TLPT reporting to authorities

Reporting to authorities is the stage at which a TLPT exercise becomes accountable. The firm shares the report, including the scope, the scenarios, the findings and the remediation plan, through the arrangements set out in the applicable framework. That sharing allows the authority to judge whether the exercise covered the right functions, whether the scenarios reflected real threats, and whether remediation is credible. It also allows lessons that affect the wider sector, such as a supplier weakness, to be handled in a coordinated way.

Reporting is not a single document sent at the end and then forgotten. It includes engagement before and during the exercise, the formal report afterwards, and follow up on remediation progress. A firm that reports promptly, honestly and completely will find follow up constructive. A firm that reports late, selectively or with gaps will find follow up searching, because the authority will need to establish what was omitted and why. The discipline of reporting therefore begins long before the report is written.

The report should contain the scope and service maps, the threat intelligence picture, the scenarios and their outcomes, the findings with timelines and evidence, and the remediation plan with owners and verification arrangements. It should also record exclusions and limitations, so that the authority can judge coverage. A report that omits exclusions, or that presents findings without timelines, will be difficult for the authority to assess, however well the testing itself was carried out.

The report should be written for a reader who was not present during testing. Attack paths should be explained in sequence, detection and response should be described at each stage, and findings should be linked to root causes and to critical functions. Technical detail should be sufficient to verify the finding, but the narrative should remain understandable to a supervisor who needs to judge resilience rather than to reproduce the attack. Clarity in reporting is a form of accountability: a report that cannot be understood cannot be challenged.

Timing and route follow the framework arrangements. Firms should confirm the expected timing early in preparation, so that reporting is not delayed by uncertainty about format or recipient. The report should be shared through the agreed channel, with access limited to the agreed audience, given the sensitivity of its contents. Where the framework provides for reporting to more than one authority, the firm should ensure that each recipient receives the same report, so that follow up is consistent.

An illustrative timetable helps planning. Preparation and testing may take a considerable period, reporting follows promptly after testing, and remediation updates follow at agreed intervals. The firm should not wait until all remediation is complete before reporting, because the authority needs to see the findings and the plan while remediation is still under way. Conversely, the firm should not report a draft that is so incomplete that the authority cannot judge the exercise. The balance is a complete report, shared promptly, with remediation progress reported thereafter.

TLPT reports contain sensitive detail: attack paths, system weaknesses, detection gaps and supplier information. Handling arrangements should limit access, control onward sharing, and set retention and destruction expectations. Staff who handle the report should understand those arrangements, and the report should be marked accordingly. A report that circulates widely inside a firm, beyond those who need it for remediation or oversight, increases risk without improving resilience.

Follow-up focuses on remediation. The authority may ask for progress updates, challenge timelines, ask for evidence that fixes work, or discuss findings that remain open. It may also compare the firm's results with those of comparable firms, to judge whether a weakness is firm specific or sector wide. Follow-up is not a sign that the exercise failed. It is the mechanism by which the regime ensures that findings lead to change, rather than to reports that sit unread.

Firms should prepare for follow-up by maintaining a live remediation tracker, with evidence for closed actions and explanations for delays. When the authority asks about a finding, the firm should be able to show the action, the owner, the progress and the verification, without having to reconstruct the position. That readiness demonstrates that remediation is managed as part of the resilience programme, not assembled for a supervisory meeting.

Good reporting teaches the firm to write for an external reader, which improves internal clarity as well. A firm that can explain its scope, its scenarios, its findings and its remediation plan to an authority can also explain them to its board, its auditors and its own teams. That clarity often reveals gaps in the firm's own understanding: a finding that is hard to explain may not be fully understood, and a remediation plan that is hard to summarise may not be fully thought through.