Tabletops. On-demand.
Scenario, facilitation, report. The complete tabletop in one session under 60 minutes.
No long lead time, no calendar juggling, no post-session scramble. Your team shows up virtually, responds, goes back to work.
Alex · IR lead
Nadia · LegalWhy tabletops fall flat
They take weeks to stand up
Even a well-resourced team loses the better part of a quarter to scheduling, scoping and pre-reads. Holly compresses that into the time it takes to send the calendar invite.
The scenario rarely fits the company
Generic templates produce generic conversations. Holly generates a scenario tuned to your industry, organization and regulations.
The evidence gets lost in the room
Decisions get made, then lost in Slack threads and post-session emails. Every decision, every Directly Responsible Individual (DRI), every clause cited, auto-recorded during the session. No post-session scramble. Fully controlled and efficient.
Bespoke engagement, or on-demand. Both have a place.
Bespoke engagement · Consultant-led tabletop
- Built for complex, multi-entity scenarios where the design itself needs expert hands
- Deep industry expertise shapes the scenario, the room and the debrief
- Custom scoping, bespoke write-up
- Often used for annual flagship rehearsals with a consultant who knows your sector
On-demand · Handrails
- Built for speed and execution between flagship exercises
- Schedule any day, any time, no facilitator to book
- Transparent PAYG pricing
- Report ready before your team signs off
- Re-run any time, same scenario or a new twist
- Track progress and insights between tabletops (coming soon)
Many of our partners are consultancies who use Handrails to extend their own programs. See Partner with Handrails.
One exercise. Fifty-plus frameworks.
The IR plan must be documented, communicated and tested. Auditors and underwriters look for evidence that scenario-based exercises happen on cadence, not just that the plan exists.
Sample exercises: Cyber incident response · Ransomware response · OT cybersecurity · Connected-device cybersecurity.
Regulated entities must test continuity plans against severe-but-plausible scenarios across critical operations and material service providers. Identify important business services, set impact tolerances, then prove the tolerances hold.
Sample exercises: Operational resilience · Third-party disruption · Supply chain integrity.
The crisis-management plan must be tested annually as a separate exercise from the recall procedure. For US SEC registrants, material cybersecurity incidents must be disclosed within four business days of materiality determination.
Sample exercises: Crisis management · Mass-casualty response.
Documented mock recalls verify the recall and withdrawal procedure works in operational conditions. Medical device manufacturers face equivalent obligations under FSCA and post-market surveillance frameworks. Pharma sponsors face market-action and pharmacovigilance reporting clocks.
Sample exercises: Mock recall & traceability · Food defence (TACCP) · Food fraud (VACCP) · Outbreak response · Sentinel event · Recall & FSCA · Pharmacovigilance signal · Vigilance & post-market surveillance.
CAPA framed as an investigation-and-effectiveness system. CAPA discipline is the single most-cited Form 483 deficiency. The TGA adopts the PIC/S Guide to GMP for medicinal products by reference, so equivalent expectations apply to Australian licensed manufacturers.
Sample exercises: Quality escalation & CAPA.
From zero to evidence in three steps.
Context in
Paste a policy, share a URL, or describe your setup. Holly writes a scenario that looks and feels like your business, not a textbook. Tuned to your architecture, customers and framework, in minutes.
Alex · IR leadNadia · LegalVirtual session
Nominate a team to join a single live video call. Engineers, legal, comms, exec, observers, everyone in the same room at the same time. Holly facilitates, asks the hard questions, injects twists, and keeps the clock so the exercise finishes on time.
Report out
Holly writes the after-action report while the session runs. What went well, what broke, what to fix, mapped to the clauses and frameworks you care about.
Four artifacts, in the shape audits accept.
Auditor-ready evidence pack
Clause-mapped write-up with decisions, DRIs and recommended actions. Drop into the audit folder as-is.
Board and exec-ready summary
A one-page narrative for the audit committee or risk committee. What was tested, what held, what didn't, what we're doing about it.
Owner-tagged action list
Findings paired with DRIs and actions. Drop straight into your tracker the minute the call ends.
Gap and remediation register
Severity-ranked gaps, missed escalations and process failures with clear remediation actions and owners.
Your next tabletop is sixty minutes away.
Sign up, describe your setup, pick a scenario. Hand the report to your auditor the same afternoon.