Acting on findings

An engagement can find exactly what it set out to find, produce an accurate report, and change nothing. When that happens the reason is rarely that the finding was wrong. It is that the conditions for the finding to travel were absent.

Three layers decide whether a finding moves, following the three-layer frame. The rational layer, whether the finding is accurate and specific, is the easy part and the one exercises usually get right. The emotional and political layers are where findings stall.

  • The emotional layer is whether the room was safe enough for the real finding to be named. A finding that asks someone to admit a critical service could be down for a week surfaces accurately only when the person who would own that admission is present and willing to make it. Where naming it carries a cost, the sanitised version gets recorded instead, and the sanitised version cannot be acted on.

  • The political layer is whether anyone present can turn the finding into a decision. Someone, by name, needs the authority and the will to convert it into a changed control, a moved budget or a different process. Where security sits below the line at which budgets are set, findings become a list that is acknowledged and left unresourced.

  • The finding needs an owner from the moment it is written. A finding specific enough to be given an owner is usually specific enough to act on, and a finding too vague to own is too vague to be a finding. A priority finding whose owner is “nobody present” is the signal to bring the right person in or to escalate, before the exercise closes rather than after.

The practical test is the one threat modelling applies before a session ends: for each priority finding, who in the room has the authority and the capacity to act on it. A programme that can answer that produces change; one that cannot produces a document. The same conditions run through engagement objectives, the readiness a purple loop needs before it starts, and the reporting handover that carries a finding to whoever can act on it.

Last updated: 4 July 2026