Running it as a project rather than as a document

A document that gets updated, or a project with a date

Most suppliers treat compliance as a folder somebody refreshes when an audit is announced. That works while the requirement is self-attested and stops working when somebody comes to check.

A project has a scope, a plan, milestones that can be verified, a budget, an owner and a risk register. Compliance preparation has all of those available to it and is rarely given them.

Seven, in order, and the order matters

• Define the boundary.
• Analyse the gap against the standard.
• Remediate, in the order the gap analysis gives.
• Document: the plan and its supporting procedures.
• Collect evidence.
• Check readiness, internally or with somebody external.
• Be assessed.

Attempting them out of order is the commonest cause of rework. Remediating before the boundary is drawn secures systems that need not have been in scope; documenting before remediating produces a plan describing an environment that no longer exists by the time anybody reads it.

Checkable, not proportional

"Eighty per cent complete" is not a milestone. "The boundary diagram is signed off by the sponsor" is. "All access control requirements have evidence dated within ninety days" is.

A milestone somebody outside the project can verify prevents the slow drift where everything is nearly done for five months.

Three that are outside your control

Assessor availability. The number of accredited assessors is finite and demand is not evenly spread. Booking is a lead time measured in months and it belongs in the plan as a dependency rather than as a final step.

Vendor lead times. Network equipment, controller upgrades and professional services all queue.

Machine downtime. Anything requiring a machine to stop competes with production, and production wins. Get the windows booked early and treat them as fixed.

Five entries, reviewed monthly, actually used

Most registers are written once and never opened. A short one that gets read is worth more: the discovery finds more than expected, the owner leaves, an assessor cannot be booked, a machine cannot be remediated, a key vendor slips.

Each with a named response rather than a probability score. The score is documentation; the response is management.

Not a list of every requirement

A plan with a line per requirement is unmanageable and hides the structure. Group by control family and by system: what has to happen to the enclave, what has to happen on the floor, what has to be written.

The requirements then become a checklist inside each group rather than the plan itself.

The deliverable is evidence and the deadline is external

In most internal projects the deadline is negotiable and the deliverable is a working thing. Here the deadline sits in somebody else's contract and the deliverable is a demonstration that things were true over a period.

Which means work cannot be compressed at the end. Evidence covering ninety days requires ninety days, and no amount of effort in the final month produces it.

Half a day, with the people who will be asked for things

Production, quality, IT, whoever handles contracts. What is happening, why, what will be asked of each of them, and when. It costs half a day and it prevents the pattern where the compliance owner spends six months explaining themselves one conversation at a time.

Use whatever the business already uses

A new tool for this project means one more place to look and a licence to justify. Whatever tracks work elsewhere in the business is adequate, and it has the advantage that people already open it.

Put the float where the risk is

Not a fortnight at the end, which gets consumed by whatever ran late first. Float belongs after discovery and after shop-floor remediation, because those are the two phases that overrun.

A plan with float at the end has a date that moves. One with float in the right two places has a date that holds through the ordinary surprises.

Say when something is finished

Phases that are never formally closed stay open, and work drifts back into them for months. A short written statement that the boundary is agreed, dated and signed by the sponsor, is what allows the next phase to proceed on a stable base.

Elsewhere in running the programme

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.