crisis exercising specifically, yeah, you're sort of the

2:10master of disaster sometimes. So you bring the misery to your participants. But it's, of course, it's broader than that. So as you mentioned already, of course, it's a varying palette of work that you do in the background, more organizational, more governance related, designing structures, analyzing business impact, that sort of stuff. And it's sort of that bulk of work that builds resilience that you

2:47want to want to take forward and put into fictional practice in an exercise. And in that sense, you try to make as good of a translation of the client's resilience context and translate that into exercising needs. And yeah, doing so should result in a few key objectives for the exercise. And that's sort of what you I think are, yeah, it's probably your key duty in that sense. Because it's only in the moment of the exercise

3:28itself when you are, well, the master of disaster, so to say. So it's much more than that. It's really trying to to give meaning to an exercise, to make it useful, you know, make it worth everyone's time. Oftentimes, you see that crisis management teams are, well, they consist of very senior people with very busy agendas. So you have to, first of all, make it worth their while and make them feel like they've learned something. And, well, if you succeed in that, that should also, more or less by definition, mean that you've also increased resilience overall.

4:03I love it. You should, you should put master of disasters, bringing misery to participants in your LinkedIn profile. I think that's really clear what you're doing. But how, how, how did you end up being this? How did you end up in this line of work? Um, that, that would be, uh, well, derived straight from my background, um, during my studies. So, um, I studied, uh, public administration, which is internationally not really that wide of a widespread of a concept, I think. Um, so business administration is, um, and public administration is basically the, uh, public sector.

4:42Uh, version of business administration. Um, and so that was for my bachelor's and then for my master's, um, I, uh, followed up in that same, uh, line of studies. Um, but then with a specialization on crisis management and security policy. Um, well, you can already sort of sense where that's going. Um, so, uh, yeah, that was, uh, the sort of starting point, uh, for the focus of my career. And, uh, yeah, from that point forward, you start orienting, uh, for a job and, uh, uh, I guess, yeah, PwC was the perfect fit, uh, at that moment and so far still is. Um, so yeah, that's, uh, how I ended up here.

Crisis Readiness in Practice

5:25Okay. Um, when you work with clients, what does being prepared actually mean in practice? Um, so yeah, that's, that's a spectrum. So, um, it, it has many sides to it. Um, I'll list a few. So planning is one thing. Um, but everybody with a bit of experience knows that, uh, you know, a plan will only last so long during a real crisis. Um, so if, if, if such a plan is not, um,

6:02I guess, supported by its users, then it will be thrown out of the window straight away. Um, so there is definitely also a human component. Um, there is a component of experience, um, either through real life, uh, yeah, incidents and crises or through thorough exercising or a combination of, of the two. Um, and, um, yeah, it also, I guess, depends on what type of mentality you attach to that. So, um, and that's, I think, tied to the type of organization that you're dealing with. So you have public organizations that have, uh, a very operational focus, um, directly ties to the wellbeing of citizens, for example, or you have, um, private organizations, but that play, for example, a key role in either, uh, nationwide logistics,

6:59or, um, perhaps deal with, um, dangerous chemicals or, well, any other, uh, type of key process or, yeah, strategic objective that, um, already sort of breathes a sense of, we need security. Um, and that sort of already attracts a type of person, I feel like. Um, so that's, that's definitely something that you can notice in the room, right? So, um, um, operational people, although perhaps through the years might've grown through strategic, strategic, strategic levels, um, might still be very hands-on, you know, and very involved with, oh, well, the crisis situation, then let's jump in and be as involved as we can.

7:42Um, so preparedness in that sense is a mentality. It's an effort. It's, um, definitely not a checkbox exercise. It's sort of, uh, uh, it's a, it's a, it's a condition, you could say. Um, I think that's, that, yeah, yeah. In that, in the sense that whenever something would occur, a certain disruption or whatever type of emergency, that you are immediately ready to respond. And I guess, just to really shorten it, uh, that's the definition, I guess, uh, various aspects, I would say.

8:22It makes, makes sense. And how, having that in mind, that, uh, condition aspect of it, how do you approach designing crisis simulations that reflect real organizational complexity? Yeah. Yeah. So, um, I guess, um, uh, the, the easy answer is that depends, uh, it's, um, uh, it, it's rarely just about the exercise. So, um, looking at real life situations, it's really like asking yourself and the client, like,

8:58what's, what's, what's your sort of resilience challenge, right? Um, what are you, what, what issues are you facing? Um, and, uh, and going forward from there. So perhaps the client is like, yeah, we should do exercising and, um, you know, make it a simulation really stressful. Um, I want to have a real life experience and, um, yeah, let's, let's test this organization. You know, let's, let's, let's expose the gaps.

9:28Um, I guess, uh, I, I get the ambition and I love the energy. Um, but, um, it is always good to sort of take that step back. And as I said, look at the larger picture, um, as to see what are your resilience challenges and perhaps first work on those. Like, um, do you have a plan that you are happy with that is extensive enough for you, but not too extensive are your key crisis stakeholders or perhaps, you know, even a step back and sort of incident managers, um, also happy with this plan.

10:01Are they using it? Um, have they made perhaps contributions to it? Um, is it easy to work with? Well, and those are all a whole host of questions. Like, what are you even practicing if you want to do an exercise? And if those questions already perhaps result in more questions or a lot of uncertainty, um, then that's definitely a sort of a first step to take and, um, in preparation of the exercise. Um, and also, um, if not, then perhaps to consider toning down a bit your ambitions for the exercise.

10:34Um, so I, I guess that, that would be the approach to sort of see the underlying resilience challenge and see how ultimately an exercise would be a good fit to improve and test. Of course, of course, very valid, but there are conversations to be had before him.

Good Exercises vs Behavior Change

11:01In your experience, uh, what do you think separates a good exercise to one that genuinely changes behaviors? Um, oh, that's, that's a great question. Um, does, can I ask a question back? Does that imply that a good exercise may not change behavior? Hmm. Uh, well, it depends on the training objectives, I guess. Um, but yeah, maybe, um, exercises are designed to change beliefs around the plans around what is expected you to do and the beliefs are expected to transform into different actions.

11:49If the beliefs, if the beliefs, if the beliefs are changed or not, what are you, what's your take on it?

11:56Um, yeah, I, I guess so. Um, I guess so. In that sense, uh, changing beliefs, especially using just one exercise, um, I guess that requires an element of shock, right? Uh huh. I mean, it's, yeah, especially if you consider how some stakeholders might have been working at an organization for years, like how, um, how, how prevalent and how convincing the beliefs they've built up over the years might be to themselves.

12:38That's not something that's not something that you easily change, I think. Um, but an exercise is definitely a starting point and a great exercise. Yeah. Might do more. So it's, I think, I guess it's, uh, the, the, the, the, the point of getting the ball rolling, um, during an exercise. So to, to, to indeed get the discussion going to, I guess, let various beliefs conflict perhaps with participating stakeholders and being able to capture that conflict, um, or at least, well, it doesn't even have to be conflict.

13:15It can also be consensus, but we are talking about a change of beliefs and my mindset and perhaps behavior ultimately, um, capturing that as well as you can and, um, and turning that into a way forward. Right. Um, because of course, you know, after the crisis is over during the exercise, people go back to business and, you know, people live busy lives, especially at a strategic level. So, um, before you know it, after a few weeks, all of the potentially changed beliefs and even more potentially changed behaviors, um, might just ease back into the usual, so to say.

13:55Yeah. So there is sort of this very narrow window opportunity to, um, to create change, but it has to be done. I mean, I think also for a large part in the follow-up of the exercise and not just the exercise itself, but that requires also internally in an organization, um, in certain amount of commitment resulting in a capability that's at least capable of self-learning. Self-learning basically, uh, there's a cycle of evaluation, reflection improvement.

14:26Um, and if that's not there, um, then it's going to be very hard. And this is also something I think that, for example, with, um, you know, exercising for compliance, for example, um, valid reason naturally, but it's also, um, you know, with that type of, um, motivation. Um, it's, I think it's more likely that you will see, um, a less prevalent self-improving structure within the crisis management, uh, capability.

15:02So I guess that's, that's sort of what it hinges on. Mm-hmm. That's very interesting. So it looks like, you know what you're talking about and that you have a lot of experience and you've been thinking this through. Um, and that's, um, really valuable, uh, when you're, you're just, you don't rush to create an exercise just because it's like the next, the next task, but you're doing like all the thinking on what this is. Uh, what's the impact of what we're doing, what the next steps should be. Um, and because you have expertise I've, uh, read, uh, I've been checking your LinkedIn and I've seen that you've been, uh, co-hosting a crisis simulation masterclass.

15:43Um, is it, uh, can you just tell us a little bit about the key takeaways from that experience? Um, uh, yeah, well, um, that's, that's a good question. Um, the key takeaways from that experience. Um, do you mean like key takeaways, uh, personally or for the participants of the masterclass?

16:17For the, for the participants. Oh, okay. Yeah. Um, well, I guess, um, a, a primary one, I think, um, would, would be one that I think overall the sector of crisis management, consulting, exercising, um, it has sort of a cool factor to it, if you know what I mean. Um, crisis, cyber attack, power outage, forest fire, you know, name a few of those, uh, typical scenarios.

16:54And it's something that, you know, people can get lost in, you know, thinking about the most amazing scenarios. Um, complexities involved organizations, victims, et cetera. However, the point of crisis exercising is not just fooling around, you know, uh, it's not like an escape room where we're just having a great team building exercise. Um, although team building is definitely sort of an element, uh, that's strengthened. Um, there is more to it.

17:26Like I just explained, you know, it's, it's part of a larger picture and you have to take it more seriously, um, than just the scenario, which is so to say the fun part, you know, where you can really let your creativity go. But there is sort of a, a canvas that the creativity has to be unleashed upon. And that canvas is the pre-work. Um, and in that sense, um, the clarity of setting strong exercise objectives, um, is also the foundation that sort of ties the injects slash injections, uh, to, um, the success of the exercise.

18:06So, um, for the ones listening that don't know, like an inject is a stimulus, right. To further the scenario in a crisis exercise. So for example, an email, a news article, et cetera. Um, if you have an injection that cannot be tied to any of the objectives that you've set, um, either directly or indirectly, you should strongly ask yourself, what's it even doing here? Um, and I think that's in the masterclass, probably like the first and main lesson that we are really thinking this through, right?

18:45Like we are not fooling about this is, uh, this is meant to prepare an organization and people within the organization in a meaningful way for a certain calamity. Um, and although you can probably think of great versions of, well, monstrous calamities, um, it's the art of tying it all together into a meaningful, um, risk-based might I add, um, approach to scenario design.

19:18And I think that realization is, uh, well, I think one of the key takeaways. Nice. Great. So having that in mind that it's not about fooling around and just letting your creativity go bananas.

Designing Realistic Exercises

19:37You have a canvas where you start, is that the first step that you take when you're creating an exercise from scratch or what's your design process? Um, so, um, I, I guess so, um, you know, it's, it's, you know, you always have to start with, uh, with that initial conversation, um, getting to know the context, uh, getting to know the challenges. And then if you indeed get to a point where, um, you can start tying organizational objectives in terms of resilience to, um, the learning objectives for an exercise, um, yeah, that's definitely the starting point.

20:21Because that sort of decides what type of exercise is a good fit, what should the exercise look like, what type of scenario, um, does that require, um, and ultimately the granularity of, um, the injects that you are designing for the exercise. Um, it all hinges on the starting point that the learning objectives.

20:51Um, and to decide a scenario, where do you get inspiration from? Uh, I guess the client context. So, um, depending on who, uh, the exact, um, asker, you know, who is asking for the, the exercise, um, or, um, what specific stakeholders an organization has internally. Like, um, you know, perhaps an organization does not have a clear, uh, BCM owner, for example. Um, makes things sometimes a bit harder to get the clearest picture.

21:25Um, having that, uh, conversation with, uh, key stakeholders, um, within the organization that are either busy with, with risk management, business continuity management, that are building a crisis management capability. Um, perhaps people working on physical security, um, people that can tell you something, um, with a certain amount of certainty about what types of risks are relevant to this organization in terms of impact and likelihood.

21:56Um, and perhaps what vulnerabilities are specifically out there, you know, risks that are harder to mitigate, um, that might require more in terms of live crisis management because it's sort of a chronic vulnerability. That's the sort of source that you are hoping for, um, in the, in, in, in the, in the whole trajectory of developing the exercise. And yeah, it should be a good starting point for, um, um, for scenario writing.

22:28If you don't have that, then, um, it's, it's more up to yourself seeing given the sector that an organization is active in, what are prevalent risks, what real life, um, crises have occurred. Um, to sort of get more of an advisory role, I guess, um, and, and, um, put their organization more into, in, into the context that they operate in. Um, but I'm, I guess that's, that's really, um, for organizations that are a bit lower in maturity, because yeah, the higher in maturity, the more likely that this type of thinking and conversations have already taken place.

23:09Got it. Got it. Okay. And, um, how do you do it so the exercises feel realistic rather than theoretical? Um, so that, that's, uh, um, the, the, yeah, the very straightforward answer would be to make it realistic. So, yeah, in order to feel realistic, it has to be realistic. So, um, and I guess there's a few, uh, facets to that.

23:40So, um, first of all, again, scenario wise, does it make sense? Of course, you know, there's always black swans and you don't know what you don't know in terms of, um, the type of unexpected crisis that might hit your organization. Um, but there is a limit to the scope of, um, the imagination that participants will have, especially when you have more technical or operational people. Um, it's really important that the sort of mechanisms behind cause and effect of a scenario are valid.

24:14Um, for example, like a power outage or an IT outage, the way that, first of all, the outage occurs, but also the way that an organization takes effect from that outage. Um, the mitigating options an organization has for that specific outage. Um, it's good to be very aware of that because as soon as your scenario sort of disregards, um, those aspects, it's very likely that people start challenging, um, the scenario.

24:47And that immediately breaks with the immersion of an exercise. So realism, um, has to be facilitated from a sort of scenario mechanical point of view. And at the same time, I think also just the overall experience, right? So how would you experience a crisis in real life? And then we would try to get as close as possible to that experience.

25:17So looking at the audience of your exercise, knowing who you will have participating, knowing what their sort of day-to-day work looks like, how an incident may occur, how a crisis may occur, or an escalation between the two takes place, how the communication lines go. So, but also, and that's sort of what I'm going here with, what does it look like? Um, what's the overall tonality of it? Um, what's the, um, the sort of ambience or the direct environment that you're in whenever this happens?

25:53It all sort of assists into this greater, uh, objective for the facilitation, at least to create immersion. Um, and I think that's sort of the, the line or the, the, the mechanism that you want to trigger there. Create realism in a, in the exercise. Therefore, it feels realistic. And because it feels realistic, people are immersed. And when people are immersed, it's basically just, uh, smooth sailing from there because they are in, you know, they are taken, uh, by the situation.

26:31That we've created for them. And, um, yeah, from there, it's just a matter of managing that overall vibe, basically. Got it. And when that immersion happens, which is magic, by the way, how do you make sure that it's tastes like the, like that? I mean, how do you, um, make sure that you have the right level of complexity, that it doesn't go to the too easy zone.

27:04They get bored or disengaged or they don't go to the too complex, too overwhelming. So where they just pull back and they just disconnect. How do you make sure that they are, uh, in track all time? Um, I, yeah, well, I think first of all, um, the things that I just mentioned that sort of lead to the immersion, that's sort of something that needs to be monitored and prepared. I would say, first of all, over the full extent of the exercise.

27:36So you cannot have a strong first round to sort of get people into it and then be like, okay, well, from here on the forward, we should be good. So this is something that you have to sort of maintain. So the scenario has to be very solid from A to Z. Um, you cannot start slacking in a development towards the end. Um, but during the exercise, um, you want to be able to monitor live what's sort of going on in the crisis management room, basically. Um, you want to listen in closely to the conversations that are being held.

28:12Being held to the structure of meetings. Um, what does it look like? Is it starting to become a mess or is it looking too easy? You know, are people sort of leaning back, um, feeling like, like they've got things under control, either rightfully so or not, because perhaps they are not aware of certain aspects of the scenario, but regardless. So what you want to do with that monitoring, um, if you notice that you have a group that is either under too much load or under too little load, um, you want to have the option to increase or decrease the pressure on the fly.

28:50So, and that means that you on the, in the prepare phase of the exercise, you want to have a few options created, like thinking ahead of what, what kind of direction might this group go in? What's the most likely response? And perhaps have a few less likely likely options as well, because you can be surprised from time to time. Um, that's already a good start to think ahead. Um, at the same time, you also only have the flexibility to indeed whenever something occurs that you really didn't expect, you know, uh, participants really start going into a direction that you didn't anticipate.

29:23Um, to have the option to on the fly, either take out or add specific injects, um, well, more or less improvised, but as you are aware, as the creator of the scenario, you can still sort of fit it in with, um, with the broader picture. And something that's then really helpful is to have someone from the organization on board with the facilitation team. So if you really have, um, for example, you know, a team that is looking like it's having a too easy of a time, um, to really have an impactful, fresh out of the box injection based on the knowledge that the internal stakeholder of that organization has provided to you.

30:12That's a great way of getting, uh, well, the sweat going again, so to say, um, at the same time, you want to be able to, um, remove injects on the fly as well. So to, you know, if you really feel like, um, things are really derailing, um, at that point, you've already sort of taken note of whatever lessons should be derived from that. Right. So, you know, okay, this is what probably went wrong. That's why we are in a mess right now. Um, lessons were learned. Let's try to sort of keep the exercise and the team a bit more sustainable and try to see what else, what other kind of lessons we can learn from it by, you know, having the rest of the remaining exercise be still fruitful.

31:00And in order to do so, you have to take some pressure off. So for example, either taking out injects that you had planned, um, that would add even more pressure or to perhaps add injects that are a bit more relieving. Um, so to take out an issue that, uh, the crisis management team was handling, um, or in a likely case, they were managing many issues at the same time. Um, um, take one or two out, just solve it, like, um, create a, uh, a spin on the narrative that makes sure that, um, whatever issue they were having or one of them is just solved for some reason.

31:38And then they can just take it away, have more resources in that room able available to, uh, focus on the other issues at hand and yeah, be able to regroup a bit more effectively. I guess that's the sort of, uh, the gas pedal that you want to balance for a bit. Nice. Okay. And can you tell us a little bit about the most challenging scenario or exercise that you had to put together? Um, I, I would say generally the most challenging ones are the most technical ones.

32:15So, um, especially with, uh, very operational hands-on teams, um, that are very aware of how their organization and their day-to-day operation works. That can be very challenging because it, it, it requires various rounds of validation, proper research, um, and even then you're not sort of risk-free. Um, so it's also a bit of a, I guess, expectation management. You're sort of also hoping that the participants have, uh, a certain bandwidth of tolerance for, uh, any, uh, fact or inject or whatever that deviates a bit from what would be otherwise, uh, 100% true to, um, the reality.

33:02Um, yeah. And, and, and from that point forward, it's, it's basically a matter of to what information resources do you have access? So technical can mean a whole host of things like, um, IT technical, financial technical, um, perhaps, um, climate or ecology, ecologically related, uh, in a technical way. Um, again, electricity technical, or if you have, uh, for example, a power plant or any manufacturing site for that matter.

33:39Um, um, machines, conveyor belts, um, the more detail there is, and the more operational the exercise objectives are, um, the more challenging it is for us to, um, really get into that context and really deliver something that sticks. Um, um, with more strategic teams, um, um, you notice that there is more, I guess, a conceptual way of thinking and looking at things. Um, so presenting incidents or a full crisis as it is, um, might be a bit easier, um, because there's a bit more tolerance for what's possible and what's not.

34:23Partially because, well, perhaps people want to feel prepared for the black swan and partially because people might not fully be aware of what's true and what's not. So, um, yeah, that's, that's sort of, uh, I guess, uh, the first thing that comes to my mind when it comes to, uh, the difficulty level for us to, uh, deliver a strong exercise. Got it. Got it. Okay.

Final Thoughts and Advice

34:45Well, Tim, this is the last question. I always like to, uh, ask this question to my guests. Um, so if you could, uh, talk to a younger version of yourself, what would you tell him, uh, someone who is starting out in this field? Ooh, um, that, that's a very fun question. Um, I think to make it personal, um, I've, so personally, I've always had a sort of a great amount of respect for, for seniority.

35:17I think, um, my message to my younger self would be, you will be surprised how often very senior people are very unaware of how things move in their organization, how things should move in their organization. Um, um, period.

35:45Fantastic. Let's leave it there. Love it. Cool. Thank you. Okay. Well, thank you very much, Tim. It's been fantastic to have you in the show. We've learned a lot. I think there's a lot of thinking and, and I really like how you put all your knowledge, uh, into proper, uh, methodologies and how to approach, um, uh, exercise and, and readiness. So it's been really valuable. Thank you very much. And I really hope that you have a nice day.

36:15Appreciate it. Thank you so much for having me. It's been, it's been a blast. Thank you.