How do I brief the executives at the end of discovery?

Start

Discovery is ending and the executives expect a briefing

The pack's first executive briefing comes at the end of discovery, which in its defaults is the close of week 7. It reports what you found. It is neither an audit nor yet a plan. It has four parts: the findings in four words, the top risks, the starting position and the asks.

• Then: Must something reach the executives before discovery ends?

Decision

Must something reach the executives before discovery ends?

The pack says to change nothing until discovery ends, except to stop harm, to act on a legal duty or to take a no-regret action. Judgement: only those cases justify telling the executives early. If you cannot tell whether a finding is that serious, answer yes and tell the sponsor.

• Yes, or not known: Tell the sponsor now, act only to stop harm, then brief as planned
• No: Close discovery and count the findings in the four words

Outcome

Tell the sponsor now, act only to stop harm, then brief as planned

Take the finding to its owner and to the executive sponsor at once, and do only the action that stops the harm or meets the duty. The discovery workbook says a contradiction that is a live risk goes to its owner now. Make no wider change and no promise. The full briefing still follows at the end of discovery, with everything else you have found.

Step

Close discovery and count the findings in the four words

Count items as Evidenced, Described only, Not found or Contradicted, and list every contradiction. Show counts such as 14 of 20 looked at, never a score. An item you have not yet looked at stays as not yet looked at. Do not guess a finding to fill the table.

• Then: Does every finding state what you saw: a record, test or system view?

Decision

Does every finding state what you saw: a record, test or system view?

A statement alone is Described only, however senior the person who made it. Executives will act on what you show them, so separate what you were told from what you saw before you present. If a finding rests on a document you have not checked, or you are unsure, answer no.

• Yes: Has each owner heard their Contradicted and Not found items first?
• No, or not known: Get the proof, or present the item as Described only

Step

Get the proof, or present the item as Described only

Go back for the record, the test or the system view. If you cannot get it before the briefing, present the item as Described only and say what proof would settle it. A shorter list that holds up serves you better than a long one that does not.

• Then: Has each owner heard their Contradicted and Not found items first?

Decision

Has each owner heard their Contradicted and Not found items first?

Judgement: tell the owner of a Contradicted or Not found item what you found before it goes into a briefing, so that nobody learns of it in the meeting. The pack asks for this only where the contradiction is a live risk, which goes to its owner now. If you have not spoken to the owner, or you are unsure, answer no.

• Yes: Pull together the risks, past-review items, open duties and baseline
• No, or not known: Tell those owners now, and change a finding only on new evidence

Step

Tell those owners now, and change a finding only on new evidence

A short private conversation or note is enough. Record what you find, not who is to blame. Judgement: if the owner shows you a record, update the finding. If they only disagree, keep the finding and say on the slide that the owner disputes it.

• Then: Pull together the risks, past-review items, open duties and baseline

Step

Pull together the risks, past-review items, open duties and baseline

Take the few risks the findings support from the risk register, each with its owner and band. Add how many inherited exceptions and risk acceptances are past review, the open incidents and promises with dates, and the baseline in counts and levels in words, with each unknown and its reason. Never total the baseline.

• Then: Write each ask as a decision with options, a recommendation and cost

Step

Write each ask as a decision with options, a recommendation and cost

Each ask states the decision, why now, at least two options, your recommendation, the cost and the risk of not deciding. The pack's usual asks cover the decision-rights arrangement and sponsor, the few priorities, owners for acceptances past review, the reporting rhythm, who briefs the management body, and a date for the budget conversation.

• Then: Does an ask need money, a date or a result you cannot yet keep?

Decision

Does an ask need money, a date or a result you cannot yet keep?

The pack says to promise nothing until the plan is agreed, and its briefing asks for no money. It asks the executives to set a date for the budget conversation instead. If you are unsure whether you can keep a commitment, answer yes.

• Yes, or not known: Turn it into a decision on priorities or a date for the budget talk
• No: Does an ask accept a risk or renew an exception?

Step

Turn it into a decision on priorities or a date for the budget talk

Replace the commitment with a decision the executives can take now: agree the priorities, agree what the programme will stop or leave for now, or agree a date for the budget conversation. State the cost of the ask as none where it is none, and show the risk of waiting. The plan and any outside promise follow once the plan is agreed.

• Then: Does an ask accept a risk or renew an exception?

Decision

Does an ask accept a risk or renew an exception?

Such a decision goes to the approver the band sets, and nobody approves what they own or requested. An exception goes to the approver for its band. A risk acceptance goes to the approver for the band of the residual risk, and outside tolerance only the board or its equivalent decides. If you cannot tell the band, answer yes.

• Yes, or not known: Address each such ask to its approver and name the role on the slide
• No: Fit the deck to the audience and plan the time around the asks

Step

Address each such ask to its approver and name the role on the slide

Approvers depend on how the organisation is governed: the board or a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board. The decision-rights matrix asks the executive sponsor to take such a decision on to its approver. You do not approve what you own. The pack's default is that you accept no new risk in the first 30 days.

• Then: Fit the deck to the audience and plan the time around the asks

Step

Fit the deck to the audience and plan the time around the asks

The deck suggests a slot split that keeps one third of the time for the decisions. In a small organisation, present to the owners or the management team and keep only the deck's minimum slides, cutting the rest to a line each. Settle each cost with finance and each legal point with counsel before the meeting, as BR-06 asks for who has agreed.

• Then: Agree with the sponsor who tells the management body, and when

Step

Agree with the sponsor who tells the management body, and when

This briefing does not replace telling the management body. The pack's default is that, within 60 days of the start, the sponsor tells it what NIS2 Article 20 asks of it: to approve the measures, oversee their implementation and follow training, and that it can be held liable. Counsel confirms what liability means.

• Then: Hold the briefing and write down each answer as it is given

Step

Hold the briefing and write down each answer as it is given

Present the findings briefly and spend most of the time on the asks. Record each ask with the answer, the owner and the date. If an executive makes a new request, note it as Noted, not committed, until you have checked that you can keep it.

• Then: What did the executives decide on each ask?

Decision

What did the executives decide on each ask?

Take each ask separately. Agreed as put, agreed with changes, deferred and declined each leave a different task. A deferral is itself a decision, so record until when and what stays true in the meantime.

• Agreed as put: Record the answers, then draft the plan from them
• Agreed with changes, or deferred: Bring it back with the changes or a date, and keep the risk visible
• Declined: Record the refusal and take the risk to its approver

Outcome

Record the answers, then draft the plan from them

Keep the decisions and who gave them. Draft the hundred-day plan from the findings and the agreed priorities, tracing every item to a finding, an interview record or a handover gap. Tell the groups you interviewed what you heard, and promise nothing new.

Outcome

Bring it back with the changes or a date, and keep the risk visible

Judgement: where the executives agreed with changes, return the amended ask at the next meeting. Where they deferred, record the date and the risk that stays in place until then. A deferral then shows as a choice rather than a quiet default.

Outcome

Record the refusal and take the risk to its approver

Write down what was declined, by whom and what stays true. A risk that stays outside tolerance goes to the approver the band sets, the board or its equivalent where the rules say so. Do not work around the refusal, and do not accept a risk you own.