Make it more real
"... the exercise was criticised by some banks as not challenging enough. Some participants wanted a greater emphasis on ..."
I'd want to see a greater emphasis on bankers being kidnapped on their way to work or from their homes, then being 'pressured' to reveal their passwords, etc. I'm a firm believer in 'worst case' testing.