The Exercise That Never Changes
A payments processor has run the same hurricane tabletop every November for three years. Attendance is strong, satisfaction scores are high, and the after-action report is largely a copy of the prior year's. Forty percent of corrective actions from the last two exercises remain open, including a generator fuel contract and an outdated call tree. The new CIO has asked whether the program is 'actually proving anything,' and a regulator has requested evidence of an exercise program that tests objectives, not just attendance. There is no dedicated exercise budget, and the operations team resists anything requiring downtime or weekend work.
1. What is the most likely reason the exercise program is not improving outcomes?
Read the worked answer
- Repetition of the same scenario, format, and participants produces a learning plateau; the team is rehearsing familiarity, not capability.
- The exercises appear to lack stated objectives and measurable success criteria, so nothing can fail and nothing can improve.
- Satisfaction scores are being used as a proxy for effectiveness. They measure comfort, not performance.
- Corrective actions have no owner, due date, or escalation path, so findings recur - a repeat finding is a governance failure, not a training failure.
- The program is not linked to the BIA and risk register, so priority risks (cyber, third-party dependency) go unexercised.
- There is no progression of exercise types (seminar, tabletop, functional, full-scale) building toward tested recovery capability.
2. Design a 12-month exercise cycle that fits the constraints and satisfies the regulator.
Read the worked answer
- Q1: objectives-driven tabletop on a top-priority risk from the risk register (for example, ransomware on the billing platform), with an independent facilitator, written objectives, and pass/fail criteria.
- Q2: functional exercise of crisis communications and notification, measuring time-to-notify and call-tree accuracy - no production downtime required, addressing operations' resistance.
- Q3: dependency-focused exercise with the print vendor and the parent-company feed, testing the interfaces that actually drive recovery time.
- Q4: recovery or failover test on the tier-1 platform, scheduled in a low-volume window, validating achieved RTO/RPO.
- Each event documents scope, objectives, success criteria, participants, observations, and corrective actions with named owners and due dates.
- Rotate scenarios year to year and include senior leaders; combine events where feasible to control burden and cost.
- Report a one-page annual cycle plan to the regulator showing objectives, types, and linkage to business impact tiers.
3. How should the CIO's 'prove it' question be answered, and what should be done about the 40 percent of open corrective actions?
Read the worked answer
- Report metrics that measure capability: percentage of objectives met, achieved RTO versus target, time-to-notify, percentage of corrective actions closed on time, and coverage of tier-1 processes and key dependencies.
- Triage the legacy backlog: close what is no longer relevant, formally accept specific risks with a named owner, or fund and schedule the rest. An open item with no owner is not a plan.
- Assign corrective-action owners during the exercise itself, before participants leave, with an executive sponsor and escalation of overdue items to the risk committee.
- Suspend new exercise content until critical open actions are closed; exercising the same known gaps repeatedly adds no assurance.
- Give the CIO a trend line, not a satisfaction score, as the primary evidence.