Training and simulation

Nobody wants training. They want people to behave differently when something goes wrong, and evidence that it happened.

Who is this actually for?

Two people usually share the decision, and they judge it differently.

A compliance owner needs the requirement satisfied and the evidence exportable. An operational leader needs the team to perform, and tends to be skeptical of anything that looks like a checkbox. Both sit in the same approval, so a program that satisfies only one stalls.

Why does completion prove nothing?

Everyone has run compliance training. A completion rate tells you people opened it.

The number worth tracking is what changed. Decisions made, time taken, where the exercise stalled, who had to be found, and whether the second run went better than the first.

1. What decision each participant made, and how long it took.
2. Where the exercise stalled, and who had to be located.
3. What changed between the first run and the third.
4. What a leader can report upward without editing it.

How often should exercises run?

Frequency is the variable that changes the outcome.

A tabletop that takes 2 days happens once a year and behaves like an event. An exercise that takes 15 minutes can run monthly and behaves like a capability program. Teams that move to short and regular tend to find gaps their annual exercise never surfaced.

Build or buy?

Building gives you scenarios that match your actual operating environment. Buying gives you cadence, measurement and someone else maintaining the content.

The honest test is whether anyone on the team has time to write, run and score exercises every month. If not, a build becomes an annual event again within 2 quarters.

What makes a program survive its second year?

Reporting a leader can use.

An exercise result that cannot be taken to a board or a regulator does not get funded again. That puts board reporting inside the program design rather than beside it — see explaining a security program to the board.

What people ask