How do I find out what an inherited security programme really does, as opposed to what it claims?

Start

You inherit a programme that others describe to you

Every description of an inherited programme is a claim until you have seen something that backs it. Some of it is real, some is written down and not done, and some is a hope. Your first job is to tell these apart before you build on any of it or promise anything.

• Then: Read and listen for three weeks and change nothing

Step

Read and listen for three weeks and change nothing

Meet people and read what exists: the last board report, the risk register, the exception register and the last audit report. Change no policy, tool, structure or priority until discovery ends at the close of week 7. The only exceptions are stopping harm, acting on a legal duty and no-regret actions. The default rule is TR-01.

• Then: Did the outgoing leader leave a handover document?

Decision

Did the outgoing leader leave a handover document?

A handover document is what the outgoing leader believed, so it is a source of claims and not a record of the facts. Where there is none, you build the picture from records and write down what is missing. That route has its own flow.

• Yes: Read the handover as a list of claims, not as facts
• No, or not known: Build the list of claims from records and mark the gaps

Step

Build the list of claims from records and mark the gaps

Take the risk and exception registers, the incident log, correspondence with customers, auditors and regulators, the supplier register and the account lists. Each states something the programme is said to do. Write down what you cannot find, and who you asked for it.

• Then: Work through the ten discovery areas, two items each

Step

Read the handover as a list of claims, not as facts

Mark every statement in it that you can check: a role, an approval, a test, a supplier assessment. Treat each as something to look at, not something to rely on. Do not criticise the author in front of others. Record what you find, not who is to blame (NE-7).

• Then: Work through the ten discovery areas, two items each

Step

Work through the ten discovery areas, two items each

The areas are governance, risk, policy, access, vulnerabilities, incidents, suppliers, resilience, awareness and assurance. Each has two items to find out and a published document to read first. Start with the areas your interviews raised. Without a team, take the lightest proof for each: one test is worth more than three statements.

• Then: For one item, ask for the proof, not for an answer

Step

For one item, ask for the proof, not for an answer

Proof is a record, a test result or a system view. For access, that is an extract of active accounts compared with the HR leaver list. For backups, it is a restore you watch. Ask for it by a date you set. An assurance from the person who runs the control is not proof. Where a supplier runs the control, ask for the supplier's own evidence.

• Then: Was proof shown or found by the date you set?

Decision

Was proof shown or found by the date you set?

A date turns silence into a finding. If nothing was produced and you can find nothing yourself, that is a result worth recording. If you find the proof yourself, answer Yes. The pack sets no default length for the wait, so choose a date that fits the item and tell the owner what it is. Judgement: keep it short enough to finish discovery by week 7.

• No, or not known: Record it as Not found
• Yes: Did it show the work is done, not only that it is claimed?

Decision

Did it show the work is done, not only that it is claimed?

A policy, a plan or a description shows what is meant to happen. It does not show that it happens. A record, a test result or a system view does. In the evidence words of the maturity pack, a statement alone is Told, and something shown that says what the practice needs is Seen. If you cannot tell, take the cautious answer.

• No, or not known: Record it as Described only, and keep asking
• Yes: Does what you saw match what you were told?

Decision

Does what you saw match what you were told?

Compare the proof with the claim. A matching record is Evidenced. A difference of any size is Contradicted, such as eleven leaver accounts still active where the claim was that leavers are removed in the window. That figure comes from the pack's worked example and is not a benchmark.

• Yes: Record it as Evidenced, with what you saw
• No: Record it as Contradicted, with both versions

Step

Record it as Not found

You asked, by a date, and nothing was produced and nothing could be found. This is a finding about the programme. It is no judgement of the person you asked. Name the follow-up: an action, or an item for the 100-day plan. A plan item must trace to a finding, an interview or a handover gap (TR-14).

• Then: Enter the finding, what you saw and the date you looked

Step

Record it as Described only, and keep asking

Described only means you were told, or a document claims it, and you have seen nothing that shows it is done. It is not a finding of failure, and it is not yet a finding of success. It is checked again after six months by default, or on a material change (TR-02). Never promise anything that rests on it.

• Then: Enter the finding, what you saw and the date you looked

Step

Record it as Evidenced, with what you saw

Write what you saw and the date you looked, so that someone else can find it again. Evidenced describes one item. It is not a maturity level, which is set by the maturity method from a sample of records. Do not add the findings into a score.

• Then: Enter the finding, what you saw and the date you looked

Step

Record it as Contradicted, with both versions

State what you were told and what you saw side by side, without blame. Counsel confirms what a finding means for any duty to notify a regulator, so ask Legal before you write one that touches such a duty. Keep the evidence with the finding.

• Then: Is it a live risk, such as a leaver's account still active?

Decision

Is it a live risk, such as a leaver's account still active?

Discovery does not stop harm from continuing. A contradiction that is a live exposure goes to its owner now, which TR-01 allows. Anything else waits for the findings and the plan. Judgement: if you cannot tell whether it is live, treat it as live.

• Yes, or not known: Send it to the owner today and ask for the fix
• No: Enter the finding, what you saw and the date you looked

Step

Send it to the owner today and ask for the fix

Name the system, the account or the record, give the owner the evidence and ask for a date. Taking a no-regret action early does not break the rule of learning first. Agree who decides first if the owner is unclear, using the decision-rights arrangement.

• Then: Enter the finding, what you saw and the date you looked

Step

Enter the finding, what you saw and the date you looked

Every finding states what was seen. Leave an item blank until you have looked: a blank means Not yet looked at, which is not a finding. For Not found and Contradicted, name the follow-up in the same row.

• Then: Are items left to look at, and is it before the end of week 7?

Decision

Are items left to look at, and is it before the end of week 7?

Discovery closes at the end of week 7. Items you cannot look at by then stay Not yet looked at, with a reason, and you say so when you record the baseline. Unknown is a result.

• Yes: For one item, ask for the proof, not for an answer (back to an earlier step)
• No: Close discovery and count the findings in four words

Outcome

Close discovery and count the findings in four words

Count items in each of the four words and list the contradictions and the items not looked at. A count looks like 14 of 20 items looked at: 6 Evidenced, 5 Described only, 2 Not found, 1 Contradicted. Do not add it into a score. Take the counts to the first executive briefing and let the plan follow them.