Recovery Test Report

Harbour & Finch LLP · Q3 2026

Plan: Assured
Tests run: 16–17 Sep 2026
Services tested: 4 critical
Issued: 24 Sep 2026

3 of 4

Three services met their recovery targets. The finance system was restored in time, but its bank feed did not reconnect. One action is open, with a retest booked for November.

Results against targets

Service	Recovery time target	Achieved	Data loss target	Achieved	Result
Practice management system	4 h	2 h 40 m	1 h	15 m	Passed
Document management	4 h	3 h 10 m	1 h	30 m	Passed
Microsoft 365 mailbox restore	8 h	1 h 05 m	24 h	4 h	Passed
Finance system	24 h	6 h 20 m	24 h	12 h	Action

How to read this. The recovery time target is the longest acceptable outage. The data loss target is the most recent data you can afford to lose. You agreed both targets with us for each critical service.

How we tested

Each service was restored from its backups into an isolated environment, so live systems were not affected. We timed each step and asked the service owner to confirm that the restored service worked.

Evidence collected

Backup job logs for each service
Restore timings, recorded at each step
Data integrity check results
Sign-off from the business owner of each service
Screenshots of the restored services in use

Recovery Test Report · Q3 2026

Finding

Finance system: bank feed did not reconnect

The finance system was usable 6 hours and 20 minutes after the test started, well inside its 24-hour target. Staff could post transactions, but bank transactions could not import until the bank feed was set up again by hand.

Test timeline, 17 September

09:00 Test started. Latest backup selected from the finance system backup vault.
10:45 Server and database restored into an isolated recovery environment.
11:30 Data integrity checks passed. Ledgers and invoices matched the source system.
12:10 Staff from the finance team confirmed they could log in and post transactions.
14:05 Bank feed failed to reconnect. The API token for the bank was not in the backup.
15:20 Test closed. Service usable without the bank feed. Action raised.

Cause

The bank feed uses an API token that was stored only on the original server, outside the backed-up data. The recovery runbook did not include a step to restore it.

Impact in a real outage

The finance team would work without automatic bank imports for about one day, until the bank issued a new token. Payments and invoicing would continue.

Actions

Action	Owner	Due
Store the bank feed API token in the shared secrets vault	IT provider	31 Oct
Add the token restore step to the finance system recovery runbook	Elmfort	31 Oct
Retest the finance system recovery, including the bank feed	Elmfort	28 Nov

Next scheduled tests. Practice management and document management in December. Microsoft 365 and the finance system, including the bank feed, in March 2027.