Exercises for the Board

A board exercise rehearses the strategic decisions that only senior leadership can make during a severe disruption, such as whether to pause a service, how to communicate externally, what risk to accept while recovering, and how to oversee a response without interfering in it. It is not a technical test, and it should not become a briefing in which the board listens while others present. Board members should be asked to decide, to explain their reasoning, and to face the consequences of those decisions as the scenario unfolds. The value lies in revealing gaps in authority, in risk appetite, and in communication before a real disruption exposes them.

A board exercise should not try to test technical procedure, system configuration, or the detailed steps of an incident response. Board members are unlikely to operate those procedures in a real disruption, and asking them to do so wastes the session and creates a false sense of coverage. The scenario should therefore be pitched at the level of consequences and choices: customer harm, market impact, regulatory communication, reputation, and the trade off between speed and safety. Technical detail should appear only as background that informs a strategic choice, such as a briefing note stating that a workaround is available but untested. The board then decides whether to approve its use, knowing the uncertainty involved.

Risk appetite is often described in general terms until a scenario forces it to be applied. A board exercise can do that by presenting a choice in which every option carries harm: keep a service running with uncertain data, pause it and leave customers without access, or use an untested alternative. Consider a wealth service whose client reporting is disrupted before a period of market volatility. The board may need to decide what clients are told, whether reporting is delayed, and what assurance can honestly be given. The discussion should surface whether existing appetite statements actually guide such a choice, or whether they are too vague to help. If appetite does not guide the decision, the exercise has found a governance gap, not merely a difficult scenario.

External communication at board level involves decisions about tone, timing, and accountability, not drafting alone. The board may need to decide who speaks for the firm, what is said when facts are incomplete, and how to handle questions from regulators, media, or key clients. An exercise should present draft messages that are plausible but flawed, such as a message that promises a return time that cannot be kept, and ask the board to correct them. It should also test the boundary between transparency and speculation. A message that admits uncertainty can build trust, while a message that invents certainty can damage it when the certainty proves false. Those judgements are strategic, and they belong in a board exercise.

Oversight during a disruption means asking the right questions, challenging assumptions, and ensuring that decisions are recorded, without taking over operational command. A board exercise should rehearse that boundary. Board members can practise asking what information is missing, what alternatives were considered, and what harm each option creates, while leaving the incident team to execute the chosen course. The scenario can test this by giving the board incomplete or conflicting briefings and observing whether members demand clarity or accept reassurance. A board that intervenes in operational detail during an exercise may do the same in a real incident, slowing the response it is trying to help.

Board conclusions should reach the service plan through named actions, not through general encouragement. If the exercise reveals that authority to pause a service is unclear, that authority should be clarified in writing. If it reveals that risk appetite does not cover a key choice, appetite should be revised or supplemented. If it reveals that external communication needs a faster approval route, that route should be agreed. The board should also receive a follow up report showing which actions have been completed, so that the exercise is not forgotten once the session ends. A board exercise that produces no change to authority, appetite, communication or oversight has rehearsed a discussion, not a decision.