Operate · item 26
Recovery drill record
Recovery is a measurement, not a policy. more
Health
Whether recovery has been rehearsed
Drills executed, scheduled, overdue and failed, with the findings they left open.
Drill results are measured against a modeled estate on a rehearsal calendar of our own making. more
Last executed drill — Screening agent kill switch
DRL-004 · Kill switch · Function to the business · Human Resources · executed Aug 1, 2026
Executed
The candidate screening agent carries an open adverse-impact alarm. more
Recovery time
3 min
target 5 min · met
Recovery point
under a minute
target under a minute · met
The agent stopped in three minutes against a five-minute target. more
Measured from the operator action to the last agent write, taken from the evidence chain.
Findings
Stop worked as designed and within target.closed
no owner assigned
There is no rehearsed path for restarting the agent afterward. moremedium · open
owner Priya Raman
run by Priya Raman · participants Human Resources · Talent Acquisition · Platform operations · evidence EVD-02403 · next due Sep 30, 2026
Drill calendar and record
16 drills · 10 produced a measurement
DRL-001 · Model gateway failover under loadExecuted
Failover · platform · Model gateway
Primary inference region is withdrawn during a business-hours peak. more
recovery time 22 min against 15 min
recovery point under a minute against under a minute
2,520 of 2,520 units recovered
observed by Grace Abbott
Recovered in 22 minutes against a 15-minute target. more
executed Jul 23, 2026 · run by Yusuf Adeyemi · every 90 days · next due Oct 21, 2026 · 2 open findings
DRL-002 · Evidence store restore from backupExecuted
Restore from backup · platform · Evidence store
The append-only evidence store is lost and must be rebuilt from backup. more
recovery time 3.3 hrs against 4.0 hrs
recovery point 41 min against 15 min
8,011 of 8,054 units recovered
observed by Grace Abbott
Restored inside the time target and outside the recovery point target. more
executed Jun 25, 2026 · run by Yusuf Adeyemi · every 120 days · next due Oct 23, 2026 · 2 open findings
DRL-003 · Order-to-Cash line rollback rehearsalExecuted
Rollback · tower to function · Order-to-Cash Tower
An agent releases 400 orders against a stale credit position. more
recovery time 87 min against 60 min
recovery point under a minute against under a minute
383 of 400 units recovered
no independent observer
Reversal completed in 87 minutes against a 60-minute target. more
executed Jul 10, 2026 · run by Morgan Idris · every 90 days · next due Oct 8, 2026 · 3 open findings
DRL-004 · Screening agent kill switchExecuted
Kill switch · function to the business · Human Resources · Human Resources
The candidate screening agent carries an open adverse-impact alarm. more
recovery time 3 min against 5 min
recovery point under a minute against under a minute
148 of 148 units recovered
observed by Nadia Kovac
The agent stopped in three minutes against a five-minute target. more
executed Aug 1, 2026 · run by Priya Raman · every 60 days · next due Sep 30, 2026 · 1 open finding
DRL-005 · Record-to-Report close continuityOverdue
Full recovery · tower to function · Record-to-Report Tower
The finance ledger connector is lost 36 hours before a close deadline. more
recovery time not measured against 8.0 hrs
recovery point not measured against 60 min
1,180 units in scope
no independent observer
Not executed. Deferred twice because the window collided with an actual close.
scheduled Aug 10, 2026 · run by Ana Duarte · every 180 days · next due Feb 6, 2027 · 1 open finding
DRL-006 · Identity provider outageScheduled
Failover · platform · Identity and access
The enterprise identity provider is unavailable. more
recovery time not measured against 30 min
recovery point not measured against under a minute
2,520 units in scope
observed by Grace Abbott
Scheduled but not yet executed. more
scheduled Aug 6, 2026 · run by Yusuf Adeyemi · every 180 days · next due Feb 2, 2027
DRL-007 · Source-to-Pay payment run reversalFailed
Rollback · tower to function · Source-to-Pay Tower
A payment run is released against a corrupted supplier master. more
recovery time 3.5 hrs against 45 min
recovery point under a minute against under a minute
291 of 620 units recovered
observed by Grace Abbott
The drill failed its objective. more
executed May 14, 2026 · run by Tobias Renn · every 180 days · next due Nov 10, 2026 · 3 open findings
DRL-008 · Customer Service major incident tabletopExecuted
Tabletop · function to the business · Customer Service · Customer Service
A product incident drives contact volume to six times plan while the externally facing credit clause is live. more
recovery time not measured against 2.0 hrs
recovery point not measured against under a minute
0 units in scope
no independent observer
The group concluded that the holding response could be published inside 30 minutes and that the merged-queue switch is well understood. more
A tabletop produces judgments, not measurements. more
executed Apr 22, 2026 · run by Avery Chen · every 180 days · next due Oct 19, 2026 · 2 open findings
DRL-009 · Connector hub degraded readExecuted
Failover · platform · Connector hub
Three source systems degrade at once. more
recovery time 14 min against 20 min
recovery point under a minute against under a minute
704 of 704 units recovered
observed by Daniel Okoye
The estate failed closed in 14 minutes against a 20-minute target. more
executed Jun 16, 2026 · run by Yusuf Adeyemi · every 90 days · next due Sep 14, 2026 · 1 open finding
DRL-010 · Quarter close full rehearsalExecuted
Full recovery · tower to function · Record-to-Report Tower
The complete close path is run against a rehearsal period with the surge playbook active.
recovery time 3.6 days against 4.0 days
recovery point 22 min against 60 min
1,180 of 1,180 units recovered
observed by Grace Abbott
The close completed inside the committed window with the surge playbook active. more
executed Jun 8, 2026 · run by Ana Duarte · every 180 days · next due Dec 5, 2026 · 1 open finding
DRL-011 · Agent platform kill switch, estate wideScheduled
Kill switch · platform · Agent orchestrator
Every agent on the estate is stopped simultaneously. more
recovery time not measured against 10 min
recovery point not measured against under a minute
2,520 units in scope
observed by Grace Abbott
Scheduled. The estate-wide stop has never been exercised, only per-agent stops.
scheduled Sep 21, 2026 · run by Yusuf Adeyemi · every 365 days · next due Sep 21, 2027
DRL-012 · Sales quote line rollbackSkipped
Rollback · function to the business · Sales · Sales
Quotes issued against an incorrect price book are withdrawn and reissued.
recovery time not measured against 1.5 hrs
recovery point not measured against under a minute
260 units in scope
no independent observer
Skipped. Recorded rather than removed from the calendar, so the gap stays visible.
scheduled Mar 22, 2026 · run by Morgan Idris · every 180 days · next due Sep 18, 2026 · 1 open finding
DRL-013 · Database point-in-time recoveryExecuted
Restore from backup · platform · Primary data store
The primary store is recovered to a point 30 minutes before a simulated corruption event.
recovery time 1.7 hrs against 2.0 hrs
recovery point 18 min against 30 min
2,520 of 2,520 units recovered
no independent observer
Recovered inside both targets. more
executed May 28, 2026 · run by Yusuf Adeyemi · every 90 days · next due Aug 26, 2026 · 1 open finding
DRL-014 · Legal contract line kill switchExecuted
Kill switch · function to the business · Legal · Legal
The contract drafting agent is stopped mid-negotiation across active matters.
recovery time 4 min against 5 min
recovery point under a minute against under a minute
62 of 62 units recovered
observed by Grace Abbott
Stopped in four minutes. more
executed Jul 4, 2026 · run by Rafael Ortiz · every 90 days · next due Oct 2, 2026
DRL-015 · Observability blackoutOverdue
Tabletop · platform · Observability
Monitoring and alerting are lost while the estate continues to run. more
recovery time not measured against 60 min
recovery point not measured against under a minute
0 units in scope
no independent observer
Not executed.
scheduled Aug 9, 2026 · run by Yusuf Adeyemi · every 180 days · next due Feb 5, 2027 · 1 open finding
DRL-016 · Procurement approval chain failoverExecuted
Failover · function to the business · Procurement & Source-to-Pay · Procurement & Source-to-Pay
Named approvers above the high materiality band are simultaneously unavailable. more
recovery time 26 min against 30 min
recovery point under a minute against under a minute
94 of 94 units recovered
observed by Grace Abbott
Delegation resolved in 26 minutes. more
executed Jul 19, 2026 · run by Tobias Renn · every 120 days · next due Nov 16, 2026 · 1 open finding
Can the work be reversed
475 live lines by reversibility
Fully reversible164 lines · 35%
Partly reversible118 lines · 25%
Needs a counterparty100 lines · 21%
Not reversible93 lines · 20%
93 lines carrying 401,471 units a week cannot be reversed once committed. For those, the only real control is the gate in front of them, and that is where the argument belongs.
Can the work be stopped
475 live lines by kill-switch design
Immediate stop92 lines · 19%
Drain then stop111 lines · 23%
Stop at next gate167 lines · 35%
No stop mechanism105 lines · 22%
105 lines have no stop mechanism at all. Across the whole estate, rollback has been rehearsed on 105 lines and the kill switch has been tested on 36. The rest are designed, documented and unproven.
Rehearsal coverage by function
475 lines · 196 with no manual fallback · 54 with no recovery owner
AI GBS & Global Business Services39 lines · rollback rehearsed on 7 · kill switch tested on 1
6 not reversible · 13 with no manual fallback
Administration37 lines · rollback rehearsed on 6 · kill switch tested on 1
8 not reversible · 13 with no manual fallback
Human Resources36 lines · rollback rehearsed on 11 · kill switch tested on 4
6 not reversible · 16 with no manual fallback
Finance33 lines · rollback rehearsed on 4 · kill switch tested on 1
4 not reversible · 21 with no manual fallback
Customer Service33 lines · rollback rehearsed on 5 · kill switch tested on 1
5 not reversible · 14 with no manual fallback
Engineering33 lines · rollback rehearsed on 8 · kill switch tested on 4
12 not reversible · 16 with no manual fallback
Information Technology33 lines · rollback rehearsed on 8 · kill switch tested on 3
6 not reversible · 9 with no manual fallback
Legal33 lines · rollback rehearsed on 8 · kill switch tested on 3
9 not reversible · 13 with no manual fallback
Procurement & Source-to-Pay33 lines · rollback rehearsed on 10 · kill switch tested on 3
5 not reversible · 15 with no manual fallback
Marketing33 lines · rollback rehearsed on 9 · kill switch tested on 3
6 not reversible · 11 with no manual fallback
Research & Development33 lines · rollback rehearsed on 6 · kill switch tested on 2
5 not reversible · 13 with no manual fallback
Revenue Growth Management33 lines · rollback rehearsed on 8 · kill switch tested on 5
8 not reversible · 13 with no manual fallback
Supply Chain33 lines · rollback rehearsed on 8 · kill switch tested on 2
6 not reversible · 18 with no manual fallback
Sales33 lines · rollback rehearsed on 7 · kill switch tested on 3
7 not reversible · 11 with no manual fallback
Left bar is rollback rehearsal coverage, right bar is kill-switch test coverage. more
Lines that carry a recovery risk note
the 14 highest-volume of them
MK5B · Nurture Program7,979 units a week · Marketing
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Morgan Idris · not covered by any drill
RO1B · Account Hierarchy Rebuild7,975 units a week · Revenue Growth Management
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Sofia Lindqvist · covered by DRL-003
SC4C · Excess & Obsolete Review7,961 units a week · Supply Chain
Not reversible and no manual fallback. more
Not reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Ravi Menon · not covered by any drill
PR8A · Requisition-to-PO7,758 units a week · Procurement & Source-to-Pay
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Marcus Weill · covered by DRL-016
EN5C · Performance Baseline7,697 units a week · Engineering
Not reversible and no manual fallback. more
Not reversibleImmediate stoprollback never rehearsedno manual fallback
recovery owner Sofia Lindqvist · not covered by any drill
GB3A · Order to Invoice7,641 units a week · AI GBS & Global Business Services
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
no recovery owner · covered by DRL-003
IT8A · Pipeline Incident7,590 units a week · Information Technology
No stop mechanism other than disabling the connector this line reads from.
Needs a counterpartyNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Ravi Menon · not covered by any drill
GB3C · Collections Cycle7,557 units a week · AI GBS & Global Business Services
Not reversible and no manual fallback. more
Not reversibleStop at next gaterollback never rehearsedno manual fallback
recovery owner Marcus Weill · covered by DRL-003
AD4A · Meeting to Outcome7,551 units a week · Administration
No stop mechanism other than disabling the connector this line reads from.
Needs a counterpartyNo stop mechanismrollback rehearsed 5 months agomanual fallback exists
recovery owner Sofia Lindqvist · not covered by any drill
SC8B · Supply Alert7,534 units a week · Supply Chain
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Ravi Menon · not covered by any drill
RD8A · Regulatory Submission7,459 units a week · Research & Development
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
no recovery owner · not covered by any drill
RD8B · Standards Change Response7,276 units a week · Research & Development
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Yusuf Adeyemi · not covered by any drill
IT6A · Application Incident7,208 units a week · Information Technology
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Morgan Idris · not covered by any drill
AD8A · Incident to Closure7,155 units a week · Administration
No stop mechanism other than disabling the connector this line reads from.
Needs a counterpartyNo stop mechanismrollback rehearsed 11 months agomanual fallback exists
recovery owner Ravi Menon · not covered by any drill
Actions
What is waiting on a person
A recovery plan is worth exactly as much as its last rehearsal. more
Operations
What this desk is allowed to start
A surface that only reports is not operable. more
Trigger and bound
This desk can schedule and record a drill, including what was measured and what it found. more
Live observability
What the record shows right now
Drill state across the estate.
Current distribution
16 drills
Executed1063%
Scheduled213%
Overdue213%
Failed or skipped213%
Is policy and strategy coming to fruition
Whether the written intent is holding here
10 of 16 drills have actually been run. 20 findings from them are still open.
Not holding on the record
The continuity policy states that every recovery path is rehearsed on a schedule. 62.5% have been, 2 are overdue, 1 were skipped and 1 failed outright. more
What this page is, and what it is not
Drill results are measured against a modeled estate on a rehearsal calendar of our own making. more
Of the 16 drills on the calendar, 11 were executed and 10 produced a measurement. 3 overran their recovery time target and 1 lost more data than the recovery point target allows. 1 failed outright. Those results are kept on the record with the ones that passed, because a drill record that only holds successes is a marketing document.
6 of the 16 drills were run and judged by the same team. An independent observer is what separates a measurement from a claim, and its absence is marked on every drill where it is missing.
Across 475 live lines, rollback has been rehearsed on 105 and the kill switch tested on 36. 54 lines have nobody named as the recovery owner. Those are gaps, they are counted, and none of them are presented as controls.