The period that has to run continuously from now on

Your first window ran for twelve months and closed on 30 September. The report about it will be issued in the middle of November.

Between now and then, a buyer will ask for the current one. Then another buyer will ask the same thing in March, and a third in July. None of them wants to hear that the period is between runs.

So the second window opened on 1 October, which was yesterday, and nobody held a meeting about it.

Predict

Five annual controls went into the first report. In year one, all five were performed within a few weeks of each other, in the month the first window opened. When do they come due in year two?

Choose one answer

Spread across the year, as the calendar settles downAll five in the same month again, which is also the month fieldwork landsIn the month before the window closes, since that is the deadlineWhenever the owner schedules them, since annual is a loose requirement

Lock in answer

Below, work backwards from a report date to the day the window has to open. The remediation leg is set to zero, because in a continuous cycle there is no gap to put it in, and fieldwork is six weeks.

Window countdown

≈ Hypothetical model, not a forecast

Works backwards from a target report date to the day the observation window must already have opened, and the day work must have started for it to open on time. It answers when you must start, and it will never answer whether you are ready — no arrangement of dates can tell you that.

It assumes

• Today is 2 October 2026, declared rather than read off a clock.
• Fieldwork is six weeks, which is a plausible figure and not yours.
• There is no remediation leg, because a continuous cycle has nowhere to put one.
• Weekends, holidays and the December shutdown all count as ordinary days.
• The window is twelve calendar months, so its length in days depends on where it falls.

It ignores

• Whether the controls work, whether evidence exists, or whether anybody is ready — this is a calendar, and a date cannot answer any of those
• Scheduling reality: reviewer availability, fieldwork slipping, the report taking longer to write than to earn
• Weekends and holidays, which make every stretch here shorter in working days than it looks
• Whether a shorter window would be accepted, which is a negotiation and not arithmetic
• Evidence that has to be collected from before the window opens, which moves the start date earlier again
• The possibility of a window that has already opened, where the start date is in the past and the arithmetic says so without saying what to do about it

Your last window closed on 30 September 2026, so the next one has to open on 1 October 2026 with no gap at all. Fieldwork is six weeks and there is no remediation leg. Move the target report date until the window opens on exactly 1 October 2026.

Target report — year2,027

Target report — month6

Target report — day30

Day the window must open, numbered from 1970-01-01

20,592

Window opens — year

2,026

Window opens — month

5

Window opens — day

19

Days from today until the window must open

-136

Work must start by — year

2,026

Work must start by — month

5

Work must start by — day

19

Days from today until work must start

-136

Days by which that start date has already passed

136

The start date needed for this target is in the past

1

Length of the window in days, as the calendar falls

365

Days from the start date to the report date

407

• Days from today until the window must open
• Length of that window, in days

◷ Not there yet — keep moving the controls.

What the dates say

A report dated 12 November 2027 needs a window from 1 October 2026 to 1 October 2027. Today is the second of October, so that window opened the day before yesterday and the figure the model reports is negative by one day.

Nothing is wrong. That is the normal state of a second year: the period you will be examined on is already running, and the only question is whether the controls inside it are running too.

Watch what the two lines do as the window gets longer. Ask for a one-month window and the opening date is nearly a year away, which feels comfortable and produces a document almost no buyer wants. Ask for the twelve months buyers do want and the opening date is behind you. There is no setting on that chart where a twelve-month window and a comfortable start date coexist, and that is not a planning failure — it is what continuous means.

›Why the remediation leg cannot come backOptional

In year one the sequence is: fix things, then open the window, then collect evidence of the fixed things working.

In year two the window is already open. So a control you redesign in February produces February-to-September evidence inside a window that started in October, and the four months before the redesign are still in the period and still get asked about.

That is not a reason to avoid redesigning controls — a control that needs redesigning is worse than a design change mid-period. It is a reason to say so in writing when you do it, with the date, rather than letting the artefact trail start abruptly in February with no explanation attached. The engine's view of this is the same as a reviewer's: an artefact that does not reach back to the start of your window leaves the earlier part of the window spoken for by nothing.

The month where four things land at once

Here is a composite second-year calendar, built from the ordinary case rather than from a disaster.

• October 2026. Fieldwork for the first report is under way; four of the eleven controls are being sampled and three people are answering questions.
• Also October 2026. The restore test, the leadership review, the refresh of what people are told to do about suspicious email, and the annual re-approval of the policy set all come due, because all four were performed in October 2025 to get them inside the first window.

Four annual controls and a fieldwork week, in one month, owned by substantially the same three people. This is the collision, and it recurs every October for as long as nothing moves.

The fix is a one-off and it only runs in one direction. You can pull an annual control forward — run the restore test in July instead of October, eleven months after the last one — and the only cost is doing it slightly sooner than you had to. You cannot push one back, because thirteen months between instances means there exists a twelve-month window containing none of them, and that window is the one somebody will ask about.

So staggering is paid for once, in early work, and it buys a flatter year for ever. It is the single highest-value hour of scheduling in a second year and it appears on nobody's plan, because in year one the cluster was the project succeeding.

Check

You decide to accept a gap: let the first report go stale for three months, then open a fresh twelve-month window. What have you actually traded?

Choose one answer

Hours, in exchange for a later deadlineCredibility, in exchange for nothing measurableCoverage, in exchange for a cheaper auditNothing, as long as the letter covering the gap is signed

Check answer

Worth remembering

• The next window opens the day the last one closes, so a second year has no remediation leg.
• A twelve-month window reaching a near-term report date has an opening date already in the past.
• An annual control comes due twelve months after its last instance, not at the end of the window.
• Annual controls done together in the first push stay clustered for ever unless somebody moves one.
• Staggering works only forwards: pulling a control earlier is free, pushing it later creates an empty window.
• Accepting a gap costs credibility rather than hours, because the controls run at the same cost regardless.