Recovery Evidence and Lessons

Recovery evidence is the record that shows what was affected, what was restored, what was checked, what was decided, and what was learned. Lessons are the changes that record leads to. Both matter because recovery is judged afterwards, by customers, by senior leaders, and by supervisors, on the basis of what can be shown, not on the basis of what people remember feeling confident about at the time. A firm that recovered well but cannot show how will struggle to prove it. A firm that recovered badly but learns honestly from the record may still improve its next recovery.

Evidence should be produced in the ordinary course of recovery, not assembled afterwards for review. Decisions noted at the time, restore actions logged as they happen, and checks recorded with their results are far more reliable than reconstructions written days later. That discipline also helps during the incident itself, because a clear record lets a new shift, a deputy decision maker, or a provider pick up the work without re-asking every question. Evidence, in this sense, is an operational tool, not merely an audit artefact.

During recovery, the record should capture the facts that later review will need. What happened, as far as it is known, and how that understanding changed over time. Which parts of the service were affected and which were checked and cleared. Which copies were chosen for restoration, what checks were run, and what was found. Which decisions were made, by whom, on what evidence, and with what limits. And what was communicated, to whom, and when. Each element answers a question that will otherwise be asked later, from memory, under pressure.

Preserving evidence is difficult precisely when it matters most, because the incident may have affected the very systems that hold logs and records. A firm should therefore think, before an incident, about where recovery evidence will live if live systems are unavailable, how it will be captured when normal tooling is down, and how it will be protected from alteration during recovery itself. Simple arrangements, such as a separate log kept outside the affected estate, can matter more than sophisticated tooling that depends on the estate being healthy.

Lessons become changes through a process with owners and dates. After recovery, or after a rehearsal, the firm should review what happened, identify what should change, and assign each change to a named owner with a date for completion. Changes may involve the recovery plan, the backup arrangements, the sequencing, the communication approach, or the training of decision makers. What matters is not the category of the change but that it is specific enough to be completed and checked. A lesson stated as a general aspiration, such as improving coordination, is unlikely to change anything on its own.

Lessons should be tracked until they are completed and verified, not merely until they are assigned. A firm should be able to show, for each lesson, whether the change was made, whether it was tested where testing is relevant, and whether it has held in later rehearsals or incidents. Tracking of this kind prevents the familiar pattern where lessons are agreed enthusiastically after an incident and then quietly fade as normal work resumes. Enthusiasm after an incident is not a delivery mechanism. Ownership, dates, and follow-up are.

Honest learning depends on a culture where people can report problems without fear that candour will be punished. If staff believe that admitting a recovery error will lead to blame, they will present recovery in the best possible light, and the firm will learn from a polished story rather than from what happened. Leaders set that culture by how they respond to bad news during and after recovery. A leader who thanks people for surfacing a problem, and who focuses review on systems and decisions rather than on individuals, makes future candour more likely.

Honest learning also means reviewing successes with the same candour as failures. A recovery that succeeded despite thin evidence, a lucky restore, or a decision that happened to work should not be recorded as proof that the approach was sound. Reviewing success critically is harder, because there is less urgency to change what worked, but it is how a firm avoids turning luck into policy. Under DORA, which applies from 17 January 2025, the EU frame is labelled separately from the UK regime under FCA PS21/3 and PRA PS6/21, with their own dates. In either frame, the value of evidence and lessons lies not in the report, but in the changed plan that follows it.