The Headlines Have Reached the Board. Could That Be Us?

A certificate proves one thing: that what was in scope met the standard on the day of the audit. It says nothing about the morning a headline lands and the board asks a question the audit never did.

The moment

It arrives as a short email, usually from the chair or a non-executive, usually forwarded from a news site. A ransomware attack has stopped a well-known organisation for weeks. A cloud provider has gone dark across a region. A supplier everyone uses has lost its customers' data. A regulator has announced something new. The email asks two questions, and both are reasonable: could that be us, and would our plans hold?

Whoever owns compliance, security or resilience is now expected to answer, quickly, and in a way the board can rely on. How that goes depends entirely on what was in place before the email arrived.

What the board is actually asking

The board is not asking whether the organisation is certified. It already knows that. Underneath the two questions in the email are four it wants answered:

• Are we exposed to this, and how badly?
• Would we know if it were happening to us?
• Would we cope, and for how long?
• Who is accountable for the answer?

None of these can be answered from a certificate, a policy or a Statement of Applicability. They can only be answered from a system that has been assessing its own risks, testing its own plans and measuring its own controls since the last audit. The standards expect exactly that. ISO 27001 requires risk assessment at planned intervals and when significant changes occur. ISO 22301 requires an exercise programme, not a plan on a shelf. Every one of them, at clause 9.1, asks whether planned activities are carried out and planned results achieved; the standards call this effectiveness, and it is what the board is asking about without using the word.

The two positions

Organisations tend to be in one of two positions when the headline arrives.

In the first, the answer takes a day. The risk register already carries the scenario or something close to it, reviewed within the year. The controls that would detect and contain it have evidence of operating, not merely existing. The continuity plan has been exercised against a loss of systems or a supplier, and the exercise record says what held and what was fixed afterwards. The response to the board is a page: here is our exposure, here is what is in place, here is what is not, here is what we will do and by when. The headline is treated as a change in context, which is what it is, and the system absorbs it.

In the second, the question starts a scramble. IT is asked for assurances it cannot give at short notice. A paper is written for the board, and the writing of the paper is the first real look at the scenario anyone has taken. The risk register is opened and found to describe the organisation as it was at certification. The continuity plan is current in the sense that it has a date on it. The organisation is not failing its audits; it is simply running a system that was built to pass the audit rather than to answer questions.

Neither position is a judgement on the people. The second is the natural result of treating compliance as a project that finished when the certificate arrived.

Why the headline is a useful test

A headline is an unplanned audit, and a better one in some ways than the planned kind. The auditor samples the system against the standard. The headline samples it against the world. It tests the things auditors can only partly reach: whether risk assessment is alive, whether the exercise programme has run, whether control owners can produce evidence without a fortnight's notice, and whether anyone can speak for the whole system rather than a part of it.

That is why the question deserves a proper answer rather than reassurance. A system that can answer it is one that will also be calm at the next surveillance visit, because the same records serve both.

Six steps when the question lands

1. Translate the headline into a scenario in your own terms. Not the organisation in the news, but your assets, your dependencies, your duration. A ransomware story becomes: extended loss of all IT with no fixed restoration date. A supplier story becomes: our largest third party unavailable for a month.
2. Check the risk register for it. If the scenario, or something close, is there and has been reviewed in the last twelve months, start from that assessment. If it is not there, that absence is the first finding, and it goes into the answer.
3. Trace the controls that would prevent, detect or contain it, and ask each owner for evidence that the control has operated this year: the last access review, the last restore test, the last supplier assessment. Existence is not the question.
4. Test the plans against the scenario on paper. Who decides to invoke, what the manual workaround is for each critical activity, how long it holds, and what is said to customers and regulators on day one. If the plan has never been exercised, say so.
5. Answer the board in one page: exposure, what is in place, what is not, what will be done and by when, and who owns it. A board can act on that. It cannot act on reassurance.
6. Record the whole exercise inside the management system: a risk assessment update, an input to the next management review, an addition to the exercise programme. The next headline then finds the answer already half written, and the next auditor finds a system that responded to a change in its context.

What good looks like

The board asks, and the answer comes within days from records that already exist. The scenario joins the exercise programme rather than being forgotten once the news cycle moves on. The risk register reads as a description of the organisation now, not at certification. Control owners can speak to their evidence in their own words. At the next surveillance visit, the auditor sees a system that noticed the world change and did something about it, which is the clearest sign of a system that is working.

None of that requires a bigger team or a new tool. It requires the quiet discipline of measuring the system between audits, so that a headline becomes an input rather than an emergency.

Not sure which position you are in?

If a headline has reached your board and you are not sure which position you are in, that is worth knowing before the next one does. Thirty minutes with a practitioner will usually tell you, with no proposal at the end of the call.

If you would rather start on your own, the free Readiness Check gives an indicative SSF Effectiveness Score in minutes, with no documents required.