The pressure to demonstrate resilience capability has grown significantly. Regulators expect organisations to test their ability to remain within impact tolerances under realistic disruption scenarios, not just confirm that plans exist. Boards want confidence that is grounded in evidence. And the pace at which incidents develop means there is very little time, when something real lands, to discover that preparation was thinner than assumed.

Against that backdrop, most organisations face a recognisable set of gaps:

Exercises that confirm rather than challenge: Many organisations run exercises that are designed, consciously or not, to go well. Scenarios are manageable, participants are briefed in advance, and the debrief focuses on what worked. The result is confidence that has not been genuinely earned, and gaps that remain invisible until they are not.

Leadership capability is assumed rather than built: Crisis and incident management places specific demands on senior leadership: rapid decision-making, clear communication under pressure, the ability to maintain control when the situation is evolving faster than the information. These are skills that require practice. They do not simply exist because someone holds a senior role.

Exercises are disconnected from the wider resilience picture: Testing a crisis management plan in isolation from business continuity, third-party dependencies, and cyber resilience produces a partial picture. The incidents that cause the most damage are the ones that travel across those boundaries, and exercises that do not reflect that leave organisations underprepared for the scenarios that matter most.

Findings are not acted on: Even where exercises surface genuine gaps, the path from debrief to improvement is often unclear or deprioritised. The value of testing is only realised when what it reveals is used to build something better.

DCR designs and delivers testing, training and exercising programmes that are built around the real conditions your organisation would face, the real people who would need to perform, and the real gaps that need to be closed.

Scenario design and exercise delivery: We design exercises that reflect the actual threat landscape and operational profile of your organisation: cyber incidents, operational failures, third-party disruptions, reputational crises, and multi-event scenarios that test how resilience holds when more than one thing goes wrong at once. Exercises are tailored to the audience, from board-level strategic simulations to operational team exercises, and designed to create genuine pressure rather than managed comfort.

Leadership and decision-making development: We work with senior teams and boards to build the specific capabilities that incident and crisis management demands: clear decision rights, structured communication under pressure, and the command and control capability that determines whether leadership performs or falters when it matters. This is built through practice, not instruction.

Honest debrief and improvement planning: Every exercise DCR delivers includes structured, honest debrief: not a review of what went well, but a clear-eyed assessment of where the gaps are and what needs to be built. We provide a practical improvement path, and where appropriate, stay to support the work of closing what the exercise surfaced.

Ongoing programme design: A single exercise builds awareness. A sustained programme builds capability. We work with organisations to design testing and exercising programmes that develop resilience over time, keep pace with a changing risk landscape, and meet the ongoing regulatory expectation for demonstrated preparedness.

The DCR team has designed and delivered exercises for boards, leadership teams and operational functions across financial services, retail and other sectors. We have run simulations at every level of complexity, from focused tabletops to multi-day, multi-team exercises that test the full breadth of an organisation's resilience capability.

What we bring:

Exercises built for genuine pressure: Our scenarios are designed to challenge, not to confirm. We bring the experience to know where organisations typically find their gaps, and the independence to surface them honestly rather than managing toward a comfortable outcome.

Senior credibility in the room: Exercises only work if the people in them take them seriously. Our facilitators bring the seniority and sector knowledge to engage boards and executive teams at the right level, ask the questions that matter, and hold the room when the scenario demands it.

From testing to building: The value of an exercise is not the exercise itself. It is what the organisation does with what it finds. DCR's approach is built around the full cycle: design, delivery, honest debrief, and a clear path from finding to improvement. Organisations that work with us come out better prepared than they went in, not just better informed about where they are weak.

Adaptive organisations do not find out how ready they are during an incident. They already know, because they have been there before.