One exercise, start to finish.
What it shows, and what it doesn't.
Carrowmore Payments is a fictional payment processor we use to test Clariveo. This page follows one scenario — an outage at the company that processes its card payments — from the recovery target to the board readout.
An illustration, not a product export. The organisation, its people and its figures are invented for this page. Once our next release has been reviewed, we will replace it with an export from the product itself.
The story
The target
Card acquiring must be back within 1 hour. After 2 hours, merchants miss settlement — that is the tolerance. Carrowmore set both itself.
What the supplier says
The card processor says it restores service in 2 hours. That is recorded as “the supplier states” — a claim, not proof.
The tabletop
The payments, operations and communications leads rehearse the outage in their roles. On the exercise clock they make the calls and tell merchants within the target. Nothing is restored: it is a rehearsal.
The gap
Switching to a second processor is the plan. The second route is contracted — but it was never integrated. In a real outage, it could not be used.
The fix, and who owns it
“Integrate the second processor route” goes to Cormac Daly. It counts as done only when Fiona Harte, the plan's named verifier, has checked it.
The figure changes
The processor corrects its restore time to 2 days. Against a 1-hour target, that is now flagged as a conflict, and the plan is marked for review.
The board readout
What the board sees — in three plain parts.
What we tested
A tabletop exercise: an outage at our card processor, with the payments, operations and communications leads in their roles.
What worked
Decisions and merchant messages were made within the 1-hour target on the exercise clock. Card acquiring: simulated recovery target met.
What still needs proving
That card acquiring actually comes back within 1 hour. That takes a timed failover test to the second processor route — which first has to be integrated. Until then, it is not demonstrated.
And beneath it
- Stage: Exercised. 0 of 4 critical services demonstrated by a restoration test or a real incident.
- Open action: integrate the second processor route — owner Cormac Daly, to be verified by Fiona Harte.
- Supplier conflict: the processor states 2 days to restore; card acquiring needs 1 hour.
- What would change the readout: a failover test to the second route, timed, within 1 hour, checked by someone other than the person who ran it.
A tabletop is worth running: it finds gaps like the second route before a real outage does. It does not prove recovery, and this readout doesn't claim it.
Bring a real scenario.
Or start with a fictional or redacted one, and bring the real one when you are ready.