What you would tell the person who inherits this

You are leaving in three weeks. The handover meeting is an hour, on a Thursday, and the person taking this over has a full job already.

They will inherit eleven policies, a register, an evidence folder and a certificate. None of that is the thing you need to tell them.

What you need to tell them is six facts about how this actually runs here, every one of which is currently stored in your head, and every one of which is the reason the second year goes better for you than it will for them.

Predict

Of everything one person knows about a compliance programme, which part is least likely to survive their departure?

Choose one answer

The policies and the registerWhich controls describe what the company already did, and which ones changed behaviourWhere the evidence is storedThe relationship with the auditor

Lock in answer

The six

One. Where the evidence actually is, including the two places it is not. The quarterly review exports are in a folder owned by a personal account rather than the team; they vanish when the account is deprovisioned. The pipeline logs roll off after ninety days, so the first quarter's are gone unless somebody pulled them, and somebody did, into a different folder, as a one-off.

Two. Which controls describe what the company already did. Of eleven, three were written to describe existing practice, two asked people to work differently, and six fell somewhere between. The three are robust and need almost no attention. The two will drift back towards the old behaviour within about two quarters unless somebody holds them, and knowing which two is worth more than any policy on the list.

Three. Which quarter is thin, and why. Last August the reviewer was on leave and the review happened three weeks late. It is inside the period, it is late, and there is a note about it. A sample is as likely to land on that instance as any other, so the next person should know before they are asked rather than after.

Four. Who actually does the work, as against whose name is in the field. The owner field says the head of engineering. The person who assembles the list every quarter is a specific engineer who has never been told they are part of a control, and who will be surprised to be asked about it in a walkthrough.

Five. Which supplier answer is softer than it reads. One of the companies inside your boundary carves out their own hosting provider, so their report does not cover the layer most of your risk lives in. Another answered a questionnaire with text written by their sales team. Both answers are on file and both are thinner than the file suggests.

Six. What you promised one specific customer that is in no policy. A notification commitment in a contract signed eighteen months ago. A statement about where data is stored, made in an email during a procurement conversation. Those are controls with owners and cadences and no rows, and the only person who knows they exist is the person who was in the meeting.

Something people say

“It is all documented, so the handover is a question of reading the documents.”

Why it spreads

It is the literal truth about the artefacts, and the artefacts are the only part of the programme that is visible to anybody above the person running it. A folder with eleven policies in it looks complete, and in the only sense that can be inspected from outside, it is.

The part that is true

The documents really do contain what is supposed to happen, and a new person really can get to a working understanding of the design from them in a week. Nothing here is an argument for fewer documents.

Why can the six facts not go into the policies?

Because they are confidentialBecause a policy is written to be durable and these facts are notBecause auditors do not want that level of detailBecause they are opinions rather than facts

Where it goes

One file, with a date at the top, written to a person rather than to a reader. Six headings and a paragraph under each. Rewritten, not amended, once a year — because an amended one accumulates the same problem the policies have, which is that nothing in it tells you which parts are still true.

Two honest limitations. It goes stale, like everything else here, and the fix is the date at the top rather than a promise to maintain it. And it is an inventory of where you are weakest, in one short document, which is the point track 2 made about the register and applies with more force to this: it lives wherever the register lives, under the same access, and not in a shared drive called Handover.

Check

You have written the six. Which one should the next person read first, and on their first day rather than their first month?

Choose one answer

The thin quarter, because it is the thing most likely to be asked aboutThe two controls that asked people to change how they workWhere the evidence actually livesThe customer promise that is in no policy

Check answer

Worth remembering

• Everything that is a file survives a departure; every judgement about the files leaves.
• A policy is written for a competent stranger, so it has no slot for facts about this company.
• The six: where evidence really is, which controls changed behaviour, the thin quarter, who does the work, which supplier answer is soft, and the promise in no policy.
• Controls that described existing practice hold; controls that asked people to work differently revert.
• The owner field and the person who does the work are different people more often than not.
• Contractual commitments are controls with owners and cadences and usually no row in the register.
• The handover letter is dated, rewritten rather than amended, and kept where the register is kept.