# Business continuity and recovery test: working record

Original T-NEX working aid. Version: 11 September 2026. Edit locally; no information is transmitted to T-NEX.

Self-developed working example to adapt to the process. Not a complete DORA test programme or evidence of a previously completed T-NEX client test. Perform potentially disruptive steps only within internally approved test boundaries.

## 1. Test scope

- Test ID / date / version: [complete]
- Function and business process: [complete]
- Test type: [tabletop / simulation / technical test / combination]
- BIA/continuity-plan reference and version: [complete]
- Business scope / explicit exclusions: [complete]
- Environment and permitted data: [complete]
- Providers and interfaces: [complete]
- Lead / technical operator / business acceptance / observer: [complete]
- Start approval / abort authority / fallback: [complete]

## 2. Criteria before starting

| Criterion | Target and rationale | Measurement | Actual result | Evidence | Assessment |
| --- | --- | --- | --- | --- | --- |
| Alerting and availability | [ ] | [ ] | [ ] | [ ] | not tested |
| Decision on continuity mode | [ ] | [ ] | [ ] | [ ] | not tested |
| Recovery time | [ ] | [ ] | [ ] | [ ] | not tested |
| Tolerable data loss | [ ] | [ ] | [ ] | [ ] | not tested |
| Business task completed successfully | [ ] | [ ] | [ ] | [ ] | not tested |
| Reconciliation and backlog | [ ] | [ ] | [ ] | [ ] | not tested |
| Communication and return to normal service | [ ] | [ ] | [ ] | [ ] | not tested |

## 3. Test sequence

1. **Define the question and boundary.** Example: following an outage of its reporting application, a business team can produce and approve a priority report again. Record the affected function, permitted test environment and authority to abort before starting.

2. **Record dependencies and targets.** Include data, sign-in, interfaces, workstations, staff and involved providers. Derive maximum tolerable disruption, recovery target and tolerable data loss from the actual process; the template does not prescribe generic hourly targets.

3. **Prepare the sequence and evidence.** Assign distinct tasks to the test lead, business acceptance owner, technical operator and observer. Agree data, fallback, communication and time measurement beforehand. An exercise notification must not be mistaken for an actual incident.

4. **Trigger the scenario in a controlled way.** Record the trigger and timestamp. Check alerting, activation of continuity arrangements, restoration and backlog handling. A discussion workshop alone does not demonstrate technical recovery; identify the two test types separately.

5. **Verify business recovery.** Starting the application is insufficient. Complete a defined business transaction, reconcile its data and have the accountable role assess the result. Compare measured times and lost or reconstructed data against the agreed criteria.

6. **Close deviations and retest.** Assign each deviation an owner, deadline, interim measure and retest evidence. Distinguish passed, partially passed, failed and not tested. The responsible management role decides on residual risks and follow-up actions.

## 4. Timeline and event log

| Time | Event / action | Role | Result / evidence |
| --- | --- | --- | --- |
| [ ] | [ ] | [ ] | [ ] |
| [ ] | [ ] | [ ] | [ ] |
| [ ] | [ ] | [ ] | [ ] |

## 5. Deviations and retesting

| ID | Deviation / impact | Interim measure | Owner | Deadline | Retest / result |
| --- | --- | --- | --- | --- | --- |
| [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |

## 6. Final decision

- Result: [passed / partially passed / failed / not tested]
- Dependencies not covered and limitations: [complete]
- Business acceptance / date: [complete]
- Residual risks and accountable decision: [complete]
- Follow-up test / date / owner: [complete]
- Updated plans and communication needs: [complete]


## Sources and context

- [BaFin: MaRisk, Rundschreiben 06/2026 (BA), 30.06.2026, amtlicher Volltext bei der Bundesbank](https://www.bundesbank.de/resource/blob/825336/866a68577eb35afee82fbe60c39a4f87/472B63F073F071307366337C94F8C870/2026-06-30-rundschreiben-data.pdf)
- [Verordnung (EU) 2022/2554: DORA, insbesondere Artikel 11, 24 und 28–30](https://eur-lex.europa.eu/eli/reg/2022/2554/oj)