Scenario

Plans and tolerances are claims; scenarios are how leadership checks the claims before reality does. A scenario is a structured description of a plausible disruption, specific enough to test decisions, plans and limits against. The concept exists because untested assumptions feel identical to tested ones until the day they fail. For a board, scenarios convert the phrase we believe we are ready into we tried it and here is what broke.

Scenarios are drafted by the resilience or risk function, approved by management, and used in exercises, BIA validation and regulatory self-assessments. Regulators such as the FCA and CBUAE expect testing against severe but plausible scenarios, and NCEMA in the UAE drives exercising at national level. A good scenario is concrete: the data centre lost at 09:00 on the last business day of the month, the key supplier unreachable for 48 hours, not simply a major IT problem. One well-built scenario can expose that a 4-hour recovery promise actually takes 11 hours with real staffing.

The typical failure is exercising comfortable scenarios the team already handles well, which produces reassurance instead of learning. Severity should be dialled up until something breaks, because that breaking point is the most valuable data the board receives all year. Scenarios must also stay plausible, or the lessons get dismissed as fantasy. In the ERGP programme, a chapter of Module 4 on crisis management is devoted to designing and running scenario-based exercises.