Exercises, Simulations and Resilience Measurement

Introduction

Crisis management capability cannot be established by policy documents alone. Organisations become dependable under pressure when leaders rehearse decisions, test systems, expose dependencies, measure performance and convert evidence into improvement. Exercises and simulations provide controlled opportunities to examine how people, technology, processes, suppliers and governance arrangements interact during disruption. Resilience measurement complements exercises by determining whether the organisation can anticipate threats, absorb shocks, adapt operations and recover while protecting people, critical services, reputation and legitimacy.

This chapter presents an integrated approach to designing exercises, evaluating performance and measuring resilience maturity. It distinguishes tabletop, functional and full-scale exercises; explains how to formulate objectives, scenarios, injects and evaluation criteria; and introduces practical measures such as preparedness indicators, stress-test results, recovery performance and audit findings. The emphasis is managerial and applied: the purpose of an exercise is not to prove that a plan is perfect, but to generate credible learning and improve organisational decision-making.

Learning Objectives

By the end of this chapter, learners should be able to:

1. Distinguish among discussion-based, functional and full-scale exercises.
2. Design exercise objectives, scenarios, injects, assumptions and evaluation criteria.
3. Plan safe and realistic exercises involving multiple stakeholders.
4. Evaluate preparedness, response quality, resilience maturity and recovery performance.
5. Use audits, stress tests, indicators and after-action reviews to support governance.
6. Interpret exercise evidence critically and prioritise corrective actions.

1. Exercises as Instruments of Organisational Learning

An exercise is a structured activity in which participants respond to a simulated threat, disruption or crisis. Unlike a routine meeting, it introduces conditions that require coordination, judgement and trade-offs. A well-designed exercise tests not only whether participants know the plan, but also whether the plan is usable under uncertainty.

Exercises serve several purposes:

• Validation: determining whether plans, procedures and resources are workable.
• Verification: checking whether specified capabilities exist and can be accessed.
• Training: developing individual and collective competence.
• Integration: improving coordination across departments, agencies and suppliers.
• Discovery: revealing unanticipated vulnerabilities and dependencies.
• Confidence building: allowing leaders and stakeholders to practise under pressure.
• Evidence generation: producing information for risk treatment and investment decisions.

An exercise should be treated as an intervention in a learning system. Its value depends on the quality of the question being tested, the realism of the conditions, the behaviour of participants and the discipline of evaluation. A large exercise with vague objectives may produce less useful evidence than a short tabletop focused on one critical decision.

Exercise principles

Effective exercises generally follow six principles:

1. Purpose before activity. The organisation defines what it needs to learn before selecting the exercise format.
2. Realism without unnecessary danger. The scenario should be credible and challenging, but participants must understand that it is simulated.
3. Constructive independence. Controllers should enable learning rather than coach participants toward a desired answer.
4. Evidence over opinion. Evaluation should rely on observed actions, decisions, timings and records.
5. Proportionality. Exercise complexity should reflect organisational risk, maturity and available resources.
6. Improvement after performance. Findings must become assigned, funded and monitored corrective actions.

2. Exercise Types and Their Uses

Exercises can be classified by the degree of discussion, operational realism and resource mobilisation involved.

Tabletop exercises

A tabletop exercise is usually discussion-based. A facilitator presents a situation in stages and asks participants what they would do, who would decide, what information they require and how they would communicate. It is particularly suitable for testing:

• activation thresholds;
• delegation and escalation;
• crisis leadership behaviours;
• legal and ethical decisions;
• business continuity priorities;
• relationships with regulators, emergency services and suppliers;
• assumptions embedded in plans.

Tabletops should not become lectures or rehearsals in which the facilitator supplies the correct response. Participants should explain their actual decisions, constraints and dependencies. The facilitator records unresolved issues, contradictory assumptions and decisions that depend on unavailable information.

Functional exercises

A functional exercise places participants in their operational roles, often using an incident-management structure, communications platform or emergency operations centre. Actions may be simulated, but the command and control process is performed. Functional exercises test whether information is received, analysed, escalated and converted into coordinated action.

They are useful for examining cyber incident response, crisis communications, continuity management, emergency coordination, supply disruption and executive decision support. They can also test whether teams maintain logs, issue situation reports, protect sensitive information and transfer responsibility during shift changes.

Full-scale exercises

A full-scale exercise combines simulated command activity with field operations. It may involve facilities, vehicles, protective equipment, technical teams, volunteers, emergency services, hospitals, suppliers and public communications. It is appropriate when physical interaction or mobilisation is central to the risk.

Because full-scale exercises can create confusion, public concern or operational hazards, they require formal safety controls. The exercise must be clearly identified to relevant authorities, participants and potentially affected communities. Real emergency calls, public alerts or infrastructure interventions should not be initiated without explicit authorisation and safeguards.

3. Designing an Exercise

3.1 Establish the exercise purpose

The starting point is a decision or capability problem. Examples include:

• Can the executive team decide whether to invoke continuity arrangements within 30 minutes of a major technology outage?
• Can the organisation maintain essential customer services when two critical suppliers fail simultaneously?
• Can the incident team coordinate cyber containment while preserving evidence and meeting regulatory obligations?
• Can the organisation restore priority operations within its stated recovery objective?

A useful exercise purpose identifies the capability, disruption and intended learning. It avoids broad statements such as “test the plan,” which are difficult to evaluate.

3.2 Write objectives

Objectives should be specific, observable and linked to risk. A strong objective contains an action, a condition and a performance expectation. For example: “Given a loss of the primary data centre and incomplete information about restoration time, the crisis leadership team will prioritise essential services, assign decision ownership and communicate a justified operating strategy.”

Objectives should be limited in number. Three to six primary objectives are often more useful than a long checklist. They may address:

• command and control;
• situational awareness;
• decision quality;
• continuity of critical services;
• internal and external communications;
• resource mobilisation;
• protection of vulnerable people;
• recovery and transition.

3.3 Conduct a needs and risk analysis

Exercise design should be informed by risk assessments, previous incidents, audit findings, regulatory requirements, technology changes and organisational restructuring. The design team should identify:

• high-consequence scenarios;
• critical processes and minimum service levels;
• dependencies on people, premises, technology, utilities and suppliers;
• authority and delegation gaps;
• information requirements;
• recovery assumptions;
• populations that may experience disproportionate effects.

The scenario should be challenging enough to expose weaknesses but not so complex that the exercise tests confusion rather than resilience.

3.4 Build the scenario

A scenario establishes the initial conditions, hazard, affected systems, time, location and consequences. It should include enough information to make decisions while preserving uncertainty. Scenario realism can be increased through credible operational details, but excessive detail may distract from the objectives.

A scenario normally contains:

• context: the organisation, date, operating conditions and relevant background;
• trigger: the initiating event;
• impact: immediate consequences and affected capabilities;
• constraints: scarce resources, conflicting priorities or incomplete information;
• trajectory: how conditions may develop;
• end state: the point at which the exercise concludes or transitions to recovery.

The scenario should be approved through a safety and governance review. Sensitive information, personal data and security vulnerabilities should be handled according to applicable policies and law.

3.5 Design injects

An inject is a piece of information or event introduced into the exercise to stimulate a decision or action. Injects may be delivered through email, telephone, dashboard, media report, customer complaint, supplier message, regulator request or simulated sensor alert.

A useful inject has a clear purpose and a planned delivery time, although controllers may adjust timing to preserve learning. An inject register can include:

Injects should create meaningful dilemmas rather than artificial puzzles. For instance, a supplier’s uncertain restoration estimate may test prioritisation better than a sequence of predictable updates. Controllers should distinguish between planned injects, which structure the exercise, and contingency injects, which are used when participants need an additional stimulus or when the exercise must be redirected.

3.6 Establish rules of engagement

Rules of engagement define what is simulated, what is real, who may pause the exercise and how safety concerns are reported. They should cover:

• the exercise start and end signal;
• the words “exercise” and “real-world emergency”;
• prohibited actions;
• use of real systems and production data;
• media and public communications;
• confidentiality and recording;
• occupational health and psychological safety;
• emergency stop authority;
• accessibility and reasonable adjustments.

A safety officer or exercise director should be empowered to suspend activity when a real incident, injury, safeguarding concern or unacceptable operational risk arises.

4. Evaluation: From Observation to Evidence

Evaluation determines whether objectives were achieved and why performance occurred. It should not be reduced to a satisfaction survey. Participants may enjoy an exercise while critical decisions remain slow or poorly coordinated.

4.1 Evaluation criteria

For each objective, define observable criteria before the exercise. Criteria may concern:

• timeliness: whether action occurred within an agreed period;
• completeness: whether required steps or stakeholders were included;
• quality: whether decisions were reasoned, lawful and proportionate;
• coordination: whether responsibilities and dependencies were managed;
• adaptability: whether the team adjusted when assumptions changed;
• equity and ethics: whether vulnerable groups and rights were considered;
• documentation: whether decisions, rationale and actions were recorded.

A simple rating scale can support consistency:

The scale is useful only when anchored to specific evidence. “Good communication” is vague; “the incident lead issued a verified situation report to all designated recipients within 20 minutes” is observable.

4.2 Data collection

Evaluators should collect contemporaneous evidence, including:

• decision and action logs;
• timestamps of alerts, acknowledgements and escalations;
• copies of situation reports and public statements;
• system or communication records;
• resource requests and fulfilment times;
• observations of coordination and leadership;
• participant explanations during hot debriefs;
• outcomes against service and recovery targets.

Observers should avoid interfering with participants. They should record what happened, not infer motives. A useful observation format is: condition – action – consequence – evidence. For example: “The team received conflicting restoration estimates; it did not nominate an owner to reconcile them; the recovery priority remained unresolved for 25 minutes; evidence: decision log and controller timestamp.”

4.3 Evaluation scoring

When a numerical score is useful, an objective score can be calculated as a weighted average:

Here, S is the overall exercise score, rᵢ is the rating for objective or criterion i, and wᵢ is its weight. Ratings must use a defined scale, such as 0–3. The formula assumes that weighted averaging is appropriate and that criteria are sufficiently comparable. A score should never conceal a critical failure: an organisation may achieve a high average while failing a legally mandatory or life-safety objective.

5. Measuring Preparedness and Resilience

Preparedness and resilience are related but not identical. Preparedness concerns the existence and readiness of plans, people, resources and capabilities before an event. Resilience concerns how the organisation performs across anticipation, absorption, adaptation, response, recovery and learning.

5.1 Capability domains

A balanced measurement framework may examine:

1. Governance: accountability, risk ownership, escalation and oversight.
2. People: competence, staffing, wellbeing, succession and role clarity.
3. Processes: continuity plans, procedures, prioritisation and decision rights.
4. Technology and information: availability, integrity, interoperability and recovery.
5. Dependencies: suppliers, utilities, partners, regulators and communities.
6. Response: command, coordination, communications and resource mobilisation.
7. Recovery: restoration, adaptation, financial control and transition.
8. Learning: exercises, incident reviews, corrective actions and assurance.

Measurement should combine quantitative indicators with qualitative judgement. Numbers provide comparability, but they do not automatically show whether an organisation is resilient. A high plan-completion rate may coexist with obsolete plans, poor staff awareness or unrealistic recovery assumptions.

5.2 Preparedness indicators

Possible indicators include:

• percentage of critical processes with current continuity plans;
• percentage of designated roles with trained deputies;
• proportion of critical suppliers assessed and tested;
• percentage of emergency contacts validated within the required period;
• completion rate for planned exercises;
• percentage of corrective actions closed by their due dates;
• time required to activate the crisis-management structure;
• availability of essential data, facilities and communication channels.

Indicators require definitions, owners, data sources, reporting frequency and thresholds. A metric without an accountable owner becomes a descriptive statistic rather than a management tool.

5.3 Stress testing

A stress test examines performance under deliberately demanding but plausible conditions. It may involve a single severe shock or a compound scenario, such as a cyberattack during a power outage and staff shortage. Stress tests should identify assumptions, define boundary conditions and specify what constitutes failure.

A stress test can evaluate:

• maximum sustainable service demand;
• minimum staffing levels;
• duration of manual workarounds;
• restoration capacity;
• liquidity and emergency procurement;
• communications under degraded connectivity;
• supplier substitution;
• decision-making with incomplete or contradictory information.

Stress tests should avoid false precision. If a result depends on uncertain assumptions, report the assumptions and sensitivity rather than presenting one number as fact.

5.4 Recovery performance

Recovery should be measured using outcomes, not merely the declaration that recovery has begun. Common measures include:

• time to detect and acknowledge the disruption;
• time to activate the response structure;
• time to restore priority services;
• duration of unacceptable service degradation;
• percentage of priority functions restored by target time;
• backlog volume and clearance time;
• financial and operational loss;
• customer, employee and community impacts;
• time to complete corrective actions.

A useful service-availability measure over a defined period is:

A is availability over the measurement period, T is total scheduled service time, and D is downtime during which the defined service is unavailable. Both times must use the same units, and the service boundary must be stated. Planned maintenance, partial degradation and degraded but usable service require explicit treatment. Availability alone does not measure service quality, safety or equity.

Recovery performance can also be compared with a target. If the target restoration time is RTO and actual restoration time is t_r, the difference is:

A positive value indicates that restoration exceeded the target; a negative value indicates restoration earlier than the target. The comparison is meaningful only when the same service definition, start point and measurement method are used.

5.5 Resilience maturity

Maturity models provide a structured way to discuss development over time. A five-level model may be defined as follows:

Maturity is multidimensional. An organisation may be mature in emergency communications but immature in third-party resilience. Therefore, maturity assessments should report domain-level results and supporting evidence rather than one unqualified organisational label.

6. Audits, After-Action Reviews and Improvement

An audit examines conformity, adequacy or effectiveness against defined criteria. It may review governance, plans, training, supplier controls, records, technology recovery or regulatory requirements. Audits provide assurance, but they can miss dynamic weaknesses if they focus only on documentation.

An after-action review (AAR) is a structured learning process conducted after an exercise or incident. A strong AAR asks:

1. What was expected to happen?
2. What actually happened?
3. Why did the difference occur?
4. What should be sustained, changed or tested again?
5. Who owns each action, by when, with what evidence of completion?

The AAR should separate observations from recommendations. An observation is evidence of a condition or performance. A recommendation is a proposed response. The root cause may involve unclear authority, inadequate resources, unrealistic assumptions, poor interface design or conflicting incentives—not simply individual error.

Corrective actions should be prioritised by consequence, urgency, feasibility, dependency and recurrence. A practical action record includes:

Closure should not mean that an action has merely been marked complete. Assurance should confirm that the intervention operates as intended, preferably through a follow-up test.

7. Illustrative Case: Northbridge Health Network

This is a fictional illustrative case.

Background

Northbridge Health Network operates three hospitals, outpatient clinics and a shared digital patient-record platform. Its continuity plan stated that priority clinical services would continue during a technology outage. A previous audit found that contact lists were incomplete and that departments had different interpretations of “priority service.”

Problem and exercise design

The resilience committee designed a functional exercise around a ransomware event affecting the patient-record platform during a regional power interruption. The objectives were to:

1. activate the incident structure within 20 minutes;
2. establish a common operating picture despite incomplete information;
3. prioritise clinical services and allocate scarce generators and technical staff;
4. communicate safely with staff, patients, regulators and emergency partners;
5. initiate recovery while preserving forensic evidence.

Injects included a hospital report of delayed medication administration, a supplier estimate that changed from four hours to forty-eight hours, a media request for confirmation, and a regulator request for an initial impact assessment.

Analysis and performance

The incident structure was activated in 14 minutes, satisfying the first objective. However, the organisation initially produced three incompatible lists of priority services. The clinical lead resolved the conflict after 31 minutes, but the decision rationale was not recorded. A public statement was drafted quickly but omitted advice for patients who could not access appointments electronically. Technical staff began rebuilding a system before confirming evidence-preservation requirements.

The evaluators rated activation as 3, common operating picture as 1, prioritisation as 1, communications as 2 and recovery governance as 1 on a 0–3 scale. The weighted overall score was not used as a substitute for analysis because the low scores concerned safety-critical capabilities.

Approach and corrective action

The network created a single service-priority taxonomy approved by clinical, operational and executive leaders. It introduced a standard situation-report template, a decision-log requirement and a recovery gate requiring approval from information security, clinical governance and legal advisers. It also established a quarterly supplier restoration test and a manual medication-administration drill.

Outcome and learning points

A follow-up tabletop showed that departments could produce one prioritised service list within 12 minutes and identify vulnerable patients more consistently. The network learned that possessing a continuity plan did not guarantee shared priorities, that recovery speed must be balanced with evidence preservation, and that communication quality includes accessibility and practical guidance—not merely message distribution.

The case illustrates three principles. First, exercises should test interfaces between functions, not only departmental competence. Second, a high-level plan must be translated into operational decision rules. Third, corrective actions require retesting to demonstrate that learning has become capability.

8. Governance, Ethics and Technology

Exercise leaders have a duty of care to participants, affected communities and the organisation. Exercises involving health, financial, personal or security information require appropriate confidentiality, access control and retention arrangements. Data collected for evaluation should be proportionate and used for defined purposes. Individual performance should not be publicly exposed when the objective is system improvement, unless misconduct or legal obligations require escalation.

Leaders should consider accessibility, language, disability, caring responsibilities and the effects of crises on vulnerable groups. A scenario that tests service continuity should ask who is least able to use alternative channels or absorb delay.

Technology can improve exercises through digital twins, incident-management platforms, automated inject delivery, network simulations and analytics. Artificial intelligence may help generate scenario variations, classify observations or identify recurring themes in after-action reports. However, AI-generated content must be reviewed for factual accuracy, bias, confidentiality and inappropriate disclosure. AI should not independently determine exercise ratings or make high-consequence judgements about individual competence. Human evaluators remain accountable for interpretation.

9. Challenges and Limitations

Exercises and metrics have important limitations:

• Participants may behave differently because they know the event is simulated.
• Senior leaders may dominate discussion, suppressing dissent and operational insight.
• Scenarios may overemphasise dramatic events while neglecting slow-onset disruption.
• Metrics may encourage gaming, such as closing actions superficially to improve completion rates.
• Averages can conceal failure in a critical service or vulnerable population.
• Exercise fatigue can reduce engagement when activities are repetitive or poorly timed.
• Inter-organisational exercises may expose legal, commercial or reputational sensitivities.
• Recovery targets may be unrealistic if dependencies and resource constraints are ignored.
• A successful exercise does not prove performance in a real crisis.

These limitations support a portfolio approach: combine discussion, functional and full-scale exercises; use audits and stress tests; examine real incidents; and repeat tests after corrective action. Measurement should be interpreted as evidence with uncertainty, not as a definitive claim of resilience.

10. Best-Practice Exercise Cycle

A mature organisation operates a continuous cycle:

1. identify risk, capability gaps and learning priorities;
2. define objectives and success criteria;
3. design and approve the scenario, injects and safety arrangements;
4. brief participants and evaluators;
5. conduct the exercise and collect evidence;
6. hold a hot debrief while memories are fresh;
7. produce an evidence-based AAR;
8. assign, fund and monitor corrective actions;
9. retest critical improvements;
10. update plans, training, governance and investment decisions.

The cycle should be integrated with enterprise risk management, internal audit, business continuity, information security, occupational safety and strategic planning. Resilience is not a project that ends when an exercise report is issued; it is an organisational capability maintained through repeated learning and adaptation.

Chapter Summary

Exercises convert crisis plans into observable behaviour. Tabletop exercises are effective for testing decisions, authority and assumptions; functional exercises test command, coordination and information flow; and full-scale exercises test mobilisation and end-to-end operations. Exercise design begins with a clear purpose, specific objectives, a credible scenario, purposeful injects and explicit rules of engagement.

Evaluation should use observable criteria, contemporaneous evidence and consistent rating guidance. Preparedness measurement may include plan currency, training, contact validation, supplier testing and corrective-action completion. Resilience measurement extends beyond preparedness to include anticipation, absorption, adaptation, recovery and learning. Stress tests examine performance under demanding conditions, while recovery indicators such as restoration time, service availability and degradation duration show operational outcomes.

Audits provide assurance, after-action reviews create learning, and corrective-action systems convert findings into change. Governance must address safety, privacy, accessibility, fairness and accountability. Metrics and maturity models are useful decision aids but cannot replace judgement or conceal critical failures. The central leadership responsibility is to create a disciplined cycle in which evidence from exercises and real events improves systems, relationships and decisions.

Key Terms

Exercise: A structured simulation used to test, train or improve organisational capability.

Tabletop exercise: A facilitated, discussion-based exercise focused on decisions and coordination.

Functional exercise: An exercise that tests operational functions and command processes in a simulated environment.

Full-scale exercise: An exercise involving real people, facilities, equipment and field activity.

Drill: Repeated practice of a specific task or procedure.

Scenario: The simulated context, event, impacts and constraints used in an exercise.

Inject: Information or an event introduced to stimulate a decision or action.

Controller: A person who manages exercise flow and delivers scenario information.

Evaluator: A person who observes performance and records evidence against criteria.

Objective: A specific capability or behaviour the exercise is intended to examine.

Rule of engagement: A control defining permitted activities, safety arrangements and exercise boundaries.

Stress test: A demanding test of capability under plausible adverse conditions.

Preparedness: The readiness of plans, people, resources and processes before disruption.

Resilience: The capacity to anticipate, absorb, adapt, recover and learn from disruption.

Maturity model: A staged framework describing the development of organisational capability.

After-action review: A structured process for comparing expected and actual performance and identifying improvements.

Corrective action: A defined intervention intended to address a finding or reduce a risk.

Recovery time objective: The target time for restoring a specified service or function.

Availability: The proportion of scheduled time during which a defined service is usable.

Common operating picture: A shared, current understanding of conditions, impacts, actions and priorities.

Review Questions

Short Answer Questions

1. What is the principal difference between a tabletop exercise and a functional exercise?
2. Why should exercise objectives be observable?
3. Define an inject and identify two possible delivery channels.
4. What is the purpose of an after-action review?
5. Why can an overall exercise score conceal important weaknesses?

Long Answer Questions

1. Explain how an organisation should move from risk assessment to exercise objectives, scenario design and evaluation criteria.
2. Compare tabletop, functional and full-scale exercises, including their uses, resource requirements and limitations.
3. Discuss how preparedness indicators and recovery-performance measures should be combined to assess resilience.
4. Explain the role of audits, stress tests and after-action reviews in a continuous improvement system.
5. Evaluate the ethical, governance and safety issues that arise when exercises use real systems, personal data or public communications.

Analytical / Application Questions

1. A university experiences a cyberattack during examination week, while its learning platform and identity service are unavailable. Design three exercise objectives, four injects and evaluation criteria for a functional exercise.
2. An organisation reports that 98% of its continuity plans are current, but a simulation reveals that staff cannot identify service priorities or deputies. Analyse why the metric was insufficient and propose a balanced measurement framework.
3. A critical service has a scheduled operating period of 720 hours in a month and experiences 18 hours of qualifying downtime. Calculate its availability using A = (T − D) / T × 100%, state the assumptions required, and explain why the result alone is not a complete resilience assessment.

Multiple Choice Questions with Answers

Question 1

Which exercise type is primarily designed to test decision-making, authority and coordination through facilitated discussion?

A. Tabletop exercise

B. Full-scale exercise

C. Equipment drill

D. Routine audit

Correct Answer: A. Tabletop exercise

Question 2

What is the principal purpose of an inject?

A. To replace the exercise objectives

B. To stimulate a decision or action during the exercise

C. To provide the final evaluation score

D. To certify regulatory compliance

Correct Answer: B. To stimulate a decision or action during the exercise

Question 3

Which observation is most suitable as objective evaluation evidence?

A. The team seemed confident

B. The exercise was interesting

C. The incident lead issued a verified situation report within 20 minutes

D. Participants liked the scenario

Correct Answer: C. The incident lead issued a verified situation report within 20 minutes

Question 4

Using availability A = (T − D) / T × 100%, what is availability when scheduled time is 720 hours and qualifying downtime is 18 hours?

A. 95.0%

B. 97.5%

C. 98.0%

D. 99.5%

Correct Answer: D. 99.5%

Question 5

Which statement best distinguishes preparedness from resilience?

A. Preparedness concerns readiness before disruption, while resilience includes adaptation and recovery

B. Preparedness applies only to technology, while resilience applies only to people

C. Preparedness is measured numerically, while resilience cannot be measured

D. Preparedness begins after disruption, while resilience ends before disruption

Correct Answer: A. Preparedness concerns readiness before disruption, while resilience includes adaptation and recovery

Question 6

What should an after-action review primarily examine?

A. Who should be blamed for every error

B. What was expected, what occurred, why differences arose and what should change

C. Whether participants enjoyed the exercise

D. How to avoid documenting weaknesses

Correct Answer: B. What was expected, what occurred, why differences arose and what should change

Question 7

Which feature is most characteristic of a full-scale exercise?

A. It uses only written questions

B. It involves real facilities, equipment and field activity

C. It excludes external stakeholders

D. It cannot test physical mobilisation

Correct Answer: B. It involves real facilities, equipment and field activity

Question 8

Why should maturity be assessed by capability domain rather than only by one organisational score?

A. All capabilities always mature at the same rate

B. A single score can conceal weakness in a critical domain

C. Domain-level assessment eliminates the need for evidence

D. Maturity scores are unrelated to governance

Correct Answer: B. A single score can conceal weakness in a critical domain

Question 9

Which action best demonstrates effective corrective-action governance?

A. Marking an issue closed when a meeting has been held

B. Assigning an owner, due date and evidence requirement, followed by retesting

C. Removing low scores from the final report

D. Repeating the same exercise without changing anything

Correct Answer: B. Assigning an owner, due date and evidence requirement, followed by retesting

Question 10

What is an important limitation of exercise metrics?

A. They always measure real-world performance perfectly

B. They can encourage superficial compliance or conceal critical failures

C. They cannot be linked to corrective actions

D. They make qualitative evidence illegal

Correct Answer: B. They can encourage superficial compliance or conceal critical failures