Tabletop exercises and incident simulations for travel agencies

Most agencies don't find out their crisis plan is broken until they're three hours into an actual crisis. The supplier has gone dark, forty clients are refreshing their inboxes, and the one person who knew the manual override process is on a cruise with spotty wifi. The playbook existed. It was in a shared drive. Nobody had ever run it under pressure.

That gap — between a written SOP and a team that can actually execute it when the room gets loud — is exactly what tabletop exercises are built to close. A tabletop exercise for a travel agency is a structured walkthrough of a realistic disaster, done in a conference room or on a video call, where your team talks through every decision they'd make if the thing actually happened. No real clients harmed. No real money moved. Just your people, your documented procedures, and a scenario designed to find the cracks.

The value isn't in confirming your plan works. It's in discovering, cheaply and quietly, all the ways it doesn't.

Why documented SOPs quietly rot

An agency writes solid SOPs — maybe after a painful incident, maybe because a new ops manager pushed for it. The documents are genuinely good. Then they sit untouched for eighteen months while the business changes underneath them.

In that time, the supplier you had a direct line to got acquired. The payment processor changed its chargeback window. Two of the three people named in the escalation path left. The "emergency contact spreadsheet" has a phone number that now rings a dentist's office. None of this shows up in the document, because documents don't notice when reality moves.

SOP decay isn't dramatic. It's drip-by-drip irrelevance. The plan looks fine on paper right up until the moment you need it, and then every third step references a tool, person, or process that no longer exists. Tabletop exercises are how you catch that drift before a client does.

This is also why tabletops pair naturally with a proper document lifecycle. If you've already built a system for keeping procedures current — something closer to a governed playbook library rather than scattered files — the exercise becomes a validation step, not a scramble. If you haven't, the first tabletop you run will mostly reveal how out of date everything is, which is still useful, just more painful.

What breaks at scale (and why small agencies get surprised)

A two-person agency runs on shared memory. When something goes wrong, both people know everything, they're sitting in the same room, and coordination is trivial. You don't need a tabletop exercise when you are the entire org chart.

The problem arrives somewhere between six and fifteen people. Suddenly knowledge is distributed. The person who handles supplier relationships doesn't know the refund mechanics. Junior agents don't know when they're allowed to make a decision versus when they need to wake someone up. Information that used to live in two heads now lives in six, and no single person has the full picture during an incident.

1. 1
   Decision authority — nobody's sure who's allowed to approve a $4,000 goodwill gesture at 11pm
2. 2
   Communication sequencing — clients get contacted before the agency knows the facts, or after a competitor already tipped them off
3. 3
   Handoff gaps — the night person resolves half the problem but documents none of it, and the morning shift starts cold

Tabletops expose these at the exact seams where your team scales. They're less about testing whether people know the procedure and more about testing whether the procedure works when distributed across multiple people under time pressure.

Building a scenario library worth running

A good tabletop program isn't one scenario you run once. It's a small library you rotate through, because different disasters stress different parts of your operation. Three of them deserve to be in every travel agency's rotation.

Scenario 1: Supplier collapse

A key DMC or tour operator goes insolvent overnight. You have twelve active bookings with them, three departing within the week, and roughly $38k in client deposits sitting in their account.

This scenario stresses your financial exposure tracking, your rebooking capacity, and your client communication under genuinely bad news. The questions that surface:

1. 1
   Do you actually know, right now, how much client money is exposed with any single supplier?
2. 2
   Who contacts affected clients, and in what order — departing-soonest first, or highest-value first?
3. 3
   What's your fallback inventory? Can you rebook twelve people in a week, or do some trips simply die?
4. 4
   How do you recover deposits, and what do you tell clients about the recovery timeline when the honest answer is "months, maybe never"?

Agencies almost always discover they can't produce a per-supplier exposure number quickly. That single gap is worth running the exercise for.

Scenario 2: Mass cancellations

A weather event, a political situation, or a health scare shuts down a region where you've got sixty travelers across the next thirty days. Everyone wants out, everyone wants a refund, and your suppliers are hiding behind force-majeure clauses.

This one stresses throughput more than anything. Your team isn't making hard decisions so much as making the same decision sixty times under emotional pressure, while deadlines stack up.

1. 1
   How many cancellation-and-rebook cycles can one agent process per hour realistically?
2. 2
   At what volume do you stop doing this one-by-one and switch to a batch communication process?
3. 3
   Who enforces your cancellation terms, and who's allowed to waive them — and does everyone give the same answer?

The failure mode here isn't a wrong decision. It's inconsistency. Three agents quote three different refund policies to clients who then compare notes.

Scenario 3: Data breach

Someone clicks a convincing phishing email, and now you're not sure whether client passport scans, card details, and travel itineraries are compromised.

This is the scenario most agencies handle worst, because it combines technical response, legal obligation, and reputational damage all at once. It also has a clock — breach notification rules are time-bound, and the window is tighter than people assume. If you haven't already mapped your baseline data protection and PCI obligations, this exercise will make painfully clear why that groundwork matters.

1. 1
   Who gets called first — IT, legal, or leadership?
2. 2
   What do you actually know about which data was accessed, and how fast can you find out?
3. 3
   At what point are you legally required to notify clients, and who drafts that message?
4. 4
   How do you keep operating while part of your systems might be locked down?

What breaks here is almost always speed of detection and the chain of who-tells-whom. Nobody's rehearsed it, so the first thirty minutes get wasted figuring out who to even call.

A comparison of the three core scenarios

Running the same type of exercise every quarter trains the same muscles.

Rotating them deliberately covers more of your operation.

How to actually run one: a simple exercise script

You don't need a consultant or a full day. A focused ninety-minute session, run by one person with a scenario and a timer, gets you most of the value. Here's a workable structure.

1. 1
   Set the scene (5 min). Read the scenario aloud. State the facts, the constraints, and the clock. "It's 9am Monday. Supplier X has filed for insolvency. You have twelve live bookings. Go."
2. 2
   Inject the first decision point (10 min). Ask the team

   what's the very first thing you do? Let them talk it through. Don't correct them — watch where they hesitate.

3. 3
   Escalate with a complication (15 min). Throw in a curveball. A departing client calls, panicking, before you've finished internal fact-finding. Now what? This tests whether communication and investigation run in the right order.
4. 4
   Force the hard call (15 min). Introduce a decision that requires authority — a $5k refund, a policy exception, a public statement. Watch who looks around the room for permission. That hesitation is your escalation path failing in real time.
5. 5
   Run to resolution (20 min). Push through to the point where the immediate crisis is contained. Capture every "we're not sure how we'd do that" out loud.
6. 6
   Debrief honestly (25 min). This is where the real value lives. What broke? What took too long? What assumption turned out to be wrong? Write it all down immediately — memory of a tabletop fades within a day.

The debrief is non-negotiable. A tabletop without a documented debrief is just an expensive conversation. The output should be a short list of concrete SOP changes with owners and dates attached.

Here's a quick visual workflow of the exercise steps.

Keep the timer visible and capture gaps as you go.

Where decision authority quietly fails

One pattern worth calling out on its own: the moment in almost every exercise where someone needs to make a meaningful call and visibly isn't sure they're allowed to.

That's not an individual failing. It's a missing rule. Clear decision authority — who can spend what, who can waive which policy, who speaks for the agency publicly — has to be defined before the crisis, because during the crisis there's no time to figure it out.

“

Keep a one-page escalation protocol pinned where everyone can access it during an exercise.

This is where a clean, one-page escalation protocol defining when juniors loop in seniors earns its keep. Tabletops are where you find out whether that protocol actually holds under pressure or whether everyone defaults to "I'll just ask the owner" — which doesn't scale and collapses the moment the owner is unreachable.

Success criteria: how to know the exercise worked

A tabletop either produces findings or it was theater. Define success before you start, not after. Reasonable criteria for a travel agency:

1. 1
   Time-to-first-correct-action — how long before the team took the right first step, not just a step
2. 2
   Decision latency — how long the hard call took once it was needed
3. 3
   Policy consistency — did everyone state the same refund/cancellation terms
4. 4
   Information accuracy — were the facts people acted on actually correct, or did someone run with an assumption
5. 5
   Communication order — did internal fact-finding happen before external messaging
6. 6
   Gap count — how many "we don't know how we'd do that" moments surfaced

A good first tabletop usually surfaces five to ten real gaps. If you run one and find nothing, you either ran a scenario that was too easy or people were performing rather than genuinely working the problem. Finding nothing is a red flag, not a victory.

A measurement checklist for validating readiness

Use this after each exercise to turn the session into durable improvements:

1. 1
   [ ] Every surfaced gap written down with a named owner
2. 2
   [ ] Each SOP change assigned a completion date
3. 3
   [ ] Contact lists and supplier details verified as current
4. 4
   [ ] Decision-authority thresholds confirmed or corrected
5. 5
   [ ] The scenario and findings filed where the next person can reuse them
6. 6
   [ ] A re-test date set to confirm the fixes actually landed
7. 7
   [ ] New hires since the last exercise flagged for inclusion next time

That last point matters more than it looks. Readiness isn't a state you reach — it's a state you lose every time someone leaves or joins. An agency that ran a flawless tabletop a year ago, then lost two senior people, is back near zero whether it feels like it or not.

A real scenario

A mid-sized leisure agency — around eleven staff, maybe 320–350 active bookings in peak season — ran their first supplier-collapse tabletop after a near-miss with a wobbling tour operator. They expected to confirm their plan was solid.

Instead, the exercise fell apart at step two. Nobody could produce a per-supplier exposure figure without manually opening individual bookings, which for a real collapse would've taken most of a day they wouldn't have had. Two of the four people in the escalation document had left. And when the "panicked client calls early" curveball hit, three agents gave three different answers about refund timelines.

They didn't buy anything fancy to fix it. They built a single running view of supplier exposure that updated as bookings were made, rewrote the escalation path with people who actually still worked there, and agreed on one scripted client holding-statement everyone would use. Three months later they re-ran the same scenario. Time-to-first-correct-action dropped from twenty minutes of floundering to under five. The exposure number was on screen in seconds.

The crisis they'd been afraid of never came. But a different supplier did hit trouble the following year, and they handled it in an afternoon instead of a week — mostly because they'd already made every mistake in a conference room where it cost nothing.

When this makes sense — and when it doesn't

Tabletops are worth the time once you've grown past the point where everyone knows everything. Two-person shop? Your energy is better spent writing the SOPs in the first place. The coordination problems these exercises test barely exist yet.

They become genuinely valuable in the roughly six-to-twenty-person range, where knowledge is distributed but you don't yet have formal crisis infrastructure. That's the zone where a quiet, forgotten gap in a handoff can turn a manageable incident into a reputation problem.

Where tabletops go wrong is when they're run to tick a box. If leadership treats the exercise as a chance to look prepared rather than to find out where they're exposed, people perform instead of working the problem, and you learn nothing. The agencies that get real value run them a little uncomfortably — they want to find the cracks, and they treat every gap as a win rather than an embarrassment.

Run them quarterly if you can, rotating scenarios so you're not always rehearsing the same muscle. Keep them short. Document ruthlessly. The point isn't the exercise — it's the slightly-less-broken version of your operation that exists the day after.