Articles

Martyn’s Law: Test It Before You Need It

For a big part of my policing career, my job was to make things go wrong. On purpose.

By Danni Grant · 23 October 2026

For a big part of my policing career, my job was to make things go wrong. On purpose.

This week I want to share some of that work, and why it matters for anyone preparing for Martyn’s Law.

The UK’s national counter terrorism exercise programme is led by the Home Office. From 2017 to 2021, I led the Counter Terrorism Policing element of it. I was the first woman to hold that responsibility, and to date, the only one. We designed and delivered exercises that tested our response to a terrorist attack against the policy and process we had actually written down.

It was multi-agency by design. Counter Terrorism Command. National Inter-agency Liaison Officers. Police, fire and ambulance colleagues. Government partners. And, where the scenario demanded it, specialist military capability through Military Aid to the Civil Authorities (MACA).

We tested the national plans that matter most. Operation Plato, the multi-agency response to a marauding terrorist attack, declared by the police. Operation Temperer, the plan for military personnel to support armed police, first used after the Manchester Arena attack in 2017. And the less visible parts: how senior commanders are briefed, and whether the right people know the right things at the right time.

Some of that testing was no notice. A simulated attack in a shopping centre, or on a ferry, with responders finding out the same way they would on the day. No warning, no rehearsal, no script. That’s where you learn how a plan really performs.

Some exercises were large, live, set-piece events, often with hundreds of participants: role players, some made up with realistic injuries, others acting as members of the public. They always drew a crowd. It is fascinating to watch an incident unfold in front of you, knowing there will be no tragic outcome. That’s exactly the point. Others were tabletop exercises around a room.

Then Covid arrived. Think back to those early days. Suddenly people weren’t gathering in the same places, in the same way. Supermarket queues (remember those?). Nightingale hospitals. The military working on UK streets. People who were struggling couldn’t access support in the way they normally would, and many more people were at home, on their own, with more time on their hands.

All of that posed new questions for UK policing, and we had to adapt, quickly. Nobody could come into the room, but the threat didn’t stop, so neither could the testing. Covid took us into new territory, and for us, digital test and exercise was born out of it, with no playbook to follow. It was ground-breaking work, and it was mine to lead.

The work also took me overseas, supporting HM Government partners around the world on their own test and exercise journeys. Different countries and systems, but the same challenge every time: effective command and control. That challenge is global.

I’ve always said I had the best job in UK counter terrorism policing. I worked with the best responders in the world. I flew in a Chinook. I went to incredible places, and worked alongside the very best of the military. Doing all of that as the first woman in the role is something I will always be proud of. I’d like to think I won’t be the last.

Why we test

Exercising isn’t about catching people out. It’s about finding the weak points in a plan before an attacker does.

Every exercise asked the same questions. Does the plan work? Do people know their role? Does information reach the people who need it? And when it doesn’t, where does it break?

My work in organisational learning meant examining the points of failure in UK terrorist attacks since 2016. Some of the hardest lessons weren’t about plans that didn’t exist. They were about plans that hadn’t been practised, roles that weren’t understood, and information that didn’t reach the right person in time.

Regular testing is what turns a plan into a response. When you have to deploy for real, the plan has to already be in people’s heads.

Capturing the learning

An exercise is only half the job. The other half is capturing what it tells you.

As a College of Policing trained debriefer, I led the national team that delivered debriefing on behalf of Counter Terrorism Policing. Lessons identified were a core part of every exercise: the gaps, and the good practice too.

But a lesson identified isn’t a lesson learned. It’s only learned when something actually changes. Until then, it’s just a note in a report.

At national level, that meant managing hundreds of learning recommendations for the UK, each needing an owner, an action and proof it had been done. It takes real effort, and at scale it matters. Otherwise the same lessons get identified again, at the next exercise, or worse, at the next attack.

Dialling it down to Martyn’s Law

You don’t need a helicopter to exercise your procedures, although they are huge fun.

Let me be accurate about what the law says. There is no requirement in the Act to test or exercise your procedures. The statutory guidance is also clear that there is no statutory requirement in the Act to carry out specific counter-terrorism training, learning or instruction (paragraph 7.51).

But that isn’t the end of the conversation. The guidance says those with responsibility for carrying out public protection procedures, as identified by the responsible person, must be made aware of the procedures and their specific role. They also need to be provided with the understanding, experience and tools to carry them out effectively (paragraph 7.51). If staff responsible for carrying out the procedures are not informed of them, or trained in how they should be implemented, it is likely to be difficult for the responsible person to demonstrate that appropriate and reasonably practicable procedures are in place (paragraph 7.52).

And as part of assessing what procedures are reasonably practicable, the guidance says the following should be considered: how procedures will be tested and practised, to ensure they are fit for purpose and that staff can implement them effectively (paragraph 7.28).

Public protection procedures apply to all qualifying premises and qualifying events, Standard Tier included (section 5(1) of the Act).

The guidance includes an example I really like. A Standard Tier bar has several evacuation procedures for different attack methods. During a routine practice, staff are unsure which to choose. That uncertainty causes a delay in responding to the incident, putting people at greater risk. The responsible person reviews what happened, replaces them with one simple evacuation procedure, gives staff updated instruction and schedules an exercise to practise it (example 1, following paragraph 7.19).

That’s a lesson identified and a lesson learned. In a bar. The same principle I worked to nationally.

For Enhanced Tier premises and qualifying events, the guidance goes further: procedures and measures should be reviewed, tested and practised regularly, which will help familiarise staff with their roles and responsibilities (paragraph 8.53).

What this looks like for a business

Proportionate. Not a set piece.

Start with a briefing. At the start of a shift, ask one question: if we had to lock down right now, what would you do? The answers will tell you a lot.

Then walk it through. Walk the evacuation route. Check which doors lock, and who has the keys. You’ll find the door that doesn’t lock on a quiet Tuesday, not on the day it matters.

A tabletop exercise is simply a scenario and a conversation. Put your managers round a table, describe an incident, and add new information as it unfolds. Who decides? Who calls the police, and what do they say?

A short practical drill, at a quiet time, tests whether it actually works.

Then the debrief, the bit that is easiest to skip. You don’t need hundreds of recommendations. Ask three things while it’s fresh. What worked? What didn’t? What will we change? Write it down, give each change an owner and a date, update the procedure, brief staff again, and test it again.

The Act’s requirements aren’t in force yet. That makes now the ideal time to practise, while getting it wrong costs nothing. And it doesn’t have to be expensive. The guidance recognises team briefings, annual refresher briefings, induction sessions and shadowing others as forms of training, learning and instruction (paragraph 7.53), and is clear that it is not mandatory to pay for third-party training or learning to comply with the Act (paragraph 7.55).

Don’t design an exercise to pass

This is the part I feel most strongly about.

I’ve seen exercises written around the plan. The scenario follows the procedure step by step, so of course the procedure works. That isn’t a test. It’s a false positive, and it gives an organisation confidence it hasn’t earned.

Real incidents don’t follow the plan, so the exercise shouldn’t either. You have to create an environment where it’s safe to fail, because that’s where the learning is.

Done badly, test and exercise becomes a tick-box activity. That is genuinely dangerous. A plan that has only ever been tested on its own terms hasn’t really been tested at all.

Realistic doesn’t mean big. Make it realistic enough to find the gaps. And when you find them, be glad. Better now than on the day.

The third question

In my first blog, I asked whether your people would know what to do if something happened tomorrow. In my last, I asked whether they would know what to say.