Operate · item 26
Recovery drill record
Recovery is a measurement, not a policy. This page holds the rehearsal calendar, the drills that were actually run, and the recovery time and recovery point measured on the day — including the ones that missed their target and the one that failed outright. A drill that was skipped says skipped. A control that has never been tested is never shown green.
Health
Whether recovery has been rehearsed
Drills executed, scheduled, overdue and failed, with the findings they left open.
Drill results are measured against a modeled estate on a rehearsal calendar of our own making. Recovery times here are real measurements of a simulation, not evidence that a customer's production estate recovers in the same time.
Drills on the calendar
16
11 carried out, 1 of them failed · 2 still scheduled
Last executed
Aug 1, 2026
DRL-004 · kill switch · 17 days ago
Recovery targets missed
4
3 on recovery time · 1 on recovery point
Not run as planned
4
2 overdue · 1 skipped · 1 failed
Self-observed
6 of 16
Run and judged by the same team, with no independent observer
Findings still open
20
across the 16 drills on the calendar
Last executed drill — Screening agent kill switch
DRL-004 · Kill switch · Function to the business · Human Resources · executed Aug 1, 2026
Executed
The candidate screening agent carries an open adverse-impact alarm. The drill stops it immediately and confirms that in-flight candidates are neither lost nor silently advanced.
Recovery time
3 min
target 5 min · met
Recovery point
under a minute
target under a minute · met
Units recovered
148
of 148 in scope
Observed by
Independent
Nadia Kovac
The agent stopped in three minutes against a five-minute target. All 148 in-flight candidates were held in a reviewable state and none were advanced. This is the cleanest result on the drill calendar.
Measured from the operator action to the last agent write, taken from the evidence chain.
Findings
Stop worked as designed and within target.closed
no owner assigned
There is no rehearsed path for restarting the agent afterward. Stopping is tested; starting again is not.medium · open
owner Priya Raman
run by Priya Raman · participants Human Resources · Talent Acquisition · Platform operations · evidence EVD-02403 · next due Sep 30, 2026
Drill calendar and record
16 drills · 10 produced a measurement
DRL-001 · Model gateway failover under loadExecuted
Failover · platform · Model gateway
Primary inference region is withdrawn during a business-hours peak. All fourteen functions are dependent. The drill measures how long the estate runs degraded and how much in-flight work is lost.
recovery time 22 min against 15 min
recovery point under a minute against under a minute
2,520 of 2,520 units recovered
observed by Grace Abbott
Recovered in 22 minutes against a 15-minute target. No work was lost because in-flight requests were queued rather than dropped. The miss was entirely in secondary capacity warm-up.
executed Jul 23, 2026 · run by Yusuf Adeyemi · every 90 days · next due Oct 21, 2026 · 2 open findings
DRL-002 · Evidence store restore from backupExecuted
Restore from backup · platform · Evidence store
The append-only evidence store is lost and must be rebuilt from backup. The drill measures recovery time and, more importantly, whether the hash chain still verifies from genesis after a restore.
recovery time 3.3 hrs against 4.0 hrs
recovery point 41 min against 15 min
8,011 of 8,054 units recovered
observed by Grace Abbott
Restored inside the time target and outside the recovery point target. Forty-three evidence records written in the final 41 minutes before the simulated loss were not in the backup and could not be reconstructed. The chain verified from genesis after the restore, which was the primary thing being tested.
executed Jun 25, 2026 · run by Yusuf Adeyemi · every 120 days · next due Oct 23, 2026 · 2 open findings
DRL-003 · Order-to-Cash line rollback rehearsalExecuted
Rollback · tower to function · Order-to-Cash Tower
An agent releases 400 orders against a stale credit position. The drill reverses them and measures how long a full reversal takes and how many require a human to unpick.
recovery time 87 min against 60 min
recovery point under a minute against under a minute
383 of 400 units recovered
no independent observer
Reversal completed in 87 minutes against a 60-minute target. Seventeen orders could not be reversed automatically because downstream fulfillment had already acted on them, and those required manual unpicking.
executed Jul 10, 2026 · run by Morgan Idris · every 90 days · next due Oct 8, 2026 · 3 open findings
DRL-004 · Screening agent kill switchExecuted
Kill switch · function to the business · Human Resources · Human Resources
The candidate screening agent carries an open adverse-impact alarm. The drill stops it immediately and confirms that in-flight candidates are neither lost nor silently advanced.
recovery time 3 min against 5 min
recovery point under a minute against under a minute
148 of 148 units recovered
observed by Nadia Kovac
The agent stopped in three minutes against a five-minute target. All 148 in-flight candidates were held in a reviewable state and none were advanced. This is the cleanest result on the drill calendar.
executed Aug 1, 2026 · run by Priya Raman · every 60 days · next due Sep 30, 2026 · 1 open finding
DRL-005 · Record-to-Report close continuityOverdue
Full recovery · tower to function · Record-to-Report Tower
The finance ledger connector is lost 36 hours before a close deadline. The drill recovers the close path and measures whether the committed close time is still achievable.
recovery time not measured against 8.0 hrs
recovery point not measured against 60 min
1,180 units in scope
no independent observer
Not executed. Deferred twice because the window collided with an actual close.
scheduled Aug 10, 2026 · run by Ana Duarte · every 180 days · next due Feb 6, 2027 · 1 open finding
DRL-006 · Identity provider outageScheduled
Failover · platform · Identity and access
The enterprise identity provider is unavailable. The drill establishes whether humans can still approve work and whether agents continue to hold valid authority.
recovery time not measured against 30 min
recovery point not measured against under a minute
2,520 units in scope
observed by Grace Abbott
Scheduled but not yet executed. Enterprise sign-on is built and not connected, so this drill would currently test the local fallback rather than the real dependency.
scheduled Aug 6, 2026 · run by Yusuf Adeyemi · every 180 days · next due Feb 2, 2027
DRL-007 · Source-to-Pay payment run reversalFailed
Rollback · tower to function · Source-to-Pay Tower
A payment run is released against a corrupted supplier master. The drill measures how much of the run can be recalled before settlement and what happens to the remainder.
recovery time 3.5 hrs against 45 min
recovery point under a minute against under a minute
291 of 620 units recovered
observed by Grace Abbott
The drill failed its objective. Only 291 of 620 payments were recalled inside the window. The remainder would have settled. The recall path depends on the payment gateway, which is one of the two systems with no connection, so the drill could only exercise the internal half of the process.
executed May 14, 2026 · run by Tobias Renn · every 180 days · next due Nov 10, 2026 · 3 open findings
DRL-008 · Customer Service major incident tabletopExecuted
Tabletop · function to the business · Customer Service · Customer Service
A product incident drives contact volume to six times plan while the externally facing credit clause is live. The exercise walks the response with the people who would run it.
recovery time not measured against 2.0 hrs
recovery point not measured against under a minute
0 units in scope
no independent observer
The group concluded that the holding response could be published inside 30 minutes and that the merged-queue switch is well understood. The group could not agree who authorizes raising status-response autonomy during an incident, and that gap remains open.
A tabletop produces judgments, not measurements. No recovery time was measured because nothing was actually moved. Recorded as unmeasured on purpose.
executed Apr 22, 2026 · run by Avery Chen · every 180 days · next due Oct 19, 2026 · 2 open findings
DRL-009 · Connector hub degraded readExecuted
Failover · platform · Connector hub
Three source systems degrade at once. The drill establishes whether the estate correctly fails closed rather than proceeding on stale reads.
recovery time 14 min against 20 min
recovery point under a minute against under a minute
704 of 704 units recovered
observed by Daniel Okoye
The estate failed closed in 14 minutes against a 20-minute target. No work proceeded on stale data. Two lines produced no user-facing explanation of why they had stopped.
executed Jun 16, 2026 · run by Yusuf Adeyemi · every 90 days · next due Sep 14, 2026 · 1 open finding
DRL-010 · Quarter close full rehearsalExecuted
Full recovery · tower to function · Record-to-Report Tower
The complete close path is run against a rehearsal period with the surge playbook active.
recovery time 3.6 days against 4.0 days
recovery point 22 min against 60 min
1,180 of 1,180 units recovered
observed by Grace Abbott
The close completed inside the committed window with the surge playbook active. This is the evidence behind the quarter-close capacity plan being marked as tested.
executed Jun 8, 2026 · run by Ana Duarte · every 180 days · next due Dec 5, 2026 · 1 open finding
DRL-011 · Agent platform kill switch, estate wideScheduled
Kill switch · platform · Agent orchestrator
Every agent on the estate is stopped simultaneously. The drill measures how long the stop takes to propagate and whether work is left in an inconsistent state.
recovery time not measured against 10 min
recovery point not measured against under a minute
2,520 units in scope
observed by Grace Abbott
Scheduled. The estate-wide stop has never been exercised, only per-agent stops.
scheduled Sep 21, 2026 · run by Yusuf Adeyemi · every 365 days · next due Sep 21, 2027
DRL-012 · Sales quote line rollbackSkipped
Rollback · function to the business · Sales · Sales
Quotes issued against an incorrect price book are withdrawn and reissued.
recovery time not measured against 1.5 hrs
recovery point not measured against under a minute
260 units in scope
no independent observer
Skipped. Recorded rather than removed from the calendar, so the gap stays visible.
scheduled Mar 22, 2026 · run by Morgan Idris · every 180 days · next due Sep 18, 2026 · 1 open finding
DRL-013 · Database point-in-time recoveryExecuted
Restore from backup · platform · Primary data store
The primary store is recovered to a point 30 minutes before a simulated corruption event.
recovery time 1.7 hrs against 2.0 hrs
recovery point 18 min against 30 min
2,520 of 2,520 units recovered
no independent observer
Recovered inside both targets. The drill was run against a restored copy rather than by failing the live store, so it proves the backup is good and does not prove the failover is.
executed May 28, 2026 · run by Yusuf Adeyemi · every 90 days · next due Aug 26, 2026 · 1 open finding
DRL-014 · Legal contract line kill switchExecuted
Kill switch · function to the business · Legal · Legal
The contract drafting agent is stopped mid-negotiation across active matters.
recovery time 4 min against 5 min
recovery point under a minute against under a minute
62 of 62 units recovered
observed by Grace Abbott
Stopped in four minutes. Drafts in progress were retained and marked incomplete rather than discarded.
executed Jul 4, 2026 · run by Rafael Ortiz · every 90 days · next due Oct 2, 2026
DRL-015 · Observability blackoutOverdue
Tabletop · platform · Observability
Monitoring and alerting are lost while the estate continues to run. The exercise asks how anyone would know something had gone wrong.
recovery time not measured against 60 min
recovery point not measured against under a minute
0 units in scope
no independent observer
Not executed.
scheduled Aug 9, 2026 · run by Yusuf Adeyemi · every 180 days · next due Feb 5, 2027 · 1 open finding
DRL-016 · Procurement approval chain failoverExecuted
Failover · function to the business · Procurement & Source-to-Pay · Procurement & Source-to-Pay
Named approvers above the high materiality band are simultaneously unavailable. The drill tests whether delegated authority actually resolves.
recovery time 26 min against 30 min
recovery point under a minute against under a minute
94 of 94 units recovered
observed by Grace Abbott
Delegation resolved in 26 minutes. The drill also exposed that two of the delegate grants had expired without anyone noticing, which was found because the drill was run and would not have been found otherwise.
executed Jul 19, 2026 · run by Tobias Renn · every 120 days · next due Nov 16, 2026 · 1 open finding
Can the work be reversed
475 live lines by reversibility
Fully reversible164 lines · 35%
Partly reversible118 lines · 25%
Needs a counterparty100 lines · 21%
Not reversible93 lines · 20%
93 lines carrying 401,471 units a week cannot be reversed once committed. For those, the only real control is the gate in front of them, and that is where the argument belongs.
Can the work be stopped
475 live lines by kill-switch design
Immediate stop92 lines · 19%
Drain then stop111 lines · 23%
Stop at next gate167 lines · 35%
No stop mechanism105 lines · 22%
105 lines have no stop mechanism at all. Across the whole estate, rollback has been rehearsed on 105 lines and the kill switch has been tested on 36. The rest are designed, documented and unproven.
Rehearsal coverage by function
475 lines · 196 with no manual fallback · 54 with no recovery owner
AI GBS & Global Business Services39 lines · rollback rehearsed on 7 · kill switch tested on 1
6 not reversible · 13 with no manual fallback
Administration37 lines · rollback rehearsed on 6 · kill switch tested on 1
8 not reversible · 13 with no manual fallback
Human Resources36 lines · rollback rehearsed on 11 · kill switch tested on 4
6 not reversible · 16 with no manual fallback
Finance33 lines · rollback rehearsed on 4 · kill switch tested on 1
4 not reversible · 21 with no manual fallback
Customer Service33 lines · rollback rehearsed on 5 · kill switch tested on 1
5 not reversible · 14 with no manual fallback
Engineering33 lines · rollback rehearsed on 8 · kill switch tested on 4
12 not reversible · 16 with no manual fallback
Information Technology33 lines · rollback rehearsed on 8 · kill switch tested on 3
6 not reversible · 9 with no manual fallback
Legal33 lines · rollback rehearsed on 8 · kill switch tested on 3
9 not reversible · 13 with no manual fallback
Procurement & Source-to-Pay33 lines · rollback rehearsed on 10 · kill switch tested on 3
5 not reversible · 15 with no manual fallback
Marketing33 lines · rollback rehearsed on 9 · kill switch tested on 3
6 not reversible · 11 with no manual fallback
Research & Development33 lines · rollback rehearsed on 6 · kill switch tested on 2
5 not reversible · 13 with no manual fallback
Revenue Operations33 lines · rollback rehearsed on 8 · kill switch tested on 5
8 not reversible · 13 with no manual fallback
Supply Chain33 lines · rollback rehearsed on 8 · kill switch tested on 2
6 not reversible · 18 with no manual fallback
Sales33 lines · rollback rehearsed on 7 · kill switch tested on 3
7 not reversible · 11 with no manual fallback
Left bar is rollback rehearsal coverage, right bar is kill-switch test coverage. Coverage is counted per line, not per function, because a function with one rehearsed line and thirty unrehearsed ones is not covered.
Lines that carry a recovery risk note
the 14 highest-volume of them
MK5B · Nurture Program7,979 units a week · Marketing
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Morgan Idris · not covered by any drill
RO1B · Account Hierarchy Rebuild7,975 units a week · Revenue Operations
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Sofia Lindqvist · covered by DRL-003
SC4C · Excess & Obsolete Review7,961 units a week · Supply Chain
Not reversible and no manual fallback. This line has neither a way back nor a way around.
Not reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Ravi Menon · not covered by any drill
PR8A · Requisition-to-PO7,758 units a week · Procurement & Source-to-Pay
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Marcus Weill · covered by DRL-016
EN5C · Performance Baseline7,697 units a week · Engineering
Not reversible and no manual fallback. This line has neither a way back nor a way around.
Not reversibleImmediate stoprollback never rehearsedno manual fallback
recovery owner Sofia Lindqvist · not covered by any drill
GB3A · Order to Invoice7,641 units a week · AI GBS & Global Business Services
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
no recovery owner · covered by DRL-003
IT8A · Pipeline Incident7,590 units a week · Information Technology
No stop mechanism other than disabling the connector this line reads from.
Needs a counterpartyNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Ravi Menon · not covered by any drill
GB3C · Collections Cycle7,557 units a week · AI GBS & Global Business Services
Not reversible and no manual fallback. This line has neither a way back nor a way around.
Not reversibleStop at next gaterollback never rehearsedno manual fallback
recovery owner Marcus Weill · covered by DRL-003
AD4A · Meeting to Outcome7,551 units a week · Administration
No stop mechanism other than disabling the connector this line reads from.
Needs a counterpartyNo stop mechanismrollback rehearsed 5 months agomanual fallback exists
recovery owner Sofia Lindqvist · not covered by any drill
SC8B · Supply Alert7,534 units a week · Supply Chain
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
recovery owner Ravi Menon · not covered by any drill
RD8A · Regulatory Submission7,459 units a week · Research & Development
No stop mechanism other than disabling the connector this line reads from.
Partly reversibleNo stop mechanismrollback never rehearsedmanual fallback exists
no recovery owner · not covered by any drill
RD8B · Standards Change Response7,276 units a week · Research & Development
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Yusuf Adeyemi · not covered by any drill
IT6A · Application Incident7,208 units a week · Information Technology
No stop mechanism other than disabling the connector this line reads from.
Fully reversibleNo stop mechanismrollback never rehearsedno manual fallback
recovery owner Morgan Idris · not covered by any drill
AD8A · Incident to Closure7,155 units a week · Administration
No stop mechanism other than disabling the connector this line reads from.
Needs a counterpartyNo stop mechanismrollback rehearsed 11 months agomanual fallback exists
recovery owner Ravi Menon · not covered by any drill
Actions
What is waiting on a person
A recovery plan is worth exactly as much as its last rehearsal. These are the rehearsals that are missing or went wrong.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can schedule and record a drill, including what was measured and what it found. It cannot execute a failover, declare a real recovery, or sign off a finding — a drill is an exercise, and treating its result as an assurance is exactly the error this page exists to prevent.
Live observability
What the record shows right now
Drill state across the estate.
Current distribution
16 drills
Executed1063%
Scheduled213%
Overdue213%
Failed or skipped213%
Is policy and strategy coming to fruition
Whether the written intent is holding here
10 of 16 drills have actually been run. 20 findings from them are still open.
Not holding on the record
The continuity policy states that every recovery path is rehearsed on a schedule. 62.5% have been, 2 are overdue, 1 were skipped and 1 failed outright. Recovery times shown on this page are the times measured during a rehearsal under controlled conditions; no figure here has been produced by a real outage.
What this page is, and what it is not
Drill results are measured against a modeled estate on a rehearsal calendar of our own making. Recovery times here are real measurements of a simulation, not evidence that a customer's production estate recovers in the same time.
Of the 16 drills on the calendar, 11 were executed and 10 produced a measurement. 3 overran their recovery time target and 1 lost more data than the recovery point target allows. 1 failed outright. Those results are kept on the record with the ones that passed, because a drill record that only holds successes is a marketing document.
6 of the 16 drills were run and judged by the same team. An independent observer is what separates a measurement from a claim, and its absence is marked on every drill where it is missing.
Across 475 live lines, rollback has been rehearsed on 105 and the kill switch tested on 36. 54 lines have nobody named as the recovery owner. Those are gaps, they are counted, and none of them are presented as controls.