The sentence everybody copies, and what it quietly commits you to

Here are four lines from the front of somebody else's report. Not a real company's; the shape is the shape everybody uses.

The description covers the Orrery platform and the supporting infrastructure used to deliver it, including the systems and personnel involved in the development, operation and support of the platform, for the period stated.

It is the least-read paragraph in the document and the one that decides what every other page means. Before you read on: read it as a promise rather than a preamble.

Predict

You paste that sentence onto your own report. How many distinct systems have you just agreed to produce dated evidence for, every quarter, for the whole period?

Choose one answer

Three or four — whatever the product actually runs onAround a dozen, once you count the obvious supporting piecesWhatever a reader decides supporting covers, which is not a number you choseNone in particular — it is a scope statement, not a control

Lock in answer

Taking the four lines apart

Read each phrase as an instruction to a stranger building a sample list.

The Orrery platform. The only bounded thing in the sentence. One named product. This is the phrase that behaves.

The supporting infrastructure used to deliver it. A test, not a list, and a test anybody can apply. Does the identity provider support delivery? It is the thing that decides who can deploy. Does the deployment pipeline? It is the thing that puts code into production. The laptops? They are where the code is written and the credentials are held. Each of those is a yes on an ordinary reading, and each yes is a control owner, a quarterly artefact and somebody's afternoon.

Development, operation and support. Three verbs, and each one names a population of people rather than a population of machines. Support is the expensive one, because support is where read access to customer records lives and where contractors are most common.

Personnel involved in. Involved to what degree. The engineer who deployed once in March is involved. Your own answer sits somewhere between twenty people and everybody, and the sentence does not say which.

The useful rewrite

The fix is not a longer sentence. It is a sentence where every phrase is countable, and one phrase names what is outside.

The Orrery production platform, the identity provider and deployment pipeline that control access to it, and the thirty-nine people who can reach production or read customer records. The analytics add-on and the systems that serve it are outside this boundary.

Same length. The difference is that a reader can count from it, and that the second sentence exists at all.

Something people say

“Copying a boundary from a report in your own sector is the safe option, because somebody already got that exact sentence through an audit.”

Why it spreads

It is genuinely how most boundary statements come to exist, it costs an afternoon rather than a fortnight, and the source document really did pass. Nobody who copies one has ever been told off for the shape of the sentence, because the shape is not the part that goes wrong.

The part that is true

The vocabulary is worth borrowing, and the shape is genuinely conventional. These documents are written in a register, readers expect it, and inventing your own structure makes a procurement reviewer slower rather than happier. Borrowing the form is sensible.

Two companies paste the identical boundary sentence. What is the most likely reason it costs one of them three times what it costs the other?

One of them has weaker controls, so more of the work is remediationThe phrases resolve against a different estate, so they enclose a different number of systems and peopleOne of them hired a more expensive firmOne of them chose a longer period

Check

You are shown two boundary statements for the same company. The first is four lines of the usual phrasing. The second is six lines, names eleven systems, and ends by naming three things that are outside. Which is riskier to publish?

Choose one answer

The second, because naming eleven systems commits you to eleven evidence streamsThe second, because the named exclusions give a buyer three things to object toThe first, because its quantifiers get filled in by whoever is reading itNeither — the scope statement is not what the opinion is about

Check answer

Worth remembering

• A boundary statement has two readers: an auditor who reads it as a population to sample, and a buyer who reads it as a description of your company.
• Every noun in it is a count you agreed to; every adjective is a count somebody else makes on your behalf.
• An undefined quantifier does not stay undefined — it resolves in an auditor's sample list and in a buyer's head, and never narrower than a list you wrote yourself.
• A borrowed sentence carries the other company's estate inside its adjectives, and resolves against yours instead.
• A boundary that names what is outside it is longer on paper and smaller in practice.