The bundle you could hand over tomorrow morning

Tomorrow morning, nine o'clock, somebody wants the bundle.

Not the bundle you could put together by the end of the month. Not the one that exists once two people spend a week in the shared drive. The one that exists when you wake up, assembled from what is already in systems you can reach, with nothing written specially and nothing chased.

That bundle is smaller than the one in your head, and it is the only one that is real. This lesson is about laying it out.

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

What you could hand over

Only what already exists, with a date on it. A policy is real evidence of design and no evidence at all of operation, which is why that is the second question.

What does it show?

It is designedIt ran

How often?onceon-changemonthlyquarterlyannualcontinuous

Most recent one

Add it

What does not line up

Where tomorrow morning is thinner than you expected

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

What does not line up

And which controls have nothing to send with them

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

Lay it out by what it shows, not by control number

The instinct is to organise the bundle the way the register is organised: one section per control, in order. It reads badly, for a reason worth understanding.

A reader works through a bundle asking two different questions, and they ask them in order. Was this control set up deliberately, by someone who thought about it? And did it then happen, through the period, with artefacts to show it? Organising by control interleaves the two questions eleven times and makes the reader do the sorting.

So: three sections.

What shows the design. Policies, settings exports, diagrams, approvals of the approach. This section is nearly always complete, because everything in it can be produced on demand. Say so — a bundle that quietly presents a full design section as though it were the hard half is making a claim it has not earned.

What shows it ran. Reviews with names and dates. Tickets with approvers. Logs, exports, restore records. Sorted by control, each with the date of the most recent instance and the number held against the number the cadence expects. This is the section somebody is actually reading.

The holes. Named, as holes.

A hole labelled as a hole is a different object

This is the whole lesson, and it is one sentence long: in progress and we have nothing for this are two different statements, and only one of them is true tomorrow morning.

A hole described as in progress invites a follow-up question — how far, by when, who is doing it — that you will answer in the next email and that will produce a second round. A hole described as a hole invites a different question, about what you plan to do, which is the conversation you wanted anyway.

Four things make the difference, and each of them is one line.

• What the control is and that it is not evidenced. Plainly. Not evidence being collected.
• Whether the gap is in the design or the operation. A control with no written design and a year of records is in a completely different position from a policy with nothing behind it, and a reader cannot tell which you mean from the word gap.
• When the artefact starts existing. Not when the work finishes — the date from which the by-product will exist. Those are rarely the same date and the second one is the one that matters.
• What covers the period before that date. Often the honest answer is nothing, and saying it is better than leaving the reader to work it out from the dates.

Check

Which way of describing a hole is the strongest tomorrow morning?

Choose one answer

Restore testing: evidence collection in progressRestore testing: policy exists, no test performed, first one bookedRestore testing: covered by our backup monitoring dashboardLeave restore testing out and send the ten controls that are covered

Check answer

The part of the bundle that lives in one person's head

There is a hole the layout above cannot show, and it is usually the largest.

Somebody knows which system holds the review records, which query produces the right export, which of the three similarly named drives is current, and that the pipeline logs beyond ninety days live in an archive bucket with a different access path. None of that is written anywhere. All of it is load-bearing.

Test it the way you would test a backup: have somebody else assemble the bundle. Not reorganise it, not review it — go and get it, from the list, with the person who normally does it unavailable. The result is usually two-thirds of a bundle and a list of four questions, and those four questions are the undocumented part, named for the first time.

That is a cheaper experiment than it sounds and it is the only way the gap becomes visible, because the person who holds the knowledge cannot see that they hold it.

›Why tomorrow morning is the right deadline to useOptional

The three-week bundle is not a lie. Given three weeks, most of those artefacts really would exist, and the work to produce them is real work that would genuinely improve the position.

The problem is that the three-week bundle is unfalsifiable. Every hole in it has a plan attached, every plan is plausible, and nothing in the exercise forces a distinction between a hole that closes by somebody running an export and a hole that closes only if a control starts happening. Both look like two weeks of effort on a plan.

Tomorrow morning is an arbitrary deadline chosen because it cannot be gamed. Under it, the export takes ten minutes and the control that has never run cannot be made to have run, so the two sort themselves into different piles without anybody having to be honest about which pile a thing belongs in. It is the cheapest available way to tell the two kinds of gap apart, and it is the distinction that decides where the next month of work goes.

Worth remembering

• The only real bundle is the one that exists tomorrow morning with nothing written specially and nothing chased.
• Organise by what the evidence shows rather than by control number, because a reader asks about design and operation in that order.
• The design section is nearly always complete, because everything in it can be produced on demand — and saying so is part of being accurate.
• In progress and we have nothing for this are different statements, and only one of them is true tomorrow morning.
• A described hole needs four lines: which control, which half is missing, the date the artefact starts existing, and what covers the period before it.
• A gap you name is bounded; a gap somebody finds by subtraction is not.
• Have somebody else assemble the bundle from the list — the questions they come back with are the part that lives in one person's head.
• Tomorrow morning is the deadline that cannot be gamed, which is how a missing export and a control that never ran end up in different piles.