When can we close an improvement action, and when do we re-assess?

Start

An action may be done, or something may call for a re-assessment

An action passes through five states: Open, In progress, Ready for re-assessment, then Closed or Not achieved. Closing is about the level, not the work. A re-assessment is also due on a fixed cycle and after certain events, whatever the actions say.

• Then: What has happened?

Decision

What has happened?

Three things start a re-assessment: an owner says an action's work is done; an event touches a domain; or the cycle since the last full assessment is running out.

• An owner says the work is done: Owner marks it Ready for re-assessment, with the evidence
• An incident, major change or new obligation: Re-assess the domains it touches now, not at the cycle
• The yearly cycle is running out: Run a full assessment within twelve months of the last

Outcome

Re-assess the domains it touches now, not at the cycle

A significant incident that a practice should have prevented or limited, a major change such as a merger, a new platform or moving IT to a provider, or a new obligation such as a new law in scope or a customer contract. Re-assess the domains it touches. For a new obligation, review the domain's target too.

Outcome

Run a full assessment within twelve months of the last

In the pack's default, the next full assessment's fieldwork ends within twelve months of the last one's, and it is planned when the approver approves this one's plan. If it will slip, tell the sponsor. Its results replace the levels now, and the next plan starts from them.

Step

Owner marks it Ready for re-assessment, with the evidence

Ready means the owner says the work is done and the evidence is ready. It is not closed: the level has not been checked yet. The owner names a re-assessor with the assessment lead.

• Then: Can someone other than the owner re-assess it?

Decision

Can someone other than the owner re-assess it?

The re-assessor must not own the action or run the practice: closing your own action is auditing your own work. Try a colleague from another function, a swap between people or teams, a reciprocal assessor from a peer organisation, then a contracted assessor. If no one is lined up, take the cautious branch.

• Yes: Does it aim for Managed within six months of reaching Defined?
• No, or not known: Do not close it: it stays Ready until someone independent checks

Outcome

Do not close it: it stays Ready until someone independent checks

An owner's own check is self-assessed and capped at Defined. The action stays at Ready for re-assessment until someone independent checks it. Raise it with the sponsor if no one can be found.

Decision

Does it aim for Managed within six months of reaching Defined?

Managed can be claimed only after the practice has run at Defined, with records, for at least six months in the pack's default. If you do not know when it reached Defined, take the cautious branch.

• Yes, or not known: Too early: re-assess once the six months have run
• No: Re-assess on records made since the action started

Outcome

Too early: re-assess once the six months have run

Managed cannot be claimed before the practice has run at Defined, with records, for the six months, so a re-assessment now cannot close the action. Setting it for the earliest date Managed can be claimed is a sensible default. Keep the practice running and leaving records until then.

Step

Re-assess on records made since the action started

Use the same criteria, confidence rules and independence as the assessment. The re-assessor chooses a sample, three or all if fewer in the pack's default, from records dated since the action started, enough to show the practice is routine and not done once for the check. Defined needs at least Seen; Managed needs Tested. The pack's default is to do it within twenty working days of Ready.

• Then: Is the practice at the level aimed for, or higher?

Decision

Is the practice at the level aimed for, or higher?

Judge the level, not the effort. A new procedure with no records of it being used is not yet Defined. If the evidence leaves it in doubt, take the cautious branch.

• Yes: Close it, recording who re-assessed it, when and the level found
• No, or not known: Set it to Not achieved and agree what is missing

Outcome

Close it, recording who re-assessed it, when and the level found

The practice's level now follows the re-assessment, and the domain's level is the lowest of its practices. A closed action means a level reached on re-assessment. It is not an audit finding closed, and not evidence of compliance.

Step

Set it to Not achieved and agree what is missing

Record the level found; the practice's level follows the re-assessment. Agree what is missing and a new due date, or record the approver's decision to stop.

• Then: Is this its second Not achieved?

Decision

Is this its second Not achieved?

One miss can be timing: a practice that has only just changed may not yet have left enough records. The pack takes an action that reaches Not achieved twice to the approver, above the security function.

• Yes: Take it to the approver to decide
• No: Re-plan, and re-assess when the owner marks it Ready again

Outcome

Take it to the approver to decide

The approver is the one your governance sets: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. Ask for a decision: more effort, a new date, or stopping the action.

Outcome

Re-plan, and re-assess when the owner marks it Ready again

Set the new due date in your tracker and report it in the next quarterly progress report. A priority action past its due date is named to the sponsor.