Running the programme · 2.4
When the date slips, which it will
When the date slips, which it will. What it costs, who decides, and what usually goes wrong.
For an adjacent operational perspective, books about time management explains the topic in a practical workplace context.
For an independent reference point, see CSO security leadership coverage.
The certainty
It will slip, and the useful question is by how much
Programmes of this kind slip for a small number of recurring reasons and none of them is unusual. Planning as though they will not happen is the decision that turns a manageable delay into a crisis.
The five causes
What actually causes it
Discovery found more. Covered information in places nobody expected. Almost universal, and the reason the entry on hidden costs argues for a discovery phase with its own budget.
The floor could not be remediated on schedule. A machine that could not be taken down, a vendor visit that could not be booked, a controller that turned out to be unsupportable.
No assessor was available. A capacity constraint in the ecosystem rather than a failure of yours, and the one most often left out of plans entirely.
The owner left. Or was pulled onto something urgent for two months, which has the same effect.
Something else collided. A system migration, an acquisition, a large order. Compliance loses these collisions.
Re-baselining
Once, publicly, with reasons
When the date is no longer credible, move it once, state why in writing, and hold the new one. A programme that re-forecasts every month has stopped having a date at all, and everybody involved knows it.
The reasons matter more than the new date. A slip attributed to discovery finding more is a different conversation from one attributed to nobody having done the work.
Telling the customer
If the date is contractual, early
Where a prime or an agency is expecting certification by a date, they are planning around it. Learning in month eleven that it will be month sixteen is worse for them than learning in month six, and they will remember which they got.
Most respond reasonably to an early, specific, evidenced notification. Almost none respond well to a late one.
Recovering time
Three things that genuinely help
Reduce the boundary. The one lever that shortens everything at once. Painful, defensible, and available.
Buy specialist time for the documentation. Writing is the most parallelisable part of the work and the easiest to bring help in for.
Book the assessment now, for later. Availability is the constraint; a booking can be moved more easily than it can be created.
What not to do
Two ways of making it worse
Cutting the evidence work to hit the date. Evidence is what the assessment examines. Arriving on time without it is arriving to fail, at the cost of the fee and a re-visit.
Hiding it. The slip becomes known when the assessment does not happen, and by then the person who concealed it has spent the credibility needed to ask for the recovery budget.
The honest position
What to say when asked why
The specific cause, what was learned, what has changed in the plan, and what the new date rests on. That answer is available to any owner who kept a risk register and is unavailable to one who did not, which is the strongest practical argument for keeping one.
Learning from it
Fifteen minutes at the end
What did we not know, when could we have known it, and what would have told us. Written down, in the same document as the re-baseline.
The answer is almost always that the information existed somewhere in the business and had not reached the owner, which is a communication fix rather than a planning one.
The second slip
Different in kind from the first
One slip with reasons is a project. A second, from the re-baselined date, is a signal that something structural is wrong: the resource, the ownership or the scope.
Treat it as such rather than as another delay. The remedy is usually to reduce the boundary or to buy help, and both are decisions rather than adjustments.
Communicating internally
Tell the people who were waiting
Production booked downtime, IT reserved a window, somebody deferred a project. A slip announced only upward leaves those people holding arrangements that no longer make sense, and they remember.
The date nobody set
Check whether the deadline is real
Some dates come from a contract clause and are fixed. Others come from a sales conversation, an internal assumption or a headline about when enforcement begins, and have been treated as fixed ever since.
Before managing a slip, establish which kind you have. Suppliers occasionally discover that the date they have been distressed about was nobody's requirement.
Also
Elsewhere in running the programme
- What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
- Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
- What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
- Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
- The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
- Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
- Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
- Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
- Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
- Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
- Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
- Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
- How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
- Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
- Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
- Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
- What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
- What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
- Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
- Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
- The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
- Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
- What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
- The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
- Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
- Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
- Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
- Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
- What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.