How do I plan the first year of recurring reviews, reports and renewals?

Start

A year of reviews, reports and renewals starts with your role

A new leader inherits dates that other people set: the board meets, auditors visit, contracts renew. The aim is one calendar for the first twelve months that shows what falls due and who owns it. The pack's calendar holds 24 recurring items in six areas: People, Risk, Controls, Incidents, Suppliers and Reporting. It schedules work that other documents set and changes none of their intervals.

• Then: Enter your start date and read off month 1

Step

Enter your start date and read off month 1

Count everything from your first day in the role. Month 1 is the calendar month that day falls in, whichever day of the month you start, so month 1 is not January unless you start then. The workbook dates the day 30, 60 and 90 reviews, the start of week 13 and day 100 from it.

• Then: Is it before week 13, when the calendar is set?

Decision

Is it before week 13, when the calendar is set?

The pack sets the full calendar in week 13, which begins on day 85. Some items fall due earlier: in the pack's standard timings, 19 of the 86 occurrences in the year fall in months 1 to 3. Yes, or not sure, means you cannot wait for the calendar before acting on the nearest dates.

• Yes, or not sure: Run the nearest dates first: reports, exceptions, renewals
• No: Do you hold every fixed date from the handover and board secretary?

Step

Run the nearest dates first: reports, exceptions, renewals

Judgement, not a pack rule: before the calendar exists, start with what falls due in months 1 to 3 in the standard timings. Month 1 alone holds the monthly metrics and executive report, the monthly review of open exceptions and acceptances, the closed-incident review check and the supplier renewal check, and later months add more. Take their dates from the handover and the people who run them, and enter them properly in week 13.

• Then: Do you hold every fixed date from the handover and board secretary?

Decision

Do you hold every fixed date from the handover and board secretary?

A fixed date is one you cannot move: a board meeting, an audit window, a renewal, a regulator's date. The handover lists the dates due in the next 90 days, and the plan lists work moved past day 100, which comes to this calendar. The board secretary gives the board dates. Auditors and suppliers give theirs. If you are not sure the list is complete, answer no.

• Yes: Enter the dates you cannot move, each with its item
• No, or not known: Ask for the missing dates

Step

Ask for the missing dates

Ask the board secretary for the year's meeting dates and the paper format, the auditors for their windows, and each critical supplier for its renewal and notice dates. A date with no source is a guess, so note where each one came from. Do not enter a date you have not confirmed.

• Then: Enter the dates you cannot move, each with its item

Step

Enter the dates you cannot move, each with its item

Put each fixed date on the Fixed Dates sheet with the calendar item it belongs to. The sheet says whether the date falls in a month in which that item is due. A date that is not a recurring item, such as the first executive briefing, names no item.

• Then: Start from the 24 standard items in six areas

Step

Start from the 24 standard items in six areas

Each item names the document or rule that sets its interval and the month it first falls in. Those are the defaults of the earlier packs, which your own standard may change. Where one document sets two intervals, as access review does for privileged accounts, critical systems and all other systems, the calendar carries one item for each.

• Then: Does a regulator, auditor or contract set dates of its own?

Decision

Does a regulator, auditor or contract set dates of its own?

Yes, or not known, means more rows. A regulated organisation adds a row for each date a regulator, supervisor, auditor or customer contract sets. Counsel confirms whether a date binds you and whether you are an essential or an important entity under NIS2. Incident notification clocks stay out of the calendar: they belong to the incident documents.

• Yes, or not known: Add a row for each, with its date and its source
• No: Does a fixed date fall outside the month its item is due?

Step

Add a row for each, with its date and its source

The workbook has ten blank rows under the standard items. Give each an ID of your own, its area, what happens, the document or rule that sets it, the interval and the first month. Keep all six areas covered.

• Then: Does a fixed date fall outside the month its item is due?

Decision

Does a fixed date fall outside the month its item is due?

Check each fixed date against its item. If the item falls due in months 2, 5, 8 and 11 and the audit is in month 6, the row cannot stay as it is. The default timing already works, so change a month only where a date outside your control requires it.

• Yes: Move the first month inside its interval, and say why
• No: Can your team run every item at its interval?

Step

Move the first month inside its interval, and say why

First month is a whole number from 1 up to the interval, so an item that runs every 3 months can start in month 1, 2 or 3. Never change the interval. Write the reason in the item's Notes: a moved item without one fails a check.

• Then: Can your team run every item at its interval?

Decision

Can your team run every item at its interval?

A small team may not manage every item as often as its source asks. No, or not known, is the cautious answer. The interval belongs to the document that sets it, so a change goes through that document's own approval and not through the calendar. Keep the row either way.

• Yes: Does every item have an owner, named by post?
• No, or not known: Keep the row, note the gap, and take the change to its source

Step

Keep the row, note the gap, and take the change to its source

Write in the item's Notes that you cannot run it at its interval. Raise the change through the document that sets the interval, such as the access review standard or the supplier policy, with the approver it names. Do not delete the row or stretch the interval yourself. Until it is approved, the stated interval stands.

• Then: Does every item have an owner, named by post?

Decision

Does every item have an owner, named by post?

The owner is the post that sees that the item is done. One person may own many items, and in a small team that person is often you. An item with no owner is an item nobody will do, and a placeholder does not count. No, or not known, sends you to name one.

• Yes: Does any month carry far more items than its neighbours?
• No, or not known: Name a post for each unowned item

Step

Name a post for each unowned item

Name a post, the role that sees that the item is done. Where a managed service provider runs an item, such as an access review or a recovery test, the item stays under your owner. Note the provider and the date it delivers: its report is evidence for your review, not a replacement for it.

• Then: Does any month carry far more items than its neighbours?

Decision

Does any month carry far more items than its neighbours?

Judgement on how much is too much: the pack gives the busiest and quietest month, not a limit. In its standard timings the busiest is month 12 with 9 items and the quietest is month 1 with 5. A count is not a score: a busier month is not a worse one. If one month is more than your people can carry, spread it.

• Yes: Spread the crowded month within each item's interval
• No: Do all eight checks read Clear or Nothing to check?

Step

Spread the crowded month within each item's interval

Move an item's first month within its interval, never past it, and write the reason in the Notes. Judgement: leave the monthly and quarterly reports where their audiences expect them, and move annual items first, as they have the most room. The repeat of the baseline stays in month 12, because a check looks for it there.

• Then: Do all eight checks read Clear or Nothing to check?

Decision

Do all eight checks read Clear or Nothing to check?

The Checks sheet looks at the start date, the timing of each item, owners, sources, reasons for moves, area coverage, fixed dates and the month-12 baseline repeat. Settle every Action needed before you show the calendar to anyone. A count of open checks is work left, not a score.

• Yes: Have you taken the calendar to your executive sponsor?
• No, or not known: Settle each open check, then read the sheet again

Step

Settle each open check, then read the sheet again

Fix the cause in the workbook: name the owner, add the source, give the reason for a move, or enter the date. Do not edit a check to make it pass. Read the Checks sheet again once the cause is fixed.

• Then: Do all eight checks read Clear or Nothing to check? (back to an earlier step)

Decision

Have you taken the calendar to your executive sponsor?

Take it to the executive sponsor, who speaks for you to the management body, once the checks are settled. The quarterly report is the item that goes to the management body. Reports follow Position, Direction, Exposure and Ask, and metrics reach each audience at its own cadence: monthly for the leadership teams, quarterly for the board report. Whether your sponsor changes the calendar is theirs and yours to settle; the intervals stay with the documents that set them.

• Yes: Calendar with your sponsor: work each month, review at the anniversary
• No, or not known: Settle each open check, then read the sheet again

Outcome

Calendar with your sponsor: work each month, review at the anniversary

Work the items due each month and keep each version of the calendar with the plan for the P22 records period, 3 years by default, or longer where a contract or law asks. At the first anniversary review the calendar with the baseline, and repeat the baseline in month 12 to compare with the first. Doing an item on its date does not show that it works: the document each item names does the testing and reviewing.