TLPT frequency and cycles

TLPT is organised in cycles, with each exercise followed by remediation, reflection and preparation for the next. The timing of cycles is set through the applicable framework, taking account of the firm's risk, its critical functions and supervisory expectations, rather than being left to the firm's convenience. Describing cycles qualitatively matters: a firm should be able to explain why its next exercise is timed as it is, what it will cover, and how it builds on the previous one, without reducing the regime to a simple calendar count.

Between exercises, the work does not stop. Remediation from the previous cycle must be completed and verified, threat intelligence must be refreshed, service maps must be kept current, and supplier arrangements must be maintained. A firm that treats TLPT as an event, with long quiet periods in between, will find that its next exercise tests outdated maps, stale intelligence and unremediated weaknesses. A firm that treats it as a cycle will arrive at the next exercise with a clearer picture and a stronger starting point.

Cycle timing is determined through the framework and through engagement with the testing authority, informed by the firm's profile and by supervisory priorities. A firm with highly critical functions, complex supplier dependencies or a history of significant findings may be expected to test more often, or to cover a wider scope, than a firm with a simpler profile. The framework allows that proportionality, so that testing effort follows risk rather than a uniform timetable that ignores differences between firms.

The period between exercises is when most of the value is created. Remediation plans are implemented, controls are changed, monitoring is improved, and incident playbooks are revised. Each change should be verified, so that the next exercise does not simply rediscover the same weaknesses. The firm should also use the interval to maintain its service maps, because critical functions change: new products launch, suppliers change, systems are replaced, and dependencies shift. A map that was accurate at the last exercise may be misleading at the next.

Threat intelligence should also be refreshed between cycles. Attacker methods evolve, new groups emerge, and sector incidents provide fresh lessons. A firm that reuses the previous cycle's intelligence picture without review risks testing against yesterday's threats. Regular intelligence updates, even when they do not trigger a full exercise, keep the firm's detection and response teams alert to current methods and allow the next TLPT scenarios to be grounded in current evidence.

A firm with several critical functions cannot test all of them in depth in a single exercise, and it does not need to. Cycles allow functions to be sequenced, so that each cycle covers a meaningful set of functions in depth, while other functions are covered through other testing and through remediation follow up. Sequencing should be risk based: functions whose failure would cause the greatest harm, or where previous findings were most significant, should be prioritised, while functions with stronger assurance can be scheduled later.

Each cycle should end with a reflection that informs the next. Did the scope cover the right functions? Did the scenarios reflect the intelligence? Did detection improve compared with the previous cycle? Did remediation from the previous cycle hold up under test? Those questions turn TLPT from a series of isolated exercises into a programme that improves over time. The reflection should be recorded, shared with the teams involved, and used when planning the next scope and scenarios.

An illustrative lending firm shows the pattern. In one cycle, testers reach a loan processing system because monitoring of a supplier connection is weak. Remediation improves that monitoring. In the next cycle, testers attempt a different path, through staff credentials, and the firm detects them earlier. The improvement is visible because the cycles are comparable: similar functions, similar reporting, and a clear record of what changed in between. Without that record, the firm could not tell whether it had improved or merely faced an easier test.

Repeated exercises can produce fatigue, particularly among detection and response teams who may feel that they are being tested without seeing change. Fatigue is reduced when remediation is visible, when findings lead to real improvements, and when teams receive feedback on what they did well as well as what failed. A TLPT report that only lists failures, without acknowledging effective detection or response, demoralises the teams whose cooperation the next cycle will need.