Part II · Chapter 4 · What a control is · lesson 12
Defend one control to somebody who doubts it
16 min
Builds on Who notices when this stops happening?
Part II · Chapter 4 · What a control is · lesson 12
16 min
Builds on Who notices when this stops happening?
Go back through what you have marked as running and pick the weakest one. Not the one you like least — the one where, if somebody sat down opposite you and said they did not believe it did anything, you would have the least to say.
For most people the shortlist is short and the same control is on it: the one whose purpose is to change what a person does under pressure, and whose evidence is a figure about how many people finished a course.
Predict
A defence of a control is four sentences, and the fourth is the one that makes it credible.
What it is for. The specific bad outcome, named as a sentence with a victim in it rather than as a category.
What it produces. The artefact, with its date and its origin, and what that artefact does not show.
Who notices when it stops. A person or role who would find out without being told by the performer, and roughly how long it would take them.
The single condition that would make you redesign it. This is the sentence that distinguishes somebody who chose the control from somebody who inherited it, because only the first can say what would change their mind.
Decide about it, then defend it. The control below is in the register because its purpose and its usual evidence are further apart than anything else here — which makes it the best thing to practise on and an uncomfortable thing to be asked about cold.
Decide · security-awareness
The target of this control is a specific moment: a convincing request arrives late on a Friday and somebody decides whether to act on it. Everything about the training is instrumental to that moment, which is why completion rates are a measure of the delivery and not of the control.
The decision
What behaviour you are trying to change, and how you would know. Annual completion is easy to evidence and tells you almost nothing; a reporting rate tells you more and takes work to measure honestly. The genuinely hard decision is whether reporting a mistake is safe here, because a culture where it is not produces excellent training statistics and silent incidents.
Where this goes wrong
The control gets optimised for the artefact that is easy to produce. Completion percentages are available from the platform, so they become the evidence, and once they are the evidence the content is tuned to be completable rather than to be remembered. Nothing in that loop ever points back at the Friday afternoon it was for.
Does this apply to you?
Take what you have just recorded and write the defence out. Four sentences, in order, and resist the pull towards a fifth that summarises.
What it is for. Not “staff awareness”. Something like: a plausible request to change a supplier's bank details arrives on a Friday afternoon and somebody acts on it without checking, or somebody clicks a credential prompt and does not mention it for a week because mentioning it feels like admitting a mistake. Both of those are specific, and the second one points at a part of the control that has nothing to do with training content.
What it produces. Likely a completion report against the full population, including the people easy to leave off the list — founders, contractors, the person who joined last week. If you also hold the reports staff raised over the period, including the false alarms and how each one was answered, say so, because that is the closest thing in this control to an artefact about behaviour. If you do not hold it, say that too: it is the single most useful thing you could start collecting and it costs nothing.
Who notices when it stops. Be honest about the shape of this. Nobody is blocked by awareness training not happening. The failure is silent for a year and surfaces as a renewal date going past, which means the detector is almost always a calendar rather than a person — and a calendar notices the course not running, not the content having stopped being relevant.
The condition that would make you redesign it. The strongest version of this sentence is usually about reporting rather than content: if people are completing the course and not reporting anything, either nothing is happening or reporting is not safe here, and the second of those produces excellent statistics and silent incidents. That is a condition you can watch for, and naming it is what makes the rest of the defence sound like a decision.
It cannot tell you whether what you have is enough. Nobody on this page can know that: it moves with the firm, the boundary, the rest of your evidence and the year. What the four sentences do is make the shape of your position explicit — this is what the artefact shows, this is what it leaves open, this is what would change my mind — which is a position you can hold in a conversation without either overclaiming or apologising.
There is also a kind of doubt the four sentences do not answer, and it is worth recognising when it arrives. If the person opposite you does not believe the risk is real — that nobody at a company your size is going to be targeted by a convincing request on a Friday — then nothing about the control is in dispute and every sentence about its evidence misses the point. That is an argument about the risk register, held one track earlier, and trying to win it with control evidence is how these conversations go round twice.
Check
The instinct is to rehearse the strongest one, because it feels better and because that is the one with the best artefacts.
It is the wrong choice for two reasons. The strong controls defend themselves — a dated restore test with the problems listed needs no rhetoric, and practising on it teaches nothing except how to read out a date. And the weak one is the one that will actually be asked about, because weakness is legible from outside: a register with ten well-evidenced rows and one row whose only artefact is a completion figure is a register whose eleventh row is the obvious question.
Rehearsing the weak one also tends to change it. Three of the four sentences are usually fine; the one that stalls is the one about what it produces, and the fix is almost always a small artefact nobody was collecting — the reports staff raised, the tuning decisions and who made them, the exceptions and what happened to them. Those cost very little and they are the difference between a control you can describe and a control you can show.