A CySA+ analyst is asked to help the security manager improve the organization's incident response readiness after a recent breach revealed that staff were unfamiliar with escalation procedures. Leadership wants a low-risk activity that validates whether the incident response team understands their roles and the decision-making flow of the IR plan, without any impact to production systems or actual response tooling. Which preparation activity BEST meets these requirements?