Teaching Risk Appetite and Business Continuity Through Live Crisis Simulation

Business continuity and risk appetite are two of the most conceptually rich topics in any risk management curriculum — and two of the hardest to teach well. Students can memorise ISO 31000 definitions, recite the five risk response strategies, and draw a bow-tie diagram in their sleep. What they cannot do, after most programmes, is make a defensible risk decision under time pressure when the information is incomplete and the consequences feel real. That gap is not a student failure. It is a delivery failure.

Why Frameworks Alone Do Not Build Risk Judgement

The IRM's Professional Risk Management standards are explicit about what competent risk professionals need to demonstrate: not just knowledge of frameworks, but the ability to apply them in dynamic, ambiguous environments. That distinction matters enormously for programme design. A student who can explain PESTLE analysis has acquired information. A student who has used PESTLE analysis to make a live sourcing decision during a simulated geopolitical disruption has begun to build judgement. Only the second student is approaching IRM competency.

Risk appetite is particularly difficult to teach abstractly. It is an organisational construct — shaped by board culture, regulatory context, strategic priorities, and past experience. No lecture can recreate that complexity. But a simulation that places student teams in competing organisations with different risk tolerances, different asset bases, and different stakeholder expectations can surface exactly the kinds of trade-off conversations that risk appetite frameworks are designed to structure.

The Crisis Trigger: How Live Events Change the Teaching Dynamic

The most powerful element of live crisis simulation is not the scenario itself — it is the timing. When a disruptive event lands mid-turn, after teams have already committed resources and locked in decisions, the emotional reality of sunk cost becomes viscerally clear. Students do not just read about cognitive bias in risk decision-making. They experience it. A team that invested heavily in a single supplier and then watches a simulated port closure hit their supply chain learns something no case study can replicate.

“Organisations that had tested their business continuity plans before a crisis were 2.5 times more likely to recover within target recovery time objectives than those relying on untested documentation.”

— Business Continuity Institute, Horizon Scan Report, 2024

Designing the Debrief: Where the Learning Consolidates

The simulation session itself is not the lesson — it is the raw material. The debrief is where risk management learning consolidates. Effective post-simulation debriefs ask teams to articulate, in IRM-aligned language, what their implicit risk appetite was during the session versus what they stated it to be. The gap between declared appetite and revealed appetite is almost always instructive. Teams that claimed conservative risk profiles routinely make aggressive decisions when competitive pressure is visible on a live leaderboard.

SPPIN Sim generates a full turn-by-turn decision record for every team, which tutors can use to structure debrief conversations with evidence rather than recollection. Students can see exactly where they deviated from their stated strategy, what external events triggered that deviation, and what the downstream consequences were. That evidence base transforms the debrief from a reflective exercise into an analytical one — which is precisely the mode that risk management employers expect graduates to operate in.

Mapping to Business Continuity Standards

ISO 22301, the international standard for business continuity management systems, organises the discipline around four phases: prevention, preparedness, response, and recovery. Most undergraduate teaching focuses almost entirely on the first two. Simulation gives students access to the second two — which is where the most consequential professional decisions actually happen. Running a live simulation that includes supply chain disruption, demand shocks, and reputational crises gives students a structured encounter with response and recovery decision-making that no lecture series can provide.

Integrating SPPIN Sim into Your Risk Module

SPPIN Sim's risk management simulation module is aligned to IRM Professional Risk Management standards and structured around the four phases of ISO 22301. Tutors can configure the level of disruption, the type of crisis events injected, and the degree of transparency between competing teams. Sessions run in browser without student account creation — teams receive a code and PIN and are making risk decisions within five minutes of entering the room.

The simulation tracks risk-related KPIs including supplier diversification index, safety stock levels, and operational resilience score — giving students quantitative feedback on the downstream effects of their risk appetite decisions. For programmes preparing students for IRM membership or CII qualifications, that alignment between simulation output and professional body competency language is a significant pedagogical advantage.