Policy Experts / Assessment

Responding to a finding without making it worse

The reflex is to write another document.

A finding arrives and the response is drafted quickly, usually promising a new or revised policy, additional training, and an increased review frequency. All three are cheap to promise, all three appear responsive, and none of them necessarily addresses the cause. The organisation now carries three additional commitments that will themselves be assessed.

A response that holds up identifies why the control failed. Did the document not exist, did it exist and not describe the situation, did people not know about it, or did they know and not follow it because following it was impractical. Those four causes require entirely different remedies and only the first is fixed by writing something.

The fourth is the most common and the least often named, because naming it means saying that the requirement was not achievable, which sounds like an excuse. It is usually the truth, and a response that changes the requirement to something achievable is more credible than one promising harder compliance with the same rule.

Whatever is promised will be checked. A commitment to review quarterly creates four checkable events a year, and an organisation that misses one has converted a closed finding into an open one.

It is also worth distinguishing between a finding about a document and a finding about practice, because organisations conflate them and respond to both by revising the document. A finding that practice departed from the policy can be closed by changing either one, and choosing which requires deciding whether the practice was wrong or the requirement was. That is a substantive decision and it is usually made by default.