The Rehearsal Before the Release: Stress-Testing Insider Controls in 180 Minutes

Market abuse controls are usually examined through documents: a list, a log, a policy, a training record. That is necessary, but it is not sufficient. The more useful question for a UK board is whether those artefacts remain usable when a results announcement, fundraise or transaction timetable compresses decision-making. A short, structured rehearsal can answer that question before an actual event does.

With the 2026 year-end reporting cycle approaching, boards and company secretariat teams have a natural window to test the machinery. The exercise below is deliberately desk-based. It uses a fictional scenario, anonymised evidence and a fixed 180-minute agenda. It is not a substitute for legal advice, nor does it require the creation or circulation of actual inside information.

Why rehearse rather than review

A conventional review confirms that an insider list exists and that a wall-crossing log has entries. A rehearsal tests whether the list can be updated accurately at speed, whether the log explains who authorised a wall-crossing and on what basis, and whether investor relations can respond to an unexpected query without risking selective disclosure.

Weaknesses often sit at the joins between functions. A joiner may be added to the insider list but not to the restricted list. An adviser may be wall-crossed orally but the log may record only the date. A disclosure committee may have clear terms of reference but no tested route for convening out of hours. These are evidence gaps as much as control gaps, and they are best found in a room with the people who would have to act.

Setting the room and the clock

The company secretary should convene the session. Legal, investor relations, finance and internal audit should attend, with an observer from the audit committee if appropriate. The board does not need to be present throughout, but a board member should receive the summary and approve the actions.

The evidence pack should include the current insider list, the wall-crossing log, the disclosure timetable, communications approval routes, PDMR dealing clearance procedures and any market rumour escalation guidance. All live names and sensitive details should be redacted. The scenario should be clearly fictional — for example, a hypothetical announcement code-named Project Kestrel — and the minutes should record the exercise without reproducing any hypothetical inside information.

A practical structure is three fifty-minute segments with short breaks, followed by a ten-minute close. The clock matters. The purpose is not to complete a perfect simulation but to expose where evidence is missing, ambiguous or slow to retrieve.

Segment one: the list under pressure

The first segment tests the insider list. Participants should ask who is on the list, why they are there, when they were added and what access they have. The team should then simulate adding a new external adviser at short notice and removing a leaver on the same day.

Useful evidence tests include whether the list distinguishes role-based and person-based entries, whether joiners and leavers are captured promptly, and whether contractors and advisers are included on a consistent basis. The team should also check whether the list has a clear version history and whether access to it is restricted appropriately. A list that can be edited by one person without a second check is a list that may not withstand scrutiny.

Common findings include orphan entries that no one can explain, missing leavers, and advisers who appear on the list but not on the corresponding restricted list. These are not merely administrative points. They affect the reliability of the record if the company later needs to demonstrate that it identified and managed access to inside information.

Segment two: the wall-crossing log

The second segment tests wall-crossing. The team should simulate an adviser being brought across the wall in connection with Project Kestrel, then test what the log would show. Who authorised the crossing? When did it happen? What information was provided? What acknowledgement was obtained? What restrictions followed?

The most frequent weakness is not the absence of a log but the thinness of its entries. A date and a name may show that something happened, but not why it was permissible or what the recipient understood. The rehearsal should test whether the log can answer a challenge from a regulator, an auditor or a court without relying on memory.

The team should also test the exit. If the adviser later comes off the wall, is that recorded? If the transaction timetable slips, is the restriction reviewed? These questions matter because wall-crossing is not a one-off administrative event; it is a status that should be managed until it ends.

Segment three: disclosure, rumours and leaks

The final segment tests disclosure controls. The team should introduce a hypothetical market rumour before the announcement and ask who decides whether a response is required, who drafts it, who approves it and where the decision is recorded. Investor relations should test its script for a query that comes close to confirming inside information without doing so.

The team should also check the closed-period and PDMR dealing clearance arrangements. Can the company show that a director was told not to deal? Can it show that clearance was refused or granted on a documented basis? If the answer depends on an email that no one can locate, the control is weaker than the policy suggests.

The segment should end with a leak escalation test. Who calls whom? Is there an out-of-hours route? Does the disclosure committee have a quorum and a decision log? The objective is not to predict the real event but to confirm that the response would be coordinated and evidenced.

Closing the loop in the minutes

The final ten minutes should be used to record three to five specific fixes, each with an owner and a date. The minutes should distinguish between an evidence gap and a control gap. An evidence gap may require better record-keeping; a control gap may require a change to the process itself.

The board or audit committee should receive a short summary: the scenario tested, the participants, the principal findings and the actions agreed. The summary should avoid unnecessary detail about the fictional transaction and should not create a new record that could itself be sensitive.

What good evidence looks like

Good evidence is dated, attributable and retrievable. An insider list should show version control and a clear reason for each entry. A wall-crossing log should show authorisation, information shared, acknowledgement and exit where relevant. A disclosure decision should show who decided, when and on what basis. Training records should be current and linked to roles.

The rehearsal will not eliminate risk. It will, however, give the board a more realistic view of whether the company can produce that evidence under time pressure. For a 180-minute investment, that is a proportionate return.