Your regulator asks for evidence that your cloud exit plan works. You have a 60-page document. What is the gap?

What the interviewer is testing

Whether you know that regulators increasingly require demonstrated capability rather than documented intent.

The gap

It has never been tested. An exit plan that has not been exercised is an essay, and this is where most plans fail examination. The regulator's question is not whether you have a plan; it is whether you could execute it.

What testing looks like

Full exit is usually impractical to rehearse, so the credible approach is component-level demonstration:

Data portability — actually extract a material dataset in an open format and load it elsewhere, with the time and cost measured. This is the most important single test because data gravity is the real constraint.

Workload portability — deploy a representative service on an alternative platform or on-premises from the same infrastructure code, and record what had to change.

Dependency inventory — an honest list of every provider-specific service in use, each with a named alternative and an assessed migration effort. Managed services with no equivalent are the ones that determine feasibility, and they should be identified before they are adopted rather than during an exit assessment.

Timeline and cost estimate derived from the tests rather than asserted.

What the plan should say honestly

Full exit for a large estate is a multi-year programme. A plan claiming six months will not survive scrutiny and damages credibility on everything else.

The stronger position is a tiered plan: critical services with a demonstrated shorter path, the remainder with a realistic longer one, and the residual risk accepted explicitly at board level with the reasoning recorded.

What a strong answer adds

Distinguishing the two questions the regulator is actually asking. Exit is about your ability to leave. Concentration is systemic and is not fully addressed by any individual firm's controls — so the honest answer names it as accepted at board level rather than pretending it is mitigated.

And the architectural investment that matters most day to day: portability through open interfaces — containers, open table formats, standard protocols — which is cheap and covers a real portion of the risk without the cost of active multi-cloud.

Common weak answers

Expanding the document. Claiming multi-cloud capability that has never carried production traffic.