Kantyra
Kantyra
Alain Rees · 10-07-2026 · 7 min leestijd
The exercise succeeded, the evaluation is positive, everyone goes home satisfied. And next year the same findings appear in the report. Whoever has been in this field for a while recognises the pattern, and the science recognises it too. There is by now a solid body of research on whether organisations really learn from crisis and continuity exercises, with Dutch researchers in a leading role, and the outcome is twofold. Exercising can indeed make the difference between a controlled disruption and a derailed crisis. But the way most organisations exercise, once a year, scripted and without follow-up, mainly produces a good feeling.
This article belongs to the Resolve phase of the model behind Kantyra: a continuity plan is a control, and a control that has never been put under pressure exists only on paper.
The critical foundation under this subject is to a large extent from Leiden. Arjen Boin and colleagues, who designed simulations for governments for years with the Crisis Research Team, described the core weakness of the classic exercise as early as 2004: it repeats yesterday's crisis. The scenario is known, the roles are fixed and the plan is dutifully walked through, while real crises are characterised precisely by ambiguity, transboundary spillover and the absence of a fitting script. They argued for exercises that train improvisation and cooperation under uncertainty instead of plan adherence. Boin and McConnell added an uncomfortable truth: a plan that has never been seriously tested is above all symbolic. And in their overview of the field, Boin, Paul 't Hart and Sanneke Kuipers name learning as the strategic crisis task that is executed worst.
That broader practice confirms this picture is clear from international research. A study among forty-eight local emergency organisations in three countries found that most organisations train and exercise without systematic assessment: without predefined objectives and without measurement of competence. Swedish research by Berlin and Carlström among emergency services got to the heart of it: participants find exercises instructive and pleasant, but report little transfer to real incidents, precisely because exercises follow a script, avoid friction and are rarely repeated. Exercising for the sake of exercising, in other words, and the satisfaction afterwards is no proof of the contrary.
The second question is why lessons stick so poorly. Smith and Elliott described the classic barriers: blame culture, denial, the urge to return to normal quickly and the tendency to dismiss every event as unique. Dutch empirical research made this concrete. Wout Broekema and colleagues of Leiden University compared how the food safety authority NVWA learned from four veterinary crises, from swine fever to Q fever, and found that learning did not depend on the severity of the crisis, but on internal factors: committed leadership, an open learning culture, continuity of staffing and formalised follow-up of evaluations. In more recent work, Broekema describes the mirror-image process, and it deserves a place in every BCM glossary: organisations actively forget. Through turnover, decaying routines and evaporating urgency, crisis lessons erode by themselves, unless you deliberately counterbalance them with documentation, repetition and anchoring in systems.
For the continuity world there is a hereditary burden on top. Brahim Herbane, who described the history of the field, shows that business continuity management was largely shaped by legislation, supervision and standards. The discipline has compliance in its DNA, and that explains why so many exercises are planned for the auditor instead of for the organisation. His earlier argument with Elliott and Swartz remains current: BCM only protects value when it is anchored organisation-wide and actively tested, instead of existing as a delivered document.
The good news is that the research is fairly unanimous about what works, and that it need not be more expensive than what you do now. The most powerful finding again comes from Berlin and Carlström. They redesigned the exercise into three short rounds of the same scenario with reflection in between, in which teams were allowed to try a different approach. That produced measurably more learning than the single large exercise. Repetition with reflection beats scale. Swedish follow-up research in twelve municipalities showed that recurring exercises over the years produce a cumulative learning effect that isolated exercises miss. And a recent systematic assessment of thirty-one studies of full-scale exercises names the active ingredients: realism in scenario and tempo, sufficient duration to correct mistakes during the exercise, good preparation of participants and a structured debriefing that ties back to objectives set in advance. The same assessment is honest about the state of the evidence: many studies measure self-reported learning, so modesty is fitting here too.
Summarised, the recipe is: exercise more often and smaller, formulate in advance per exercise what you want to test, let things go wrong without settling scores, debrief against the objectives, and give every lesson an owner and a deadline. For completeness: that last point is exactly why Kantyra attaches a verdict to every exercise and automatically creates an improvement task for a partially successful or failed exercise. Not because a task equals the learning, but because the follow-up otherwise evaporates, and the Leiden research shows that formalised follow-up is precisely what separates learning from forgetting.
If you take one thing from this article, let it be this: a successful exercise is not the goal, a better organisation is the goal, and the two rarely coincide. An exercise in which nothing goes wrong was too easy. Ask yourself three questions. Do you know in advance which two or three things this exercise must demonstrate? Can you list the lessons from the previous exercise and show what was done with them? And does your team dare to exercise the scenario everyone hopes will never come, including the possibility of audibly failing in it? Three times yes means you exercise to learn. Otherwise you exercise to be able to say you exercised, and that is exactly the difference this whole model is about.
This article is a substantiated synthesis of existing scientific research and not independent, peer-reviewed research of its own. Where I interpret or explain, that interpretation is my own responsibility.
In een demo van 30 minuten lopen we het model door aan de hand van jouw situatie.
Plan een demoThe annual training and the phishing simulation are everywhere, but do they change behaviour? The large field studies and Dutch research from Twente and Leiden give a sobering answer, and point to what does work.
Between the treatment plan and demonstrable execution, many organisations harbour a gap. How to bridge it with controls that get tested, policies with a lifecycle, projects for what is missing and formal exceptions for what you accept.