Not read all the replies but this is how I do it.
Set off some kind of prompt which starts the crisis going. This might be a complaint, a micro result, a test etc.
Drip feed information of this kind throughout the process which helps guide the investigation. This could include audit records, further complaints, contact from retailers.
Whatever scenario you chose should be severe enough to prompt a recall and I also try and point it towards some kind of conclusion so that the team get a modicum of closure but also know how far to go. So for example for a metal find I might sneak in a maintenance record showing there was an issue on one batch. This then forces the team to consider where the rest of the batch has gone.
At the end of it, the team should as a minimum have identified where the affected product has gone to depot level (this may become a wider recall later but given the information early on, ideally this should be within 2 hours). At the end of 4 hours I would expect them to have (fake) communicated the issue and hopefully identified if other batches are impacted.
Things I've used in the past have included:
Metal complaints
Pathogenic micro issue
Allergen contamination
But I'm thinking for my next one I'm going to link some kind of contamination issue to a site security breach.
Can you tell I like doing these?