TLPT and the testing authority

The testing authority is the body that oversees TLPT under the applicable framework. Its role is to ensure that exercises are carried out consistently, that scopes cover critical functions, that testers are suitable, and that findings lead to remediation. It does not run the test for the firm, and it does not own the firm's resilience. The firm remains responsible for its systems, its response and its follow up. The authority provides the framework, the oversight and the challenge that make the firm's exercise credible to supervisors and to the wider financial system.

Engagement with the authority runs through the exercise, not only at the end. Firms typically discuss scope, scenarios and timing in advance, keep the authority informed during testing where the framework requires it, and share the report and remediation plan afterwards. That sequence prevents surprises: an authority that first learns of a narrow scope when it reads the final report has little opportunity to correct it, whereas an authority involved at scoping stage can challenge exclusions before testing starts.

The authority's purpose is to raise the quality and consistency of threat-led testing across the sector. Without oversight, firms might define TLPT in different ways, test different things, and report results that cannot be compared. With oversight, a supervisor reading reports from several firms can judge whether critical functions were covered, whether scenarios reflected real threats, and whether remediation is progressing. That comparability supports confidence in the sector as a whole, not only in individual firms.

Oversight also protects the firm. A framework backed by an authority gives the firm a clear basis for asking suppliers for access, for seeking board time, and for prioritising remediation. When a supplier questions why a test needs to touch its platform, the firm can point to the framework rather than to its own preference. When a board questions the cost of remediation, the firm can point to findings from a supervised exercise. Authority oversight thus strengthens the firm's internal case for resilience investment.

Engagement usually begins with notification and scoping discussions. The firm presents its critical functions, its proposed target systems, its threat intelligence picture and its tester arrangements. The authority may challenge the scope, suggest additional targets, or ask for clarification on exclusions. That challenge is valuable: it tests whether the firm has thought hard about its most important functions, and it surfaces gaps while they can still be fixed.

During testing, engagement is lighter but still important. The authority may receive updates, particularly if a significant finding emerges or if the test is paused for safety reasons. After testing, the firm shares the report and the remediation plan, and the authority may follow up on progress. That follow up is not a formality. It checks whether remediation is actually happening, whether timelines are realistic, and whether findings that affect other firms or the wider system have been considered.

Reviewers focus on the reasoning behind the exercise as much as on the findings themselves. They ask whether the scope matched the critical functions, whether the scenarios followed the intelligence, whether the testers were independent, and whether the report explains what happened in a way that supports remediation. A report that lists vulnerabilities without showing attack paths, detection times and response actions will raise questions, because it does not show how the firm would cope with a real incident.

The authority's involvement does not transfer responsibility. The firm owns the accuracy of its service maps, the safety of its production systems during testing, the quality of its incident response, and the completion of remediation. If a test causes disruption because safeguards were inadequate, the firm cannot point to authority oversight as an excuse. If remediation stalls because no owner was named, the firm cannot point to the authority for not chasing it sooner.

That division is healthy. It keeps the authority in an oversight role, able to challenge without becoming a participant in the firm's operations. It also keeps the firm accountable for the decisions that only it can make: which functions matter most, which suppliers are critical, and how quickly a weakness should be fixed. A firm that treats authority engagement as a substitute for its own judgement will produce a compliant looking exercise that teaches it little.

TLPT findings are sensitive by nature. They describe paths an attacker could take, weaknesses in detection, and gaps in response. Sharing them widely would increase risk, while sharing them too narrowly would prevent remediation. The framework therefore sets out how reports are handled, who may receive them, and how findings that affect other firms or suppliers are communicated. Firms should follow those arrangements carefully, and should not circulate full reports beyond the agreed audience.