← Thinking
Series
From exception to decision
A ten-part argument that moves from detecting a divergence — through ownership, evidence, risk, decisions, obligations, action and verification — to closure and independent assurance, tracing how an organisation governs the consequences it detects.
10 parts
- 01Detection is not governanceFinding that something has diverged from the expected state is important. Governance begins when the organisation decides what that divergence means and what should happen next.
- 02The system that detects the exception may not own the problemTechnical, operational, commercial and compliance exceptions can originate in one system while responsibility for understanding and resolving them belongs somewhere else.
- 03Evidence needs provenance, not just attachmentEvidence is more useful when we know where it came from, when it was valid, what it describes and which decisions depended upon it.
- 04Risk is not alert severitySeverity helps systems prioritise attention. Risk requires context, consequence, likelihood, controls, uncertainty and exposure.
- 05Decisions should be first-class recordsMaterial decisions deserve their own structured history: what was decided, why, by whom, on what evidence and under what conditions.
- 06A decision can create an obligationObligations do not come only from legislation and contracts. Management decisions, risk acceptances and temporary approvals can create them too.
- 07An obligation is not a taskTasks describe work. Obligations describe required states or outcomes. Completing the work does not necessarily mean the requirement has been satisfied.
- 08Completed is not the same as effectiveWork can be finished without restoring the control, reducing the risk or achieving the outcome that justified the work.
- 09Closure should require evidenceClosing an exception should be the result of demonstrated conditions, not simply an administrative change of status.
- 10Audit should be independent of executionDoing the work, governing the response and independently assuring that both were effective are related responsibilities, but they are not the same responsibility.