Notes
Practical writing on assurance, documentation and evidence. Every piece addresses a question an organization has actually been asked by a customer, an insurer or a board, and answers it in the words you would use back to them.
16 October 2026 · Frameworks and compliance · 7 min read
The framework is rarely yours to choose. Find the sentence that asked for it, then work out what will satisfy it and who has to issue it. Only when nobody has asked is choosing on merit the right question.
Read it16 October 2026 · Assurance and evidence · 7 min read
Match the leaver list against the dates accounts were disabled. The gap is the finding. On many tenants the log that would show it is kept for thirty days or less, so the first result is often that nobody can prove the control works.
Read it22 September 2026 · Incident readiness · 8 min read
Why a snapshot is not a backup, the question about administrative credentials that decides the outcome, and why retention set for accidental deletion cannot recover from a compromise.
Read it15 September 2026 · Assurance and evidence · 9 min read
Forty questions arrive with a ten-day deadline, and most organizations answer them from memory. A questionnaire is a contractual representation rather than a survey, and an answer you cannot support is a warranty you gave without noticing.
Read itListed because they are in preparation rather than to suggest a schedule. Each goes up when it is right, and nothing is published to keep a cadence.
A requirement recorded at the wrong layer is the most common reason a document set does not survive being read by somebody outside the business.
The application questions test your controls. The policy conditions decide whether a claim is payable, and they are not the same list.
Every piece here points at something you can act on the same afternoon. The questionnaire note has a response kit behind it, the backup note has a policy, and the leaver test has the Joiner, Mover and Leaver Standard. Fourteen files, all editable, none of them behind an email gate.
Tell us what was asked and who asked it. If there is a piece here that covers it we will point you at it, and if there is not, that is usually what the next one gets written about.
Also useful: Free downloads · The whole portfolio · Where we are the wrong answer