Part I · Chapter 1 · The Ask · lesson 10
The first thing that does not line up
12 min
Builds on Describe your own organisation, and watch half the work disappear
Part I · Chapter 1 · The Ask · lesson 10
12 min
Builds on Describe your own organisation, and watch half the work disappear
Everything in this track so far has been description. This is the first lesson where you write two things down and let something read them back.
The two things are a boundary and a period. The boundary is a sentence or two about what is inside the line, in your own words, and the test is whether you would read it out to a customer. The period is two dates, typed as year-month-day, and everything else you ever record in this workspace gets measured against them.
The referee that reads them will not tell you whether you are ready. It cannot: the only honest grader of that is an auditor, and an auditor cannot be simulated. What can be decided with no judgement at all is whether two things you wrote contradict each other, and that is where almost every real audit finding comes from.
So before you type: a boundary is also a bill. Every system inside the line is a system whose evidence you produce for every month of the period, and every month of the period is a month that has to be evidenced for every system inside the line. Those two sentences are the same sentence, and the register is about to multiply them for you.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
One or two sentences, in your own words. The test is whether you would read it out to a customer.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
The period you are claiming
Everything in here is measured against these two dates. Typed as year-month-day, so the same thing is stored whatever your browser thinks the date format is.
two dates, the second after the first
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
Four rules are capable of firing on what you just entered, and it is worth knowing their names, because they are arithmetic rather than opinion.
Evidence that does not touch your period. An artefact whose own dates fall entirely outside your window cannot speak to the window. The question it asks back is not whether the artefact is good; it is what covers the window itself.
Evidence that is stale for its own cadence. If something is produced monthly and the most recent one is months before your period closes, the arithmetic notices. The question is a genuine fork: did it run and go unrecorded, or did it not run?
Controls claimed to be operating with no instance inside the window. If a quarterly artefact should have appeared three times in your period and none is recorded, that is a contradiction between two things you wrote rather than a judgement about your security.
Evidence linked to nothing. An artefact attached to no control was collected for a reason nobody wrote down.
Look at what the panel actually said. For most readers at this point it said nothing, because there is no evidence in the workspace yet and three of those four rules need some. That is the honest output of an empty graph, and it is worth sitting with for a moment: a register with nothing in it has no contradictions and tells you nothing. The count going up later is the system working, not the system complaining.
One thing worth checking before moving on. If you set the period to match the date a buyer asked for rather than the stretch of time you could actually evidence, the register will take you at your word, and every month at the front of it will eventually turn into a question somebody asks.
That is the condition under which this lesson stops being useful, and it is named in the manifest: the contradiction that matters most is in something you have not written down yet, and the engine cannot see it at all. A control you never added cannot contradict anything. The silence is not a result.
Check
What you have at the end of this track is three sentences you could say out loud: what a buyer is actually asking you for, the date you would have had to start to answer them on time, and roughly what answering them costs you every year once it is done. None of those three is a claim about your security, and all three are things almost nobody who has been sent a questionnaire can say.
The next track is the boundary, which is the single most consequential decision in the whole exercise and the one most often made by pasting somebody else's sentence. The one you just typed is a first draft, and you will be asked to defend it with numbers attached.