If I inherit a programme with no documentation, where do I start?

Start

I have inherited a programme with little or nothing written down

Missing paper does not mean missing practice, and it does not mean the practice works. People describe what they believe is done. The pack's idea is to learn before you promise, find out what is real, decide who decides, and record where you started. Treat what you are told as a lead until you have seen proof.

• Then: Week 1: secure access, open incidents and dates, change nothing else

Step

Week 1: secure access, open incidents and dates, change nothing else

These cannot wait for discovery. Confirm the outgoing leader's accounts, administrator rights, tokens and vendor portals are removed, and check it against a fresh extract. List every open incident and reporting duty, and confirm who holds each incident role. List every deadline in the next 90 days. Change no policy, tool or team structure yet, except to stop harm, act on a legal duty or take a no-regret action.

• Then: Can the outgoing leader still be asked questions?

Decision

Can the outgoing leader still be asked questions?

They may be at work, serving notice or already gone. Whether you may ask for help after their last day depends on their contract and any leaving agreement. Legal and HR confirm that. If you do not know whether they can be reached, take the second branch and start from records.

• Yes: Ask them to complete the handover document, access first
• No, or not known: Build the handover from records and mark every gap

Step

Ask them to complete the handover document, access first

The handover document has twelve sections. In a small organisation the outgoing leader may be the only person who knows most of it, so ask for the access and accounts section first. Treat what they write as what they believed. It is not yet a finding. Where a section has nothing, it says None, with a date and who said so.

• Then: Has the sponsor confirmed in writing who decides what?

Step

Build the handover from records and mark every gap

Start in week 1 and do not wait for anyone. Look in the identity system and password manager for access, the incident log for incidents, the contracts and the sent mail of the outgoing leader for promises, and the supplier register and finance payments for suppliers. Mark each section as built from records, and write down what the records do not show. Ask the leader's manager and team for the rest.

• Then: Has the sponsor confirmed in writing who decides what?

Decision

Has the sponsor confirmed in writing who decides what?

With no documents, nobody may be sure who approves what. The pack's default is to agree the arrangement in writing with the executive sponsor within 10 working days, and to review it at days 30, 60 and 90. It gives no right that the packs which set each right do not give, and nobody approves what they own. Answer no if it is only understood.

• Yes: Interview every stakeholder group before judging anything
• No, or not known: Agree appointment, reporting line and decision rights in writing

Step

Agree appointment, reporting line and decision rights in writing

Ask the sponsor for a signed or emailed note of your appointment and authority, and agree for each kind of decision whether you own it, share it or escalate it in each 30-day window. In the first 30 days the default is to escalate policy, new risk acceptances, supplier decisions and spend. Incident decisions are the incident plan's and stay as they are. Spending and hiring limits are the organisation's own, so ask for them.

• Then: Interview every stakeholder group before judging anything

Step

Interview every stakeholder group before judging anything

People hold what paper does not. Hold an interview with each of the ten groups in the first four weeks, with the same four questions: expectations, worries, what has been promised, and who else to see. Record expectation, concern, commitment and follow-up for each, and commit to nothing you have not checked. Send each person a note of what you heard.

• Then: Go through ten areas and ask to see each one working

Step

Go through ten areas and ask to see each one working

Governance, risk, policy, access, vulnerabilities, incidents, suppliers, resilience, awareness and assurance. For each, ask for a record, a test or a system view. When nothing is written down, the system view and the test matter most: the identity system's account list, the scanner console, the backup console, a restore you watch. Start with the areas the interviews raised.

• Then: Did you see a record, a test or a system view of it?

Decision

Did you see a record, a test or a system view of it?

Seeing it is the test. A person telling you, or an old document claiming it, is not. If it was seen, compare it with what you were told or what the document says. If you have not been able to look yet, the answer is no, which is the more cautious branch.

• Yes, and it matches: Record it as Evidenced and leave it alone
• Yes, and it differs: Record it as Contradicted and find out why before telling anyone
• No, or not known: Record it as Described only, or Not found after asking by a date

Step

Record it as Evidenced and leave it alone

Seen and matching what you were told. Nothing needs fixing, and the absence of a policy document is not a reason to rewrite something that works. Note what you saw and when, because the finding is checked again after 6 months by default, or on a material change. An Evidenced finding is not a maturity level.

• Then: Does a finding put people, services or a legal duty at risk now?

Step

Record it as Contradicted and find out why before telling anyone

What you saw differs from what you were told. Check your own reading first, then ask the person who described it, without blame. Record what is found, not who is to blame. Judgement: a contradiction in access, incidents or a commitment to a regulator should reach the sponsor soon, and the rest can go into the first executive briefing, which closes discovery.

• Then: Does a finding put people, services or a legal duty at risk now?

Step

Record it as Described only, or Not found after asking by a date

Described only means you were told and have seen nothing. Not found means you asked for it, by a date, and nothing was produced or could be found. Both are gaps in proof, not proof that nothing is done. Judgement: with no documents, expect many of these, so ask by a stated date to separate the two.

• Then: Does a finding put people, services or a legal duty at risk now?

Decision

Does a finding put people, services or a legal duty at risk now?

Examples are live access of someone who has left, a backup that cannot restore a critical system, or a reporting duty with a running clock. Stopping harm, acting on a legal duty and no-regret actions are the only changes allowed before discovery ends. If you cannot tell, take the yes branch. Inherited exceptions and risk acceptances are reviewed within 30 days by default, by the approver the band sets.

• Yes, or not known: Act on that item now and tell the sponsor today
• No: Record the starting position in counts and words within 60 days

Outcome

Act on that item now and tell the sponsor today

Take the smallest action that stops the harm or meets the duty. Judgement: tell the executive sponsor the same day. Do not sign a statement to a regulator or auditor you have not checked. Incident decisions and reporting decisions stay with the incident plan's decision rights. Record what you did and why, then carry on with discovery.

Step

Record the starting position in counts and words within 60 days

Write down where the programme starts as counts, such as 4 of 10 areas looked at, and as levels in words, with Unknown and a reason where you cannot tell. There is no score, no percentage and no colour total. Date every value. In a year this is what lets you show what changed.

• Then: Is there a risk register with owners and review dates?

Decision

Is there a risk register with owners and review dates?

The register is the base for most later decisions, so check it early. If one exists, see whether two risks trace to a treatment action. If it is missing, out of date or you cannot tell, take the no branch.

• Yes: From week 8, write only the documents the findings support
• No, or not known: Start a register from the scenario library after the interviews

Step

Start a register from the scenario library after the interviews

Take scenarios that fit what the interviews and findings showed, not the whole library. Judgement: give each one an owner outside security where you can, as the library's own example does, and seed from the library because it is quicker than writing from nothing and avoids missing the usual risks.

• Then: From week 8, write only the documents the findings support

Step

From week 8, write only the documents the findings support

Documents come after findings, not before. Choose a profile of Core, Growing or Regulated to see which policies, standards and procedures an organisation like yours needs, then write the ones that fix a finding. By default in the pack, executive management approves a policy and the head of information security approves a standard or procedure. Who approves in your organisation depends on how it is governed, so confirm it with the sponsor.

• Then: Put a 100-day plan to the sponsor before promising anything

Outcome

Put a 100-day plan to the sponsor before promising anything

Every item traces to a finding, an interview record or a handover gap, and the plan lists what you dropped and why. Agree it in writing with the sponsor. Then take the plan, the reporting rhythm and the asks to the executives and the management body. A promise to a customer, auditor or regulator follows the plan, and never leads it.