I want a recovery exercise to place a real decision in front of the executives who would otherwise approve the plan from a distance. If the exercise can be completed entirely by the team that wrote the procedure, it may demonstrate technical competence without examining the bank's ability to act. The important uncertainty is often who can authorise an alternative, what evidence they need and how the customer will be told. Those questions cross the boundaries that ordinary operating reports tend to preserve.
This does not mean every rehearsal should become a large theatrical event. Elaborate scenarios can consume attention without producing better evidence. I favour a narrow, consequential customer situation with enough ambiguity to reveal a decision gap. A delayed commercial payroll file is one example. The affected customer needs an accurate account of what has happened, a view of available options and a realistic next update. The bank may have incomplete information about all three. That is a leadership problem as well as a technology problem.
Exercise the decision, not only the system
When we designed our payment-interruption exercise, the first proposal concentrated on restoring infrastructure. That was a necessary part of the work, but it left the executive team largely as observers. I asked what would happen if restoration took longer than expected and customer calls arrived before the scope of the incident was clear. Who could approve a fallback process? Who would decide that our evidence was sufficiently reliable for an external message? Which colleague would tell a branch manager that a promised update had to change?
We used synthetic records and kept the exercise away from live payment activity. Participants received information at different times because that is how an incident often develops. The purpose was not to trick colleagues with an impossible puzzle. It was to observe whether they could establish a shared picture, identify uncertainty and make bounded decisions. We included frontline service staff because a message that satisfies an internal approval chain may still fail to answer the customer's immediate question. Their participation altered the discussion considerably.
Observers recorded the time taken to reach specific decisions and the evidence available when those decisions were made. We did not simply measure the end-to-end duration of the exercise. An aggregate completion time could conceal a long period during which nobody knew who owned the next action. We wanted to see that interval. We also recorded requests for information that could not be fulfilled through the assumed recovery channel. One inaccessible contact list told us more about practical preparedness than several pages of a completed procedure checklist.
There is a reasonable concern that such exercises distract experienced people from current operating work. They do. The question is whether the interruption is proportionate to the dependency being examined. A bank that cannot release a few decision-makers for a controlled rehearsal should be cautious about claiming they will be available and coordinated during a real event. I make the time commitment explicit when approving the exercise and ask participants which ordinary responsibilities need cover. Unplanned overload is not a useful measure of commitment.
Keep the uncomfortable findings intact
The first run took ninety-four minutes to produce a consistent customer message. Two functions each believed that another owned approval of the fallback process. The temptation after such a result is to explain why the exercise was unusual: a colleague was absent, a document had just changed, or the scenario omitted information that would normally be available. Some explanations may be valid. They should be recorded, but they should not erase what happened. An incident will also occur under circumstances that differ from the plan.
I asked the team to preserve the original observation beside its explanation and proposed correction. That made the review less comfortable and more useful. We could distinguish a procedural gap from a scenario limitation and decide what evidence would close each issue. Where an executive believed the finding overstated the risk, that judgement remained visible. The board did not need a catalogue of every operational detail, but it did need to know which material assumptions remained disputed and who was accountable for resolving them.
The way leaders respond to an awkward finding affects the next exercise. If a failed hand-off becomes a personal embarrassment, participants will prepare a smoother demonstration rather than a more revealing test. I want colleagues to prepare properly, but not to rehearse away every uncertainty before the observers arrive. We therefore separate the assessment of the plan from an individual's performance discussion. Deliberate disregard of a responsibility still matters. An honest discovery that the responsibility was unclear should lead first to clarification and a better test.
We also avoid presenting a repeat exercise as a universal certificate of resilience. Our second run produced a consistent message in thirty-one minutes and resolved the identified approval ambiguity. Those are specific findings under specific conditions. They do not establish how the bank would perform in every disruption. I expect reports to state what remained outside scope, including dependencies that were assumed available. Precision about the limits of a test makes the result more credible. It also helps the next exercise examine a different weakness rather than repeat a successful performance.
Fund the correction that the evidence supports
Recovery findings should influence investment, but they do not always justify more technology. In our case, access arrangements and decision procedures required attention alongside infrastructure. A second platform would not have resolved an unclear authority to use it. I asked the investment committee to connect each proposed expenditure to an observed weakness or a clearly stated untested dependency. That did not eliminate judgement from the decision. It stopped us from treating the most tangible purchase as the automatic response to an operational concern.
Some corrections were inexpensive in financial terms and demanding in management time. Maintaining an accessible contact list required an owner, a refresh process and verification that it could be reached through the recovery arrangement. Agreeing a fallback authority required legal, operating and customer considerations to be reconciled before an incident. Neither task made an impressive launch announcement. Both were necessary. I am wary of resilience programmes whose budget is detailed but whose ordinary maintenance responsibilities remain vague once the programme team has disbanded.
The board's role is to examine whether management has credible evidence, sufficient resources and a clear process for dealing with unresolved findings. Directors should not attempt to run the recovery room. They can ask whether an independent observer attended, whether the exercise included customer-facing decisions and whether repeated issues are being closed with evidence. They can also ask whether the chief executive participated where the scenario required an executive choice. Delegating every uncomfortable rehearsal question downward is itself information about the institution's readiness.
For me, a useful exercise ends with fewer assumptions and a small number of obligations that someone genuinely owns. It may also end with a decision to accept a residual limitation because the cost of removing it is disproportionate. That choice should be explicit and revisited when circumstances change. The exercise has earned its interruption when it changes what the bank is prepared to do, who is authorised to do it or what it can honestly tell a customer waiting for an answer.