[OR] [BDCB] [E3] [CBS] [1] [ST] Perform Scenario Testing

Sub-CBS Code

Name of Sub-CBS

Severe but Plausible Scenario

Recommended Scenario Test

Testing Method

Scenario Testing Objective

Key Scenario Injects / Disruption Conditions

Interconnections and Interdependencies Tested

CBS-1.1

Payment Participant Management

A privileged account is compromised and used to alter participant permissions shortly before the start of a high-volume settlement period.

Conduct a controlled participant-access integrity exercise involving unauthorised entitlement changes, loss of the primary identity service, and urgent participant-access restoration.

Cyber incident simulation combined with access-control recovery test. This method is appropriate because the scenario must test both decision-making and technical restoration without modifying live participant permissions.

Confirm that unauthorised changes are detected, contained, investigated, reversed, and independently validated before affected participants resume payment activity.

Multiple participant profiles altered; privileged-user logs partially unavailable; one legitimate participant locked out; a suspicious instruction submitted; primary administrator unavailable; urgent request to restore access before settlement cut-off.

Identity and access management; participant records; compliance approval; security monitoring; CBS-1.2 Payment Instruction Submission; CBS-1.3 Transaction Validation and Authentication; participating financial institutions.

CBS-1.2

Payment Instruction Submission

A telecommunications outage affects several participants while a DDoS attack degrades the internet-facing payment gateway and an alternate channel operates at limited capacity.

Execute a multi-participant connectivity and submission continuity exercise using controlled channel failover, simulated message queues, and participant contingency procedures.

Network resilience test and third-party disruption exercise. This approach tests technical connectivity and the operational coordination required across BDCB, telecommunications providers, and participants.

Demonstrate that priority payment instructions can continue to enter the settlement chain and that accumulated instructions can be recovered without loss, duplication, or cut-off breach.

Primary network path unavailable; DDoS alerts increase; alternate path restricted to 40% capacity; two participants cannot authenticate through the alternate route; transaction backlog grows; a settlement cut-off approaches.

Participant networks; telecommunications services; secure messaging gateway; authentication services; CBS-1.3; CBS-1.5 Payment Processing and Routing; external financial institutions; incident communications.

CBS-1.3

Transaction Validation and Authentication

A failed certificate or authentication-service update causes valid instructions to be rejected while security monitoring indicates possible key compromise.

Perform an authentication-integrity simulation that requires emergency certificate validation, key revocation, alternate authentication, and safe resumption of queued transactions.

Integrated cyber simulation and technical recovery test. The combination is needed because processing must not resume until both service availability and transaction authenticity are established.

Validate that BDCB can distinguish a technical fault from compromise, protect transaction integrity, activate alternate validation, and resume processing without accepting unauthorised instructions.

Sudden increase in authentication failures; conflicting certificate status; time-synchronisation drift; suspected key exposure; pressure from participants to bypass validation; backlog of high-value payments.

Cryptographic services; time services; secure messaging; participant credentials; cybersecurity monitoring; CBS-1.2; CBS-1.4 Liquidity and Funds Availability Management; CBS-1.5.

CBS-1.4

Liquidity and Funds Availability Management

Settlement balances and intraday liquidity positions become inconsistent following database corruption and replication delay.

Conduct a data-integrity and liquidity reconstruction exercise using independent records, transaction journals, participant confirmations, and controlled suspension of settlement.

Data integrity and reconciliation test. This method directly tests whether authoritative liquidity positions can be established before settlement resumes.

Demonstrate that corrupted positions can be detected, isolated, reconstructed, reconciled, and approved within the time available to avoid settlement gridlock.

Balance discrepancies across databases; delayed replication; one participant disputes its position; collateral information unavailable; payment queues expand; senior management must decide whether to suspend or restrict settlement.

Settlement accounts; liquidity monitoring; transaction journals; participant treasury teams; CBS-1.5; CBS-1.6 RTGS Processing; CBS-1.7 Deferred Net Settlement Processing; risk management.

CBS-1.5

Payment Processing and Routing

A software deployment introduces routing defects, causing duplicate, misdirected, and delayed instructions across both RTGS and deferred settlement streams.

Run a controlled release-failure and rollback exercise in a production-like environment, followed by transaction reconstruction and backlog recovery.

Technical simulation, rollback test, and end-to-end reconciliation test. This tests the central concentration point without exposing live settlement to uncontrolled risk.

Verify rapid detection of routing anomalies, suspension of unsafe processing, successful rollback, identification of affected transactions, and controlled resumption within Impact Tolerance.

Error rates increase gradually; duplicate instructions detected; one transaction routed to the wrong stream; monitoring initially indicates normal availability; rollback fails on the first attempt; backlog exceeds normal capacity.

Change management; processing platform; routing rules; monitoring; CBS-1.3; CBS-1.4; CBS-1.6; CBS-1.7; CBS-1.8 Settlement Finalisation and Confirmation.

CBS-1.6

Real-Time Gross Settlement (RTGS) Processing

The RTGS application and primary storage fail during peak high-value processing while the recovery environment has delayed replication.

Conduct a full RTGS failover and settlement-restoration exercise using representative peak volumes and controlled participant involvement.

Disaster recovery test and end-to-end Critical Business Service simulation. A full technical and operational test is necessary because RTGS resilience depends on infrastructure, data, people, participant connectivity, and finality controls.

Demonstrate restoration of minimum viable RTGS capability, preservation of committed transactions, reliable settlement finality, and clearance of priority obligations before the Impact Tolerance is breached.

Primary RTGS unavailable; latest replication incomplete; one recovery component fails health checks; high-value payments accumulate; participant liquidity pressures increase; decision required on extending settlement hours.

Payment-processing platform; settlement ledger; storage and replication; data centre; recovery site; CBS-1.4; CBS-1.5; CBS-1.8; participant banks; telecommunications providers; crisis management.

CBS-1.7

Deferred Net Settlement Processing

An incorrect clearing file and batch-processing defect produce materially inaccurate multilateral net positions shortly before a scheduled settlement cycle.

Perform a missed-cycle and net-position reconstruction exercise involving input validation, independent recalculation, participant confirmation, and delayed-cycle decision-making.

Data reconciliation test and simulation exercise. This method tests both calculation integrity and operational decisions concerning postponement, recalculation, and participant communication.

Confirm that inaccurate positions are detected before settlement, reconstructed accurately, communicated appropriately, and settled through a controlled contingency cycle.

Control totals fail; one source file is missing; initial recalculation produces a different result; participant funding instructions already issued; cut-off time approaches; pressure to settle provisionally.

Clearing inputs; batch scheduler; secure file transfer; liquidity management; CBS-1.4; CBS-1.5; CBS-1.8; clearing participants; reporting functions.

CBS-1.8

Settlement Finalisation and Confirmation

Payments appear processed, but settlement confirmations and replicated ledger records are inconsistent after a database failover.

Conduct a settlement-finality assurance test that requires authoritative-status determination, participant enquiry handling, duplicate-prevention, and ledger reconciliation.

Data integrity, reconciliation, and controlled failover test. This is appropriate because availability alone is insufficient where payment status cannot be trusted.

Establish whether BDCB can preserve finality, prevent duplicate resubmission, communicate reliable status, and restore consistent records within the approved tolerance.

Conflicting transaction statuses; confirmations delayed; participants resubmit payments; audit journal remains available but the reporting database is inconsistent; one high-value transaction cannot immediately be classified.

Settlement engine; authoritative ledger; notification services; transaction journals; CBS-1.6; CBS-1.7; CBS-1.9 Exception and Failed Transaction Management; participants.

CBS-1.9

Exception and Failed Transaction Management

A major processing interruption produces thousands of exceptions while the case-management platform and normal participant-support channels are unavailable.

Run a high-volume exception-management and backlog-clearance simulation using alternate records, severity prioritisation, manual controls, and participant coordination.

Operational simulation and capacity stress test. The method tests the ability of people and processes to operate under exceptional workload rather than merely recover the case-management system.

Validate that critical exceptions can be identified, prioritised, resolved, documented, and communicated without losing transaction traceability or delaying the next settlement cycle.

Exception volume reaches ten times normal; key specialists unavailable; case system inaccessible; participants submit inconsistent supporting information; duplicate cases emerge; following-day processing is due to begin.

Payment operations; transaction logs; participant support; CBS-1.5; CBS-1.8; CBS-1.10 Settlement Risk Monitoring and Control; communications; workforce succession arrangements.

CBS-1.10

Settlement Risk Monitoring and Control

Ransomware disables operational dashboards and security monitoring while payment processing remains available but shows early signs of queue and latency deterioration.

Conduct a monitoring-blindness exercise requiring transition to independent and manual monitoring while cyber containment and payment-service decisions are made.

Cyber incident simulation and operational walk-through with live data feeds where controlled. The method tests whether the service can continue safely when normal visibility is lost.

Determine whether BDCB can detect deterioration through alternate indicators, establish safe operating limits, escalate promptly, and suspend or restrict processing before harm becomes unacceptable.

Primary dashboards unavailable; logs delayed; participant complaints increase; queue depth rises; one security alert suggests lateral movement; manual reports disagree; decision required on continuing processing.

Monitoring tools; security operations; payment engine; liquidity information; CBS-1.4; CBS-1.5; CBS-1.11 Payment System Oversight and Compliance Monitoring; CBS-1.12 Incident Management.

CBS-1.11

Payment System Oversight and Compliance Monitoring

Supervisory and participant-compliance records are corrupted during a cyber incident while several operational control breaches are reported.

Conduct an oversight-continuity and information-integrity exercise requiring reconstruction of compliance status and escalation of material participant breaches.

Tabletop exercise supported by data-restoration testing. The method is suitable because governance decisions and evidential integrity must be tested together.

Confirm that BDCB can continue effective oversight, identify material control breaches, preserve independent evidence, and provide reliable information to senior management.

Compliance dashboard corrupted; participant reports conflict; audit records available only offline; operational teams request temporary rule exceptions; an oversight decision is required during the service disruption.

Compliance records; supervisory teams; payment rules; audit trails; CBS-1.1; CBS-1.10; CBS-1.14 Settlement Reporting and Regulatory Information Management; legal and risk functions.

CBS-1.12

Operational Incident and Service Disruption Management

A compound cyber and infrastructure event affects payment processing, corporate communications, and the incident-management platform, while key decision-makers are dispersed.

Conduct an integrated crisis management and payment-service disruption exercise with timed injects, incomplete information, conflicting priorities, and external stakeholder communications.

Crisis management exercise and integrated business-technology simulation. This tests leadership, coordination, escalation, communications, and technical response across the end-to-end service.

Evaluate whether BDCB can establish command, classify service impact, mobilise appropriate teams, make timely decisions, communicate consistently, and keep recovery within Impact Tolerance.

Incident-management platform unavailable; primary communications degraded; cyber team recommends isolation; operations seeks continued processing; participant enquiries surge; media query received; recovery estimates change repeatedly.

Crisis management; cybersecurity; ICT operations; payment operations; legal and compliance; communications; senior management; CBS-1.10; CBS-1.13 Business Continuity and Service Recovery; participants and critical providers.

CBS-1.13

Business Continuity and Service Recovery

Ransomware affects the primary environment and accessible recovery infrastructure, while the alternate site has limited staffing and a critical telecommunications route fails.

Perform an end-to-end cyber recovery and minimum-viable-service exercise that assumes normal failover cannot be used.

Cyber recovery exercise, disaster recovery test, and alternate-site simulation. This is necessary to challenge common-mode failure and recovery assumptions rather than demonstrate routine failover.

Demonstrate clean recovery, protected restoration data, minimum viable payment service, alternative communications, workforce mobilisation, and restoration before the Impact Tolerance is exceeded.

Primary and standard recovery environments unavailable; last known clean backup requires validation; alternate-site capacity limited; key technical specialist absent; participants require urgent settlement; malware persistence suspected.

Backup and recovery; alternate facilities; telecommunications; specialist personnel; third-party infrastructure; CBS-1.2 through CBS-1.10; CBS-1.12; participant contingency arrangements.

CBS-1.14

Settlement Reporting and Regulatory Information Management

A data-warehouse failure and report-logic defect cause inaccurate settlement and management reports during an ongoing payment disruption.

Conduct a source-to-report reconstruction and alternate-reporting exercise using authoritative transaction records and manual management information.

Data integrity and reporting continuity test. This tests the reliability of decision information and regulatory evidence during stressed operations.

Confirm that management and oversight functions receive timely, accurate, reconciled information even when normal reporting tools are unavailable.

Reports conflict with settlement ledger; audit extract incomplete; management requests exposure data within 20 minutes; participant totals do not reconcile; reporting staff must operate from an alternate location.

Settlement ledger; data warehouse; reporting platform; CBS-1.8; CBS-1.10; CBS-1.11; senior management; audit and compliance.

CBS-1.15

Post-Settlement Review and Continuous Improvement and Decision Support

A major scenario test reveals recurring weaknesses, but evidence is fragmented, accountable owners dispute findings, and remediation is delayed by competing priorities.

Conduct a post-test governance and remediation challenge exercise covering root-cause analysis, risk acceptance, prioritisation, Board reporting, and closure validation.

Desktop review and governance tabletop. This method is appropriate because the objective is to test whether lessons are converted into controlled and sustainable improvements.

Verify that findings are classified consistently, root causes are established, actions are assigned, residual risks are accepted at the correct level, and closure is independently verified.

Conflicting observer findings; critical action has no funding; third-party weakness remains unresolved; business owner requests risk acceptance; repeat issue identified; Board Risk Committee reporting deadline approaches.

Lessons register; enterprise risk management; internal audit; technology and business owners; procurement and third-party management; CBS-1.11; CBS-1.12; CBS-1.13; senior management and Board oversight.

Sub-CBS Code

Name of Sub-CBS

Cyber and ICT Risk Linkage

Impact Tolerance Boundary Tested

Expected Resilience Outcome

Evidence to be Collected

Proactive Risk Management Action

Evidence of Proactive Risk Management

CBS-1.1

Payment Participant Management

Privileged-access compromise is the primary trigger; identity-service failure and audit-log unavailability amplify uncertainty.

No unauthorised participant should obtain effective payment access; legitimate critical participants should be restored before their inability to transact contributes to the two-hour service boundary.

Compromised access is disabled promptly; affected records are reconstructed and independently approved; participant activity resumes only after integrity checks.

Detection time; containment time; entitlement-change history; decision log; participant impact; suspicious transaction analysis; restoration and validation records.

Introduce stronger privileged-access segregation, emergency access procedures, independent entitlement reconciliation, and tested participant-access restoration.

Privileged-access review; access-recertification results; restoration test report; penetration-test findings; closed remediation actions; management approval.

CBS-1.2

Payment Instruction Submission

DDoS, telecommunications failure, network-route concentration, gateway saturation, and certificate failure affect submission capability.

Essential participants must retain or recover a usable submission channel within the two-hour limit; prolonged inability of a material proportion of participants should trigger contingency action.

Alternate channels accept priority instructions; messages remain complete and deduplicated; backlog is controlled and cleared within the approved operating window.

Channel availability; participant coverage; message volume; latency; queue growth; rejected and duplicate messages; failover time; cut-off performance.

Increase route and carrier diversity, expand alternate-channel capacity, rehearse participant fallback procedures, and tune DDoS controls against stress volumes.

Network architecture review; DDoS test report; alternate-channel capacity results; participant test records; provider assurance; remediation register.

CBS-1.3

Transaction Validation and Authentication

Certificate failure, key compromise, failed security update, authentication outage, and time-synchronisation error threaten transaction integrity.

Zero tolerance for knowingly processing instructions whose authenticity or integrity cannot be established; safe validation must be restored early enough to prevent the two-hour availability boundary being exceeded.

Processing is suspended safely when trust is uncertain; alternate validation is activated; keys and certificates are controlled; queued transactions are authenticated before release.

Authentication failure rates; security events; time to classify incident; key-management actions; queue age; false rejection and acceptance rates; resumption approval.

Strengthen cryptographic-key recovery, certificate monitoring, dual-control changes, redundant time services, and pre-approved emergency validation procedures.

Key-management audit; certificate-expiry monitoring; change-control tests; time-source resilience test; cyber simulation report; action closure evidence.

CBS-1.4

Liquidity and Funds Availability Management

Database corruption, replication lag, calculation error, unauthorised alteration, and failed data feed undermine balance reliability.

Zero tolerance for settlement based on materially unreliable liquidity positions; authoritative positions must be restored before gridlock or delayed settlement exceeds the service tolerance.

Corrupted records are isolated; balances are reconstructed from independent evidence; settlement resumes under approved controls; participant disputes are resolved or safely contained.

Reconciliation differences; reconstruction time; number of participants affected; queue values; collateral discrepancies; decision and approval records.

Implement independent liquidity reasonableness checks, stronger data-integrity monitoring, tested reconstruction procedures, and recovery exercises using peak transaction volumes.

Reconciliation reports; database failover tests; reconstruction exercise; integrity-control results; liquidity stress-test evidence; management minutes.

CBS-1.5

Payment Processing and Routing

Failed deployment, application defect, routing-rule corruption, middleware failure, capacity exhaustion, and ransomware affect a central concentration point.

Unsafe routing must be stopped immediately; correct routing and backlog recovery must occur without complete service loss exceeding two hours or causing material duplicate or misdirected settlement.

Defect is detected rapidly; rollback succeeds; affected instructions are identified; no erroneous settlement remains unresolved; processing resumes in controlled stages.

Detection and rollback time; affected transaction inventory; duplicate and misroute count; backlog size; processing latency; reconciliation results; recovery timeline.

Improve release segmentation, automated rollback, canary controls, routing-rule integrity monitoring, and regular high-volume failure simulations.

Change test records; rollback test; architecture review; capacity test; code and configuration assurance; remediation closure report.

CBS-1.6

Real-Time Gross Settlement (RTGS) Processing

Application, storage, database, replication, network, and cyber failures can interrupt high-value settlement and create finality uncertainty.

Essential RTGS capability should be restored within two hours; zero tolerance applies to undetected loss of finality or committed settlement data.

Minimum viable RTGS is restored; committed transactions are preserved; priority payments settle safely; participants receive reliable status; backlog clears within the operating window.

Actual recovery time; recovery-point variance; settlement volumes and values; unresolved transactions; participant coverage; ledger reconciliation; backlog-clearance time.

Remove common-mode infrastructure weaknesses, test peak-load failover, improve clean recovery capability, and establish prioritised contingency settlement procedures.

Full failover report; disaster recovery results; cyber recovery test; ledger reconciliation; architecture-risk assessment; Board or committee review.

CBS-1.7

Deferred Net Settlement Processing

Batch failure, corrupted files, secure-transfer disruption, scheduler error, and calculation defects affect net positions.

A scheduled cycle must not be completed using unreliable positions; recalculation and controlled settlement must avoid multiple missed cycles or material participant liquidity harm.

Incorrect positions are detected before posting; complete inputs are reconstructed; independent calculation agrees; participants are informed; contingency cycle completes safely.

Input completeness; control totals; calculation variances; time to reconstruct; affected value and volume; funding changes; cycle completion time.

Introduce independent net-position validation, enhanced input completeness controls, restartable processing, and periodic missed-cycle exercises.

Independent calculation records; control-total reports; batch-restart tests; secure-transfer tests; exercise report; remediation evidence.

CBS-1.8

Settlement Finalisation and Confirmation

Ledger replication failure, database inconsistency, notification outage, duplicate messaging, and transaction-status divergence threaten finality.

Zero tolerance for irreconcilable settlement status; authoritative status and reliable participant confirmation must be restored before uncertainty causes material duplicate activity or exceeds the service tolerance.

A single authoritative record is established; duplicate resubmissions are controlled; participants receive verified status; all material discrepancies are reconciled.

Number and value of uncertain transactions; confirmation latency; duplicate attempts; reconciliation differences; participant enquiries; time to authoritative-status declaration.

Strengthen atomic settlement controls, status-enquiry resilience, immutable journals, duplicate suppression, and routine ledger-reconstruction testing.

Ledger-integrity test; replication validation; status-enquiry exercise; audit-journal review; reconciliation results; action closure.

CBS-1.9

Exception and Failed Transaction Management

Case-platform outage, loss of logs, inaccessible communications, and automation failure impair exception management during peak demand.

Critical unresolved exceptions must not cause payment uncertainty, backlog rollover, or service degradation beyond the approved tolerance and operating window.

High-risk cases are identified despite system loss; alternate records maintain traceability; backlogs are prioritised and cleared; participant communications remain controlled.

Exception volume and age; resolution throughput; critical-case response time; staffing capacity; manual error rate; next-cycle readiness; participant updates.

Develop scalable exception triage, offline case templates, cross-trained surge staffing, priority criteria, and regular backlog stress tests.

Capacity-test results; cross-training records; alternate procedure test; backlog metrics; exercise observations; completed remediation.

CBS-1.10

Settlement Risk Monitoring and Control

Ransomware, telemetry manipulation, dashboard outage, alert suppression, logging failure, and time-source problems remove visibility.

Critical monitoring should not be unavailable beyond the approved short-duration threshold without effective alternate monitoring; processing must not continue blindly toward the two-hour boundary.

Independent indicators detect deterioration; manual thresholds are applied; management receives reliable information; processing is restricted or suspended before harm becomes unacceptable.

Monitoring outage duration; alert-detection time; data-quality differences; manual coverage; queue and latency indicators; escalation time; decisions made.

Establish independent monitoring paths, protected logging, tested manual dashboards, monitoring-health alerts, and blind-spot exercises.

Monitoring-resilience test; log-integrity review; alert testing; manual-dashboard exercise; detection metrics; remediation closure.

CBS-1.11

Payment System Oversight and Compliance Monitoring

Cyber manipulation, reporting corruption, audit-record loss, and unauthorised alteration of findings impair independent oversight.

Material participant or control breaches must remain identifiable and governable; oversight failure must not allow unsafe operations to continue long enough to threaten Impact Tolerance.

Independent records support decisions; temporary exceptions are governed; significant breaches are escalated; senior management receives an accurate control assessment.

Data reconstruction time; number of unverified breaches; temporary approvals; decision log; audit evidence; reporting timeliness; unresolved oversight issues.

Protect supervisory data separately from operational systems, strengthen data lineage, test alternate oversight reporting, and clarify emergency rule-exception authority.

Data-lineage review; reporting continuity test; access audit; supervisory exercise report; approved authority matrix; action closure.

CBS-1.12

Operational Incident and Service Disruption Management

Failure of incident tools and communications amplifies cyber or ICT events by delaying command, escalation, containment, and recovery decisions.

Critical incident leadership should be mobilised within the approved rapid-response threshold; delayed decisions must not cause essential service loss to exceed two hours.

A clear command structure is established; information gaps are managed; cyber and business priorities are reconciled; communications remain consistent; recovery actions are authorised promptly.

Detection, declaration, mobilisation and decision times; communication accuracy; action ownership; escalation records; stakeholder notifications; recovery forecast changes.

Improve out-of-band communications, integrated cyber-business command playbooks, delegated decision authority, call-tree testing, and regular executive exercises.

Crisis exercise report; call-tree results; decision logs; updated playbooks; management approval; completed action tracker.

CBS-1.13

Business Continuity and Service Recovery

Ransomware, backup compromise, common-mode infrastructure failure, telecommunications loss, and specialist unavailability disable routine recovery.

Minimum viable payment capability must be established before the two-hour complete-loss boundary; zero tolerance applies to restoring corrupted data into settlement processing.

Clean recovery is achieved; minimum viable service operates securely; participant connectivity is restored selectively; data is validated; full service is recovered in controlled stages.

Recovery time; backup validation; recovery-point results; alternate-site capacity; workforce mobilisation; participant connectivity; reconciliation; malware-clearance evidence.

Strengthen isolated and immutable recovery, clean-room restoration, alternate communications, specialist succession, minimum viable service design, and full end-to-end cyber recovery testing.

Cyber recovery report; backup-restoration evidence; alternate-site test; capacity results; succession records; third-party assurance; independent review.

CBS-1.14

Settlement Reporting and Regulatory Information Management

Data-warehouse outage, reporting-code defect, source-interface failure, corrupted archives, and unauthorised report changes affect management information.

Reliable information on settlement status, exposures, participant impact, and recovery must remain available quickly enough to support decisions within the service tolerance.

Alternate reporting uses authoritative sources; figures reconcile; management receives timely information; statutory and oversight records are preserved.

Source-to-report variances; report-production time; data completeness; audit-trail availability; management request response; number of unresolved differences.

Establish critical-report inventories, alternate reporting packs, source-to-report controls, protected archives, and regular reporting-continuity tests.

Reporting test results; reconciliations; archive-restoration report; access review; approved alternate pack; remediation closure.

CBS-1.15

Post-Settlement Review and Continuous Improvement and Decision Support

Fragmented test evidence, weak root-cause analysis, poor remediation governance, and incomplete technology-risk records allow recurring vulnerabilities.

Findings that could cause future Impact Tolerance breaches must be escalated, treated, accepted, or closed within approved risk-governance deadlines.

Lessons are evidence-based; actions address root causes; accountable owners and deadlines are assigned; high residual risks receive appropriate approval; closure is validated independently.

Finding quality; action ageing; repeat issues; risk acceptance; funding decisions; closure validation; committee and Board reporting.

Introduce centralised findings governance, severity-based action deadlines, independent closure validation, thematic analysis, and formal Board Risk Committee escalation for overdue critical actions.

Lessons register; remediation dashboard; risk-acceptance records; committee minutes; Internal Audit validation; Board reporting; closure evidence.