Run a Service-Recovery Tabletop With Your FM Provider

Why this matters

A continuity plan is a document; recovery is a coordinated capability. Contracts frequently allocate responsibilities without testing whether names, authority, communications, alternatives and evidence work together. A tabletop exercise creates a controlled way to expose those gaps before an actual disruption makes them expensive.

Evidence context

The UK Cabinet Office’s Contract Management Playbook, published 25 March 2026, is government practice guidance. It supports proportionate governance, responsibility mapping, obligation tracking, accurate records, multi-source performance information, change control and planned exit. It does not measure the impact of those practices, and its public-sector rules should not be treated as universal law. [1, pp. 45–49,

53–55, 67]

The Australian National Audit Office published Auditor-General Report No. 25 of 2025–26 on 18 March 2026.

It tested 14 engagements in a diplomatic Security Enhancement Program using records, contract data and procurement information. Four achieved the original scope, timeframe and estimated cost together. The sample is a bounded audit case involving mixed works and services, not an FM-sector benchmark. [2,

summary paras. 11, 19; paras. 1.17–1.18]

CBRE’s 16 July 2025 article offers practitioner guidance on supplier monitoring, supply-chain visibility and continuity planning. It is a commercial expert perspective without a reported evaluation sample, so it is used as supporting guidance rather than empirical proof. [3, sections 1 and 5]

Osmos Global analysis

Choose a scenario that stresses real dependencies without pretending to predict the next incident. The practical consequence is that a reported result must be interpreted in the operating context that produced it.

Test decisions and handoffs, not the theatrical reading of a prepared plan. This changes the management question from whether an activity occurred to whether the agreed condition was achieved and can be demonstrated.

Include provider, client and critical subcontractor roles where the recovery chain crosses organisational boundaries. The control should create enough traceability for another competent reviewer to reproduce the decision without relying on memory.

Record observed capability separately from promises to update documents after the exercise. Where evidence is incomplete, the honest result is an exception with an owner—not a confident conclusion assembled from assumptions.

Figure 1. A mobilisation or recovery decision gate Original Osmos Global conceptual framework, 2026. Not a validated scoring model. Prepared 1 September 2026.

What this means: Calendar pressure does not remove the need to own unresolved risk.

The practical tool

1. Define the service, disruption, operating assumptions and exercise objectives. Write the purpose and boundary first so the record does not become a generic administrative form. 2. Issue information in stages so participants must reassess priorities. Use information already created by operations where it is reliable, and identify any new collection burden explicitly. 3. Observe authority, communication, fallback and resource decisions. Give the action to a named role with authority to resolve the exception or escalate it. 4. Verify how restoration would be confirmed and communicated. Test the step on a difficult real example before making it part of routine governance. 5. Assign improvements, owners and retest dates. Retain the outcome and the evidence used so that later review can distinguish improvement from a change in reporting.

Illustrative application

A power-quality event affects one building while the usual specialist is unavailable and remote monitoring is intermittent. Participants must decide which services receive priority, who can authorise temporary operating limits, how occupants are informed and what evidence is required before normal service is declared restored. This example is an Osmos Global illustration, not a reported case from the cited sources.

Its purpose is to test the decision logic and reveal what evidence would be required.

Questions for the review

• Can the parties demonstrate how they will define the service, disruption, operating assumptions and exercise objectives using a current operating record? • Which evidence would cause the acceptance owner to reject the reported result or impose a condition? • Who has authority to resolve the most consequential exception raised by this continuity testing control? • How will the workflow distinguish a provider-controlled gap from a client, asset, landlord or third-party dependency? • What will be rechecked to establish that the corrective action changed the operational outcome rather than only the report?

Portfolio and GCC application

A portfolio exercise should test a shared dependency as well as a local incident. If several workplaces rely on one specialist provider, communications platform or approval route, the scenario should reveal which site receives support first and who makes that choice. A plan that works at a single location may fail when the same fallback is claimed elsewhere.

For GCC operations, involve the business owner who understands the consequence of interruption. FM can explain asset conditions, but it may not have authority to prioritise customer-facing activities or accept reduced service. Ask participants to state what information they need before deciding, where it will come from and what they will do if it is unavailable. Record unresolved authority questions separately from technical gaps.

Close the exercise with a short action review rather than a declaration that resilience has been proven. Assign each gap to a plan change, resource check, technical test or further exercise. Rehearse a selected corrected handoff to establish that the action changed behaviour. Do not expose sensitive building vulnerabilities in broadly circulated reports; keep the operational detail accessible to authorised teams while giving leaders a clear account of unresolved consequences.

Implementation-quality indicators

• Selected records can be reproduced from source evidence without reconstructing the story after the review starts. • Exceptions carry a named owner, decision route, due date and explicit consequence of delay. • Temporary controls and permanent resolution remain distinguishable in both the operating record and the governance pack. • A later reviewer can see which baseline and definitions applied when the decision was made.

Leadership implications

Business leaders should participate where recovery priorities affect operations. Procurement should contract for participation, evidence and corrective follow-through—not a guaranteed absence of disruption. Providers should test their own supplier dependencies rather than presenting a generic corporate continuity plan. The roles should be adapted to the organisation’s retained capability, site risks and contractual authority.

Practical recommendations

• Start with one service where the current evidence can be reconstructed and where a better decision would matter. • Pilot the tool with client and provider teams, record disagreements in definitions and revise the workflow before scaling. • Report exceptions, uncertainty and overdue verification alongside compliance results. • Review the control after a material incident, portfolio change, system migration or contract variation.

Risks, limitations and unresolved questions

A tabletop does not prove physical equipment capacity or emergency competence. Site drills, engineering tests and statutory exercises may also be required. Exercise records should avoid exposing sensitive security details beyond those who need them. The article provides an operational framework rather than contract wording, legal advice or a site-specific technical standard.

Source notes

[1] Cabinet Office. The Contract Management Playbook. UK Government, 2026-03-25. March 2026 edition. Printed pp.45–49, 50–55 and 67; PDF page index = printed page + 3. Accessed 1 September 2026. https://www.gov.uk/government/publications/the-contract-management-playbook Contains public sector information licensed under the Open Government Licence v3.0. https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ [2] Australian National Audit Office. Procurement and Contract Management by the Department of Foreign Affairs and Trade for its Security Enhancement Program. Australian National Audit Office, 2026-03-18. Auditor-General Report No.25 of 2025–26. Summary paras.11, 19; audit scope/method paras.1.17–1.18; recommendation6; chapter4. Accessed 1 September 2026. https://www.anao.gov.au/work/performance-audit/procurement-and-contract-management-by-dfat-for-security-enhancement-program [3] CBRE procurement professionals; no individual byline displayed. Risk & Resilience: Navigating Your Facilities Management Supply Chain Amid Uncertainty. CBRE, 2025-07-16. Sections01,02 and05. Accessed 1 September 2026. https://www.cbre.com/insights/articles/risk-and-resilience-navigating-your-facilities-management-supply-chain-amid-uncertainty

Editorial and visual note

This publication is original Osmos Global analysis informed by the cited sources. Reported findings are distinguished from Osmos recommendations and illustrations. Source findings and trademarks remain attributable to their owners. The content is general research and does not replace contract-specific, legal, engineering, safety or other professional advice.