What happens after the annual test of the Nexus programme: how evidence is sealed, reviewed, published, corrected in the open and carried into the next cycle. It also sets out what The Global Risks Alliance (GRA) contributes for finance and what it never decides.
Key takeaways
- The Global Risks Alliance (GRA) takes part in one shared programme year, not a cycle of its own: Nexus Universe is governed by The Global Risks Forum (GRF), evidence and methods come from The Global Centre for Risk and Innovation (GCRI), and GRA contributes the finance and insurance readiness track [1, 2].
- Correction and continuation begin after the test, and the year still has four gates: G4 authorises the controlled week, G5 seals the evidence, G6 authorises publication and G7 reviews renewal; each is a programme decision, never an approval by a public authority [3].
- Supervisors already run exercises as learning: the ECB tested 109 banks for cyber resilience in 2024 and fed the results into its supervisory review, and its 2022 climate stress test found that around 60% of banks had no climate stress-testing framework [4, 5].
- A correction is a new, dated version that says what changed and why, never a silent edit; a finding that can no longer be supported stays visible, marked as withdrawn [6].
- Continuation means the next cycle starts from the last one: change proposals go to the Nexus Standards, open questions to the next first-quarter edition and capability gaps to the next build [3, 7].
What correction and continuation mean in the programme year
Correction and continuation are the closing stages of the Nexus programme year: after the annual test, evidence is sealed, reviewed and published, errors are corrected in the open, and what was learned is carried into the next cycle as its mandate. The year runs on one rule, “prepared for a year, built in a month, tested in a week and stood down in a day”, then reviewed and renewed [3]. It has four quarters, twelve phases and eight gates, G0 to G7, and it is the same year for every institution in Nexus Consortiums [3].
This page follows the second half of that year, from the controlled test in the third quarter to renewal at the end of the fourth. Its companion, from year-round readiness to annual testing, reporting and recognition, follows the first half. Both describe a designed specification: no cycle has yet run, and every programme is at service level R0, information and enquiries [3, 8].
An earlier version of this page described a seventeen-phase annual cycle run by GRA itself, with protocol labs, recognition records and badges. That structure is not on record and is withdrawn here. As set out on the GRA home page, GRA reads risk evidence for finance; it contributes to the shared programme year through the finance-readiness programme of Nexus Universe; its own professional working groups and learning are designed but not yet open [1, 9].
Why the second half of the year carries the value
An exercise is worth what is learned from it, and most of the learning happens after the exercise ends. The World Health Organization’s Simulation Exercise Manual treats simulation exercises, together with after-action reviews, as the functional assessment of a system: people practise their roles, and the exercise shows whether procedures and mechanisms work under pressure [10]. Financial supervisors apply the same logic. In 2024 the European Central Bank (ECB) ran a cyber resilience stress test on 109 banks under its direct supervision; all answered a questionnaire and 28 underwent more extensive testing, and the results fed into the 2024 Supervisory Review and Evaluation Process [4].
The ECB’s 2022 climate risk stress test is the clearest public case of an exercise run to learn. It covered 104 significant banks, and around 60% did not yet have a climate risk stress-testing framework [5]. The 41 banks that ran the bottom-up module projected credit and market losses of around EUR 70 billion, a figure the ECB itself described as understated, because the scenarios excluded economic downturns and the exposures in scope were only about one third of those banks’ total exposures [5]. The value of the exercise lay in what it showed to be missing.
Regulation now asks for the same discipline. The EU Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to 20 types of financial entities and ICT third-party service providers, so that they can withstand, respond to and recover from ICT disruption [11]. The Nexus programme does not run supervisory tests. What it can offer financial institutions and authorities is the physical and cross-sector side of a scenario, tested in a controlled week and then reviewed, corrected and carried forward with its limits on record.
From the test to the evidence seal
The third quarter holds four phases. Action Week, opened at gate G4, is a week of controlled exercises across ten tracks, with independent evaluators; track 7 is finance and insurance readiness, which GRA is designed to run [3, 1]. The one-day stand-down that follows is still marked as proposed in the programme spine: new work stops, authorised jobs are checkpointed, temporary access is revoked and transferable evidence is sealed with its provenance [3]. Closeout ends at G5, “evidence sealed and stand-down recorded”, with unresolved exceptions given accountable owners. The after-action review then records what worked, what failed and what was not tested, and it preserves dissent.
In the finance track the controls are explicit. A master scenario events list is run by exercise controllers and simulation cells; evaluators test objectives and observable performance, not attendance; simulated warnings never reach live audiences; and dissent and adverse findings are kept in the after-action record. “In the finance track, a simulated loss is never presented as an observed impact,” and no exercise result is a loss forecast, a supervisory test or a capital requirement [1]. The same separation of exercise direction, control and evaluation is what the WHO recommends for any simulation exercise [10].
Reporting: what is published, by whom, and when
Publication has its own gate. G6, “publication authorised”, closes the reporting phase of the fourth quarter, and it is recorded by GRF as a programme decision with its evidence [3]. Nexus Reports publishes one edition a quarter: the third-quarter edition is Stress Test and Readiness, and the fourth-quarter Annual Synthesis is the flagship, with country and regional profiles. An edition is published after review, not to a calendar, and it is never a government risk register or a sovereign rating; no edition has yet been released [12].
GRA’s part is the financial reading. Its analysis is designed to inform the finance and insurance chapter of the annual flagship, covering protection gaps, fiscal and operational transmission and the diligence questions that remain open [2]. Its own professional briefs pass review by someone not responsible for the text, carry one evidence label on every finding (observed, published statistics, institution-reported, estimated, modelled, forecast, scenario, expert judgement or unknown), and are released with their version, authors, funding source and a route to challenge them. No sponsor or member may approve, delay or change a publication [13].
| Exercise | Banks in scope | Deeper or bottom-up testing | What the exercise showed |
|---|---|---|---|
| Cyber resilience stress test, 2024 | 109 banks [4] | 28 banks, including a live recovery test [4] | Response and recovery frameworks in place, with improvements needed; results fed into the 2024 supervisory review [4] |
| Climate risk stress test, 2022 | 104 significant banks [5] | 41 banks in the bottom-up module [5] | Around 60% had no climate stress-testing framework; losses of around EUR 70 billion, understated [5] |
Correction, update and withdrawal
The fourth quarter opens a correction phase on purpose: the programme expects to be wrong in places, and it plans for finding out. A reproducible concern is routed to the owner of the finding; the affected analysis is re-run with corrected inputs; and a new version of the edition is published with the correction and its reason [3]. GCRI keeps the record of Nexus Reports corrections.
GRA keeps the same discipline for its publications. Its record of corrections and updates distinguishes three kinds of change. A correction fixes a factual, calculation or labelling error, and the corrected version says what was wrong. An update restates a finding when a source is revised or newer evidence appears, with its new evidence label. A withdrawal marks a finding that can no longer be supported; it stays visible, marked as withdrawn, with the reason. Every entry records the publication, the date, the change, the reason, the effect on conclusions and the route by which it was raised [6].
Anyone can raise a possible error, without membership or payment. The acknowledgement gives a reference and names the next step; a reviewer not responsible for the original work takes part where the challenge is contested; and if the challenge is not upheld, the reasons are given to the person who raised it [6]. Superseded versions remain accessible, so that anyone who relied on them can see the difference.
From a finding to a better method
The earlier version of this page spoke of protocols drafted and tested in protocol labs. In the current model that work has a defined path through the six pillars. A method begins as an experiment in Labs, where its results are exploratory and labelled that way; only a reproducible prototype passes to the Foundry pillar, which rebuilds it before Nexus Universe tests it [14]. After the test, findings about methods and gaps become change proposals to the Nexus Standards, and adopted standards return to the Foundry for the next build and to Risk Academy as course modules [7].
Each step keeps its own status. Every Nexus Standard is at the proposed stage: consumers may apply it, and no authority has adopted it [15]. Adoption is final for each jurisdiction, no global body holds a veto, and a validator report is evidence for review, not a conformance claim [7]. For finance this matters: a method for separating measured, estimated and unknown components of a protection gap, of the kind GRA’s working groups are designed to develop, becomes useful to an insurer or a ministry only when its test, its limits and its corrections are on record [16].
Continuation: how one year becomes the next
The last phases of the year turn findings into the next year’s work. Docket review routes the year’s open items to their owners and registers capability gaps as work for the next build; network review publishes measured capacity results, and only measured results, never device counts; and renewal closes at G7, “renewal reviewed”, which sets the next cycle’s mandate [3]. Nexus Reports lists the open questions for the next first-quarter State and Agenda edition, and the National Portfolio and open projects are carried into the next cycle [3].
For GRA, continuation has a practical meaning. Diligence questions that the year could not answer stay on the register with their evidence state, so that the next cycle starts from what is known, estimated and unknown rather than from zero. A readiness dossier climbs only as far as its evidence allows; a rung not reached is shown as not reached, with the reason written down, and a finding that the evidence is insufficient is returned to the owner, never presented as readiness [17].
How the evidence is labelled and kept
The second half of the year produces records, not impressions: run, decision and observation records from the test week; a stand-down receipt and evidence manifest; an evidence seal and exception register at closeout; an after-action report; correction records and new edition versions; and the renewal decision [3]. Each finding carries one of nine evidence labels, missing data is shown as missing and never as zero, and simulated results are never reported as observed impact [8].
The programme keeps these records in its shared evidence environment. The participants, agreements and handoffs of the year are recorded in NXS-RLS (participants, agreements and handoffs), and the programme’s records and learning in NXS-HUB (knowledge, records and learning); every object of the year carries an identifier so that a finding can be cited and corrected [3]. Who took part, and in what capacity, is kept in the programme’s participation records.
The instruments this work reads against
The programme’s exercises are not supervisory instruments, and they substitute for none. They are designed to produce evidence of the kind these instruments already ask institutions to hold.
| Year | Instrument | Status and relevance |
|---|---|---|
| 2017 | WHO Simulation Exercise Manual | Current WHO reference; exercises and after-action reviews as functional assessment [10] |
| 2022 | PRA Supervisory Statement SS1/21, operational resilience | Current version effective from 31 March 2022; impact tolerances for important business services [18] |
| 2022 | Basel Committee principles on climate-related financial risks | Published 15 June 2022; supervisory principles for banks and supervisors [19] |
| 2023 | FSB toolkit on third-party risk management and oversight | Published 4 December 2023; identifying critical third-party services across the service lifecycle [20] |
| 2025 | EU Digital Operational Resilience Act (DORA) | In application since 17 January 2025 for 20 types of financial entities and ICT providers [11] |
What is changing
- Exercises are becoming supervisory routine. The ECB’s cyber and climate exercises fed supervisory review rather than capital requirements, which makes the after-action record the product [4, 5].
- Third-party concentration. The FSB toolkit centres on critical third-party services, whose disruption could affect critical operations and financial stability; scenarios that cross sectors are needed to read it [20].
- Operational resilience in law. DORA brings the testing of ICT resilience into binding EU rules for financial entities and their providers [11].
- Corrections as a trust signal. A public record of what changed, and why, is becoming the test of whether an evidence publisher can be relied on [6].
Three institutions, one year
The second half of the year shows the division of labour most clearly. GRF records the gates, from the authorisation of Action Week to renewal, in the manner of exercise direction, apart from controllers and evaluators, as set out in programme governance and the annual operating cycle; its results and records page explains what is kept. GCRI runs the technical office that captures evidence and handles closeout, and it stewards Nexus Reports. GRA reads the results for finance and contributes to the flagship’s finance and insurance chapter. Nexus Consortiums are formed at national and regional level through their host and lead organizations, within a multilateral programme led by these three institutions; the annual programme cycle is the same for all of them [2, 3].
Boundaries. What this page does not claim: no programme year has yet run, no edition of Nexus Reports has been released, and the programme is at service level R0. Gates are programme decisions, never public-authority approvals or certifications. GRA does not lend, underwrite, rate, invest, advise on or arrange transactions; readiness is not approval, and an exercise finding is never a loss forecast, a supervisory test or a capital requirement. GCRI does not regulate or certify, and GRF does not regulate, finance or procure. Naming a supervisor, regulation or exercise is not a claim of partnership or endorsement.
Questions and answers
Does GRA run its own annual cycle?
No. There is one programme year for Nexus Consortiums. Nexus Universe is governed by GRF, GCRI runs the technical office, and GRA is designed to contribute the finance and insurance readiness track and the financial reading of the results.
What is the difference between a correction, an update and a withdrawal?
A correction fixes an error and says what was wrong. An update restates a finding when newer evidence appears. A withdrawal marks a finding that can no longer be supported; it stays visible, marked, with the reason.
Can a sponsor or member change a finding before it is published?
No. A sponsor may be told when a publication is due, but no sponsor or member may approve, delay, suppress or change a publication. Factual corrections from any party follow the ordinary correction route.
Are exercise results a stress test or a forecast of loss?
No. Exercise findings are evidence with stated limits. A simulated loss is never presented as an observed impact, and no result is a supervisory test, a capital requirement or a promise of funding or cover.
What carries over from one year to the next?
Open diligence questions with their evidence state, change proposals to the Nexus Standards, registered capability gaps, the National Portfolio and open projects. The next first-quarter edition starts from the fourth-quarter synthesis.
How do I report an error in a GRA publication?
Write to GRA through its integrity route, without membership or payment. You receive a reference and the next step; if the challenge is upheld a new version is recorded, and if not, the reasons are given.
Glossary
- Gate: A recorded programme decision about the cycle, G0 to G7; never an approval by a public authority.
- Evidence seal: The closeout record, at G5, that fixes the evidence of the test with its provenance.
- After-action review: The record of what worked, what failed and what was not tested, with dissent preserved.
- Correction record: A dated entry stating what changed in a publication, why, and whether conclusions changed.
- Change proposal: A finding about a method or gap, submitted to the Nexus Standards for open review.
- Next-cycle mandate: The renewal decision, at G7, that sets the questions and scope of the following year.
Further reading across the network
- Universe finance-readiness programme
- The Nexus cycle at GRA: test
- The Nexus cycle at GRA: renew
- Corrections and updates at GRA
- Nexus Universe at GRF
- Exercises and learning at GRF
- The programme year in the Nexus documentation
- Programme status
References
- The Global Risks Alliance (2026). Universe finance-readiness programme. Accessed 2026-10-21.
- The Global Risks Alliance (2026). GRA in the Consortium. Accessed 2026-10-21.
- The Global Centre for Risk and Innovation (Nexus documentation) (2026). The programme year. Accessed 2026-10-21.
- European Central Bank (Banking Supervision) (2024). ECB concludes cyber resilience stress test. Accessed 2026-10-21.
- European Central Bank (Banking Supervision) (2022). ECB Banking Supervision: banks must step up efforts to incorporate climate risk (2022 climate risk stress test). Accessed 2026-10-21.
- The Global Risks Alliance (2026). Corrections and updates. Accessed 2026-10-21.
- The Global Centre for Risk and Innovation (Nexus documentation) (2026). Nexus Standards (programme pillar). Accessed 2026-10-21.
- The Global Centre for Risk and Innovation (Nexus documentation) (2026). Status and service levels. Accessed 2026-10-21.
- The Global Risks Alliance (2026). Claims and programme status. Accessed 2026-10-21.
- World Health Organization (2017). WHO Simulation Exercise Manual (WHO/WHE/CPI/2017.10). Accessed 2026-10-21.
- European Insurance and Occupational Pensions Authority (EIOPA) (2026). Digital Operational Resilience Act (DORA). Accessed 2026-10-21.
- The Global Centre for Risk and Innovation (Nexus documentation) (2026). Nexus Reports (programme pillar). Accessed 2026-10-21.
- The Global Risks Alliance (2026). Publications and professional briefs. Accessed 2026-10-21.
- The Global Centre for Risk and Innovation (Nexus documentation) (2026). Labs (programme pillar). Accessed 2026-10-21.
- Nexus Standards (2026). Governance of the Nexus Standards. Accessed 2026-10-21.
- The Global Risks Alliance (2026). Professional working groups. Accessed 2026-10-21.
- The Global Centre for Risk and Innovation (Nexus documentation) (2026). Finance readiness. Accessed 2026-10-21.
- Bank of England, Prudential Regulation Authority (2022). SS1/21 Operational resilience: impact tolerances for important business services. Accessed 2026-10-21.
- Basel Committee on Banking Supervision (2022). Principles for the effective management and supervision of climate-related financial risks. Accessed 2026-10-21.
- Financial Stability Board (2023). Enhancing third-party risk management and oversight: a toolkit for financial institutions and financial authorities. Accessed 2026-10-21.
Editorial record
Facts and programme states are given as of 21 October 2026. This page is reviewed at least every 180 days and whenever a programme state, a gate definition or a cited figure changes. It replaces an earlier version whose seventeen-phase GRA cycle, protocol labs, recognition records and badges are not on the programme’s current record; they are withdrawn here.
Published by the GRA editorial desk under the editorial integrity policy. To report an error or request a correction, use the corrections and updates route; corrections are dated and listed with the page. The programme-wide state of every claim is kept on claims and programme status.