Reporting to a board that wants one number

A board wants one number and there is not one

The request is reasonable. Compliance does not produce a single figure that means anything, and inventing one is how programmes end up reporting green in the month before a failed assessment.

Four numbers work, and they should be the same four every month.

What to report

Controls with current evidence, as a proportion. Not controls implemented: controls for which evidence exists and is recent. The gap between those two is the interesting part.

Open remediation items, by severity. A count and a trend.

Confidence in the date. Stated as a range with the reason for the range, not as a single date that never moves until it moves by a quarter.

Spend against plan. Including internal time, priced, for the reasons the entry on cost gives.

Ninety per cent is not ninety per cent of the way there

Requirements are not equal. Ten unmet requirements can be trivial or can be the ones that fail an assessment, and a single percentage hides which.

Worse, once the percentage is the reported number it becomes the managed number, and the cheapest way to raise it is to satisfy easy requirements first. That is the wrong order: the hard ones need the lead time.

Report the percentage with the count of high-severity items beside it, always, so that neither can be read alone.

The rule that keeps a programme credible

A date that slips is a normal event. A date that slips having been reported as safe the previous month is a credibility event, and the second is much more expensive than the first.

Report a risk when you first believe it rather than when it materialises. Boards absorb early warnings and remember late ones.

One page

The four numbers at the top. Three lines on what changed this month. Three lines on what is at risk and what is being done. One decision or request, if there is one.

Anything longer is read by nobody and produces questions about whatever appears on the page the reader happened to open.

Control-by-control detail

It is the material the owner works from and it is not a board paper. Presenting it invites a discussion of individual controls with people who cannot evaluate them, and it consumes the meeting.

Keep it available as an appendix nobody reads and refer to it if asked.

What goes outside the company

Separately from internal reporting, suppliers submit self-assessment scores into a government system, and primes ask their supply chains for status. Those numbers are visible to customers and they should be consistent with what the board is told.

Where they diverge, somebody has been optimistic in one direction, and the divergence is discoverable.

Monthly, and the same day each month

Quarterly is too slow to act on and weekly is noise. A fixed monthly slot that happens whether or not there is news establishes the habit, and the month with no news is the shortest paper you will ever write.

Are we going to make it

Answer it directly, with the confidence range and the two things that would change it. An owner who answers with a percentage of controls has not answered, and will be asked again in a form that is harder to handle.

One chart, not a table

Controls with current evidence, plotted monthly since the start. It answers the trend question without discussion and it makes a flat month visible, which a table of the current figure does not.

Say that

A month where the numbers did not move because the work was documentation is a legitimate month. Reporting it plainly is better than manufacturing progress, and it prepares the ground for the months where the numbers move quickly.

Elsewhere in running the programme

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.