KEY POINTS
- Home Office guidance asks responsible persons to consider how procedures will be tested and practised, so staff can carry them out quickly.
- There are several ways to test, from a 30-minute tabletop discussion to a live drill. Most venues should start with tabletops and walk-throughs.
- The Act sets no testing frequency. A sensible pattern is at least one exercise a year, plus extra tests after changes.
- Testing is how you find the gaps a written plan hides: locked keys, dead radio spots, unclear roles.
- Record every exercise, what you learned and what you changed. It is useful evidence if the SIA inspects.
Why testing matters under Martyn's Law
The Terrorism (Protection of Premises) Act 2025 requires appropriate public protection procedures to be in place, so far as is reasonably practicable. The Home Office statutory guidance says the responsible person should have confidence that procedures can be carried out rapidly and effectively, and asks them to consider how procedures will be tested and practised to make sure they are fit for purpose. Testing also reinforces whatever training staff have had.
The guidance includes an example that shows why. A standard tier bar wrote several evacuation procedures for different attack types. During a practice, staff could not decide which to use, and the delay would have put people at greater risk. The bar replaced them with one simple procedure and scheduled another exercise. Nobody would have found that problem by reading the document.
For enhanced tier premises and qualifying events, the guidance says procedures and measures should be reviewed, tested and practised regularly. See enhanced tier duties.
If you share a building, a shopping centre or a site with other operators, consider inviting them to some exercises. The Act requires responsible persons to co-ordinate with each other so far as is reasonably practicable, and a joint tabletop is one of the quickest ways to find out whether your plans clash, for example two businesses planning to use the same exit or safe area. See multi-tenant and shared buildings.
Types of test
| Type | What happens | Best for | Disruption |
|---|---|---|---|
| Briefing or discussion | A manager talks the team through the procedures and answers questions | New procedures, new staff | None |
| Tabletop exercise | A small group works through a scenario around a table, deciding what they would do at each stage | Testing decisions, roles and communication | None, takes 30 to 60 minutes |
| Walk-through | Staff physically walk routes, find safer areas and practise securing doors, without the public | Checking routes, keys, doors, timings | Low, before opening or after closing |
| Communications test | Send a test alert by PA, radio or group message and check who received it | Coverage gaps and dead spots | Low |
| Live drill | Staff carry out a procedure in real time, possibly with the public involved | Testing the whole procedure under realistic conditions | Higher, needs careful planning |
ProtectUK guidance recommends practising live communication, such as PA announcements, simulated 999 calls and radio use under pressure, and blocking one or more routes in some exercises so staff learn the alternatives.
How often to test
Neither the Act nor the statutory guidance sets a testing frequency. The guidance says procedures should be reviewed periodically, which could be annually depending on your circumstances. ProtectUK describes training and exercising as regular and ongoing. As good practice, a standard tier venue might aim for:
| Activity | Suggested frequency (good practice) |
|---|---|
| Tabletop exercise with decision makers | At least once a year, ideally twice |
| Walk-through of routes, doors and safer areas | When procedures are written, and after layout changes |
| Communications test | Every few months, and after any change to equipment |
| Live drill | Where reasonably practicable, for example once a year with staff only |
| Extra test | After a real incident, a near miss, a change of manager or a major refurbishment |
Smaller venues can combine these. For example, a 220-capacity café might run one tabletop and one walk-through each year, both before opening, and test the staff message group every quarter. Pick a pattern you will actually keep to.
How to run a 30-minute tabletop exercise
A tabletop exercise is the most useful test for most venues: cheap, quick and revealing. You need four to eight people, including whoever acts as decision maker on different shifts, a copy of your procedures, a floor plan and someone to facilitate and take notes.
- Before the session (15 minutes of preparation): choose one realistic scenario for your venue and write three short updates, called injects, that develop it. Decide what you want to test, for example who decides to lock down.
- Minutes 0 to 5, set the scene: explain that this is a no-blame discussion, not a test of individuals. Describe the time of day, how busy the venue is and who is on shift.
- Minutes 5 to 10, first inject: for example, 'A customer tells the bar that a man with a knife is shouting in the street outside the front door.' Ask: who decides, what do you do first, what do you say and to whom?
- Minutes 10 to 15, second inject: 'Two people in the beer garden are injured. People outside are banging on the doors to get in.' Ask: do you invacuate, lock down or both? Who secures which door? Who calls 999?
- Minutes 15 to 20, third inject: 'Police tell you on the phone the attacker has moved away, but they do not yet know if there is a second person.' Ask: how do you keep people calm, when do you end it, and how?
- Minutes 20 to 27, review: what went well, where people hesitated or disagreed, and what the procedure did not answer.
- Minutes 27 to 30, actions: agree no more than three to five actions, each with an owner and a date.
Change the scenario each time: a suspicious item, an incident at the front entrance, something inside, an alarm activation that might not be a simple fire. Try running it with the deputy in charge, or tell the group the usual exit is blocked.
ProtectUK also offers ACT in a BOX, an interactive digital exercise from the National Counter Terrorism Security Office based on fictional marauding attacker and explosive device scenarios. It is available under the Learning tab on ProtectUK, with facilitator guides for organisations with less experience of running exercises.
Running walk-throughs and drills safely
Walk-throughs and live drills test what tabletops cannot: whether doors lock, keys are where they should be, and how long things take. Plan them carefully:
- Start with staff only, before opening or after closing, before involving the public.
- Tell staff in advance, and make every message clearly an exercise.
- Never use realistic replica weapons or role-play attackers where the public could see.
- Do not call 999. Have someone play the call handler instead.
- If a drill could be seen from outside, tell your neighbours or landlord in advance.
- Time the key steps: how long to raise the alarm, secure all doors or clear the building.
- Be considerate of staff who may find scenarios distressing. The Home Office guidance advises viewer discretion with some training videos that recreate attacks.
- Never compromise fire safety: keep fire exits usable throughout.
Recording outcomes
ProtectUK advises keeping records of the outcomes of tests and rehearsals so procedures can be refined. A one-page record for each exercise is enough:
| Field | What to note |
|---|---|
| Date, type and duration | For example, tabletop, 30 minutes |
| Scenario | A short description of what was tested |
| Who took part | Names and roles |
| What went well | Decisions made quickly, staff who knew their role |
| Gaps found | Unclear decisions, missing keys, alerts not heard |
| Actions | What will change, who owns it and by when |
| Procedure updated | Yes or no, and the new version number |
Close the loop. When an action is done, update the procedure, brief staff on the change and note the new version. See record keeping and evidence for how this fits into your wider records.
Common mistakes and next steps
- Only ever testing with the same manager in charge.
- Exercises that always go to plan, because nothing goes wrong in the scenario.
- Finding problems and never fixing them.
- Live drills that frighten the public or staff.
- Treating a fire drill as a test of terrorism procedures.
Check your tier with the free checker, make sure your public protection procedures and staff training are in place, then put your first tabletop in the diary. Our packs include ready-made tabletop scenarios and an exercise record template.
Frequently asked questions
Is testing procedures a legal requirement?
The Act does not set a specific testing duty for the standard tier. However, the Home Office guidance asks responsible persons to consider how procedures will be tested and practised, because procedures that cannot be carried out quickly and effectively are unlikely to meet the requirement.
How often should we run a drill?
The Act does not set a frequency. As good practice, aim for at least one tabletop exercise a year, a walk-through when procedures or layouts change, and regular checks that alerts reach every area.
What is a tabletop exercise?
A tabletop exercise is a discussion where a small group works through a realistic scenario and decides what they would do at each stage. It tests decisions, roles and communication without disrupting the venue.
Can we combine terrorism drills with fire drills?
The Home Office guidance says terrorist evacuation plans can be tested and practised in the same way as fire plans, but the procedures differ, for example in routes, alerts and dispersal. Test them separately so staff learn the differences.
Sources
General information based on the Act and published guidance, not legal advice. Check the official statutory guidance on GOV.UK for your situation.