Rehearsing the Unthinkable: A Biosecurity Tabletop for the UK Microbiology Bench

Every laboratory has a version of this story. A parcel arrives in the post room with a handwritten label and no requisition. A specimen bag turns up in the rack with a smear of something on the outside and a form that names no sender. A soil sample is submitted by a member of the public who says it came from a site they would rather not describe. In almost every case the explanation is mundane, and the correct response is a shrug and a phone call. The trouble is that the exceptions are precisely the cases where a shrug is expensive.

Biosecurity tabletop exercises exist to rehearse the awkward middle ground: the sample that is probably nothing, but which has not yet been proved to be nothing. This guide sets out how a UK microbiology laboratory can run one without turning the bench into a melodrama.

Most suspicious samples are boring. That is exactly why we rehearse

A tabletop is not a terrorism drill. It is a decision-making exercise, conducted around a table with a flip chart, in which a team talks through a scenario and discovers where its plan, its call list and its paperwork do not meet reality. No one dons a respirator. Nothing is simulated in the containment suite. The output is a list of gaps with owners and dates.

The reason to bother is that biosecurity incidents are rare enough for organisational memory to lapse between them. Staff who have never handled one default to the habits of routine work: open the bag, look inside, ask a colleague, put it in the fridge. Those habits are efficient and, in the wrong circumstances, wrong.

Begin with the decisions, not the documents

Plans tend to be written as prose. Exercises work better when they are built around a handful of decisions that somebody must actually make, in sequence, under time pressure and with incomplete information:

• Do we handle this at all, or does it leave the building intact?
• Who has the authority to stop work in the room?
• What do we tell the person who brought it, and what do we not tell them?
• Who is notified first: our own duty microbiologist, the police, the health protection team, or all three?
• What do we record, and who holds the record?

Write those five questions on the wall before the exercise starts. Everything else is detail.

Three scenarios that expose the seams

Scenario A: the powder with no paperwork

A padded envelope is opened in the reception area. Inside is a twist of foil containing a grey powder and a note reading only 'from the allotment'. Reception staff have already opened it and breathed near it. The laboratory is asked, over the phone, whether it can 'just test it'.

This scenario tests the boundary between the laboratory and the rest of the organisation. The instinct of an interested scientist is to help. The correct first move is to secure the area, keep people away, avoid handling or disturbing the material, and escalate through the organisation's suspicious-package procedure — police on 999 if the circumstances suggest a credible threat, 101 otherwise — while seeking public health advice through the usual route. Testing is a downstream question, and usually the wrong one.

Scenario B: the leaking specimen

A blood culture arrives with visible contamination on the outside of the bag and a request form that has been handled with the same gloves. Nobody knows what leaked, or when. Here the exercise should surface the mundane failures: whether the receiving bench has spill materials within arm's reach, whether the courier's paperwork identifies the sender, and whether staff know that a leak is a reportable internal incident rather than an inconvenience to be wiped up quietly.

Scenario C: the environmental sample that does not fit

A sample labelled 'surface swab, private residence' arrives with no submitting organisation, no clinical context and a request for 'full analysis'. It may be entirely legitimate. It may also belong to a dispute, an insurance claim or a police investigation. The learning point is the intake conversation: who is entitled to submit, what questions are asked at receipt, and when a laboratory should decline work it cannot properly contextualise.

The first ten minutes: containment without heroics

The best-performing teams in these exercises tend to do unremarkable things very well. They isolate the item and the immediate area. They restrict access and record who has already been exposed. They cover rather than clean where cleaning would aerosolise. They avoid moving the item through busy corridors. They inform a named person rather than broadcasting.

What they avoid is improvisation dressed as expertise. Nobody in a UK diagnostic laboratory is required to make a field judgement about whether a powder is hazardous; there is no test kit on the shelf that settles it, and no benefit to a scientist improvising a chemical assessment on the bench.

Build the call list before you need it

Most exercises fail at notification, not at containment. A workable list for a UK laboratory typically includes the duty microbiologist or on-call consultant, the biological safety officer or laboratory safety adviser, the designated safety officer for the site, estates and security, the organisation's communications lead, the UK Health Security Agency health protection team where public health implications are plausible, and the police where a threat is credible. Add the courier and the submitting organisation; add the veterinary route if animal pathogens are in play.

Test the list with a live ring-round as part of the exercise. Numbers that are out of date are the most common finding, and the cheapest to fix.

Keep the paper trail as tight as the containment

An incident that is handled well and documented badly will look, six months later, like an incident handled badly. Timestamped notes, a chain-of-custody record, photographs of seals and packaging, the names of everyone who entered the area, the reasoning behind each decision and the name of the person who authorised it: these are the difference between a defensible response and an anecdote.

Retain records in line with the laboratory's quality management system, flag any occupational exposure through the correct route, and consider whether the incident engages reporting duties under health and safety law. Where a biological agent may have infected or exposed a worker, that conversation belongs in the incident report, not in a corridor.

People are the hardest part

The person who opened the envelope will be frightened, and possibly embarrassed. Brief staff early, factually and without speculation. Say what is known, what is being done, what is not known, and when the next update will come. Discourage the group chat, which will always be faster and always less accurate. Make occupational health support visible rather than implied.

Debrief on decisions, not drama

Close the exercise by scoring the things that can be measured: minutes to isolation, minutes to first notification, completeness of the log, number of people who handled the item before containment, and whether the plan was followed or quietly improved upon. Where the team deviated, decide whether the plan or the behaviour should change. Assign one owner per action.

A short pre-exercise checklist is enough to start:

• One scenario, one facilitator, one scribe, ninety minutes.
• The current written procedure, printed, on the table.
• The live call list, with a phone in the room.
• A blank incident form and a blank chain-of-custody sheet.
• A closing question: what would have made the last ten minutes easier?

Run it once a year, rotate the cast, and keep the scenarios dull enough to be believable. Preparedness is not a performance. It is the habit of asking, early and out loud, whether the obvious next step is actually the right one.