Exercise & Assurance Programme
Most exercises boards rely on for assurance are theatre.
Contested Assurance is a wargaming-derived exercise and assurance programme for critical infrastructure entities, built on UK Ministry of Defence doctrine, adjudicated rather than scripted, and rated ASSURANCE, PARTIAL or THEATRE so a board knows exactly what its exercise programme is actually worth.
Most crisis, business continuity and cyber exercises run against Australia's SOCI Act, state emergency management legislation and ISO 22301 obligations are scripted, low-consequence, and built to protect reputation rather than to test anything. Contested Assurance is the answer: an exercise and assurance programme built on formal wargaming doctrine, adjudicated in the room, and rated so a board knows exactly what its exercise programme is actually worth.
Know where you actually stand
Every engagement starts with a disclosed rating: ASSURANCE, PARTIAL or THEATRE, applied to your existing programme with the reasoning shown, not softened for comfort.
Exercises that can fail
Adjudicated outcomes, a veto-card mechanism, in-game decision capture and a standing obligation to report bias mean the result is not known before the room sits down.
Findings that close the loop
Every exercise feeds directly back into your CIRMP, IRP or BCMS review cycle, so the exercise satisfies the obligation and produces a real finding at the same time.
Scripted TTX vs Contested Assurance
| Dimension | Scripted TTX (market standard) | Contested Assurance |
|---|---|---|
| Design authority | Facilitator or legal team sets scope and scenario | Risk, technical and senior operational authority co-design; legal informs, does not narrow |
| Outcome | Pre-agreed; known before the room sits down | Adjudicated in the room; not known in advance to any party |
| Injects | Scripted, timed, rehearsed | Contested; participants argue, a facilitator adjudicates under a declared adjudication mode |
| Bias handling | Not addressed | Standing red-team obligation to report observed bias in the final record |
| Review | A hot wash-up on the day | A formal after-action review to a declared rigour standard, never optional |
| Evidence produced | "Exercise conducted" attendance record | A rated finding: ASSURANCE, PARTIAL or THEATRE, with the reasoning shown |
Every Contested Assurance engagement returns one of these three ratings. This scale is separate from the comparison above, it is the disclosed finding itself, not a row-by-row key to the table.
A genuine, adjudicated finding that would hold under regulator, court or audit scrutiny.
Some genuine testing occurs but scope, adjudication or comprehension is compromised.
Scripted, low-consequence, built to protect reputation rather than to test anything.
Three tiers, one standard
Qualitatively different in the depth of assurance carried, not volume-scaled. Each tier is a credible entry point to the next.
1. Diagnostic
From A$7,500
A rated assessment of your current exercise programme against the ASSURANCE / PARTIAL / THEATRE standard, with a board-ready gap report. No exercise delivered at this tier.
2. Designed Exercise
A$18,000 – A$35,000
One purpose-built, adjudicated exercise against a specific obligation: a CIRMP review, an IRP test, a SoNS cyber exercise. Design, delivery and after-action review included.
3. Assurance Programme
From A$60,000 / annum
A rolling annual programme: three to four exercises, a standing red-team function, independent challenge and board assurance reporting integrated into the compliance cycle.
All fees in Australian dollars (AUD), indicative and exclude GST. Final scope and fee confirmed against your obligations.
If your last exercise would not survive an honest rating, that is worth knowing now.
To rate a current exercise programme, or to scope a Contested Assurance exercise against a specific SOCI, CIRMP or ISO 22301 obligation:
Start a scoping conversationTony Ridley MSc CSyP FSyI SRMCP