Part II · Chapter 2 · The Boundary · lesson 8
Leaving something out, in a sentence you would say to a customer
13 min
Builds on When the control you rely on belongs to somebody else
Part II · Chapter 2 · The Boundary · lesson 8
13 min
Builds on When the control you rely on belongs to somebody else
Three sentences, all taken from the same place in three different registers.
Not applicable.
Not applicable — we are cloud native.
In scope, and limited to the two services customers depend on. The internal reporting tools have no recovery figures agreed and are not covered here. Priya owns the two figures for both services and would be the one to tell you they had been missed.
The first is not a decision; it is a field somebody cleared to make a warning go away. The second is a decision made against the wrong fact — cloud native is a statement about where the computers are, and the question was about how long you can be down. The third is a decision, and the thing that makes it one is that a reader could disagree with it specifically.
Predict
Three properties, and a reader checks all three without being conscious of it.
Named. The exclusion identifies a thing, not a category. The internal reporting tools is a thing. Non-critical systems is an adjective you get to define after the fact, which means you have excluded whatever turns out to be inconvenient.
Reasoned about the right fact. The reason has to be about the subject of the control. No agreed recovery figures exist for these is about recovery. Cloud native is about hosting. A reason drawn from the wrong column is worse than no reason, because it tells a reader you answered a different question confidently.
Bounded. Either a scope — these two services and not those — or a date at which the position gets revisited. An exclusion with neither is open-ended, and pending further assessment is the phrase that does the most damage in this whole document, because it is a promise with no owner and no month in it.
Now one of yours. The control below is the clearest case in this subject of something a company can honestly leave out, partly leave out, or take on entirely — and of the three, partly is the hardest to write and the most common to mean.
Decide · continuity-objectives
Continuity planning is often written as though the goal were no outage, which is not a goal anybody can fund. The useful version states how long a recovery may take and how much recent work may be lost, in numbers, and then goes looking for the places where the current architecture cannot meet them. The gaps found that way are the output.
The decision
Two numbers, chosen before the event, by someone who can be held to them. How long down is survivable, and how much recent data loss is survivable — and they are different numbers with different costs, which is why a plan that states one and not the other has made half a decision. Whoever picks them has to be senior enough that the engineering cost of meeting them is theirs to carry.
Where this goes wrong
The numbers get set by what the current setup happens to achieve, discovered afterwards and written down as the target. That inverts the exercise: the plan can no longer be wrong, because any outcome matches the objective, and the gap analysis that was the whole point has nothing left to compare against.
Does this apply to you?
If you marked it as applying, the reason you wrote is now the shortest description anywhere of what your company has agreed to tolerate. If you excluded it, the reason you wrote is the sentence you would be saying out loud in a procurement call, and it is worth reading back in that voice before moving on.
Two specific things to check in your own wording.
Did the reason name a thing or a category? Categories are how an exclusion grows after it is written: non-critical gets applied by the next person to whatever they are busy with, and nobody notices because the sentence has not changed.
Is the reason about recovery, or about something adjacent that sounds like it? Managed hosting, high availability, replication across zones — all real, all about where failure happens rather than about how long you may be down and how much recent work may be lost. The second pair is the subject. Those two numbers are different from each other and cost different amounts, and a position that states one is half a decision.
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
The referee has no opinion on whether the exclusion is wise. What it can do is notice that your workspace contains two statements that cannot both hold: a control excluded on grounds your recorded shape does not support, an exclusion whose reason names a system your boundary includes, a control marked as running with nothing attached to it.
There is one condition under which all three properties above are satisfied and the exclusion still ends the conversation, and it is worth naming because it is not a failure of your reasoning.
Your buyer may have an obligation of their own — from a regulator, or from a contract they signed with somebody upstream — to check the thing you excluded. When that is the case, the argument is not about whether your exclusion is sensible. It is that your document cannot be used for the purpose they need it for, however well written the sentence is. A reviewer in that position is not disagreeing with you; they are telling you that they cannot discharge their own duty with what you have given them.
The honest response is to find that out early and say what you would offer instead: a narrower assertion about the specific thing, a separate letter, a commitment with a date. What does not work is arguing the merits, because the merits were never in dispute.