One table, four seats, about an hour. Everything below is excerpted from the guide and the print sheets; nothing here is a new rule.
This is a fictional company and a fictional incident. Anyone can stop the game at any point with one word, and nobody has to say why. Please do not describe a real incident, and do not name your employer or a colleague.
If someone stops, pause where you are: ask the one question on the safety page, do what the person asks, and resume only if they want to.
Role cards (one per seat), one decision card per seat, the rules sheet, the table artifacts, the decision record, and the scenario card.
Pick the scenario card, which is also the Escalation Card, and read it once. Seat the four roles: CEO, CFO, CIO and CISO. The card offers three Executive Decisions, and the game runs about an hour. Set up the risk board, the twelve-point triangle, the timer and the d20.
Every risk starts at Steady, the first of four steps: Steady, Strained, Serious, Critical. The triangle is twelve points split across Money, Time and Quality, any arm from 1 to 8, and it resets to 4, 4, 4 after every Executive Decision. Money pairs with Financial, Time with Security and Quality with Reputational: an arm at 7 or more cancels one printed step on its paired risk, an arm at 2 or less adds one.
State the objective. Deliver the Escalation Card’s full brief. Ask the CISO for the thirty-second summary. Name the risk the card puts first, and start the clock at the first decision, not before.
Deliver the inject, take up to two questions, and call an Executive Decision when the card offers one. Three injects carry the three Decisions, about twelve minutes each including the decision. Within the decision: three minutes on the table timer, one sentence from each seat, then the table splits the twelve triangle points aloud, then the cards go face down, each seat’s card naming the option it votes for, and all are revealed together. A strict majority carries it; a tie fails, and a failure still pays the printed cost, still counts as resolved, and takes the card’s failure line. A seat that cannot speak aloud votes on a slip, or through a delegate named before the cards went down.
Apply the printed cost first. Then check the triangle: an arm at 7 or more cancels one printed step on its paired risk; an arm at 2 or less adds one. Roll only in doubt, a d20 against the target the card prints: at target or above is full, one to three below is partial, four or more below is a failure. Add +1 per seat that backs the option with a concrete commitment (a person, a budget or a deadline), to a maximum of +3, and the proposing seat’s specialty grade (+3, +2 or +1, printed on its role card) when the option uses it. A partial result tells the complication and moves no marker.
Say so only after the last Executive Decision the card offers has resolved, and only when both containment marks are set: Ways in shut and Leak stopped. The scenario card says which decision sets them and on which results. The marks are necessary, not sufficient.
If the hour runs out before that, the verdict is “not yet reached”: read the cost sentence and hold the debrief anyway.
Verdict in two parts: containment reached or not yet reached, then the cost sentence: one line naming the three risks as the board reads them, and if containment was reached with any risk at Critical, “contained, at a cost the business cannot sustain”. Then the debrief: what failed was process and leadership, not the tool. Ask each seat in turn one question: what would you have asked for sooner, and what would you have refused?
Fill the Decision Record as you go: votes, triangle, roll and outcome per decision, the two containment marks, the risk board at the end, and one line per seat in the debrief.