Have you ever encountered an engagement for an organization that outsources almost everything? How do you avoid the response "We will reach out to <<>>"?

This is a common challenge with organizations that heavily rely on outsourcing. The best way to tackle this is to include the vendors in your exercises. If third parties and outsourcing are critical components of your response, then the best way to maintain engagement is to include them in your exercises. This will not only stop those “easy” responses of “we will reach out to,” but it is also a fantastic way of testing your supply chain resilience and getting assurances that the risks you are transferring are mitigated.

Here are a few other strategies I would use:

• Scenario design: Craft scenarios that force participants to make decisions before they can contact external providers. For example, introduce an initial outage that disrupts communication channels. You could also create an exercise where the main third party you use are the ones with the crisis or impacted in the same one you are.
• Role assignment: Assign roles that require internal action, such as a communication lead who must draft a press release or a technical lead who must perform initial triage.
• Facilitator intervention: If participants default to "we would call the supplier/vendor," the facilitator can gently challenge them with questions like, "What steps can you take while you're waiting for the vendor to respond?" or "What information do you need to gather before contacting them?" or most importantly, you could explore how you contact them and what the process is for this.
• Debriefing focus: During the debriefing, discuss the risks and limitations of over-reliance on outsourcing and highlight the importance of internal capabilities and knowledge.