"We participated in the sector exercise."
It's a good line for a board pack. For some boards, it's also the whole report. The firm showed up, the scenario ran, everyone went home.
Showing up was never the point.
A rehearsal with no published notes
On October 8, 2026, the UK's Cross Market Operational Resilience Group completed a sector-wide simulation of a global cloud service disruption. The Bank of England described it as involving the 38 largest and most systemically important banks and market infrastructure operators, with HM Treasury, the Financial Conduct Authority and the wider sector taking part.1
The Bank said it now expects firms to act on the exercise to improve their resilience and their ability to respond to serious disruption. The release doesn't say what the exercise found.
It doesn't need to. The exercise tested a shared dependency. The response to it isn't shared. The findings that matter are each firm's own, and that's where the board's question belongs.
Attendance isn't evidence
Participation tells a board that the firm was in the room. It says nothing about what happened inside the firm's own response: which decision took too long, which dependency surprised someone, which contact list was out of date, which manual workaround nobody had tried.
Those discoveries are the product of an exercise. Without a record of them, the firm ran a rehearsal and kept no notes. Next year's exercise may find the same things and feel just as useful.
This applies well beyond the UK and well beyond banking. Any exercise your firm joins, whether run by a regulator, an industry group or a critical vendor, produces the same choice: record what you learned and change something, or file the attendance.
Ask for the action list
The board's question is short: what did we change because of this? The answer should fit on one page.
Exercise follow-up: [exercise name, date]
What we expected to work and didn't: [items]
Actions: [action, owner, due date]
Actions closed, and how we verified them: [item, evidence]
What we would need to see next time to call it improvement: [criterion]
The last line matters most. Decide now what result would show the firm hasn't improved. If nothing could, the follow-up is a ritual, not a test.
Give the page an owner. Not the team that designed the scenario; they may grade it kindly. Give it to the executive who owns the operation that would actually stop in a real cloud outage, and have them bring it to the next board meeting with the open items still open.
Expect the first version to be short and a little uncomfortable. That's the useful version.
Showing up is the start. What changed is the evidence.
Related Reading
Read False Green in Disaster Recovery: Why the Finding Determines the Fix for what happens when a test proves less than the organization hears.
