Analysis, advice, validation, cover¶

Four types of request that arrive in the same form and carry entirely different responses.

Analysis: a decision-maker does not have a position. They want the advisor’s honest construction of the situation, the landscape, the risk. The question is genuinely open. The response is the advisor’s model.

Advice: a decision point is approaching. A decision-maker has not resolved it and wants a recommendation. The advisor has genuine latitude to shape the outcome. The response is a recommendation, with reasoning.

Validation: a decision is made. A decision-maker wants confirmation that it is sound, professional assurance from someone with the relevant expertise. The response is an assessment of the decision, not of the situation. Providing analysis instead of validation misreads the request. Providing validation as if it were independent analysis misstates what is happening.

Cover: the professional weight of an advisor, attached to something already decided. What is wanted is the advisor’s name on the document. This can be legitimate: an institution sometimes needs external imprimatur to proceed, and providing that is a service. What changes is the document itself, what it claims to be, what caveats it carries, and what the advisor’s name is actually on.

Institutional pressure¶

A mandate creates pressure toward the latter two types of request.

Principals negotiate positions. Institutional leadership develops policies. Once these are agreed, an institution needs them to hold, and analysis that contradicts them is not helpful in the institutional sense of helpful. An advisor who provides such analysis is doing their job. They are not being easy to work with.

Most of this pressure is not explicit. Nobody asks the advisor to shade their analysis toward the institutional position. The effect happens through framing: the question is posed in a way that makes the confirming answer likely, the evidence provided is the evidence that supports the position, and the timeline allows for a conclusion but not for deep examination of counterevidence. An advisor who does not notice the framing may produce confirmation without having been asked for it directly.

A significant portion of requests presented as analysis requests in mandate-driven institutions may turn out, on examination, to be validation requests. The position has been agreed; the question is whether the advisor can provide technical grounding for it. Not a reason to decline. A reason to know which type of request is being answered, and to write accordingly.

Surfacing distinctions¶

A conversation about which type of request is being made is not comfortable. It requires asking, in some form, whether the decision has already been taken, whether the analysis is genuinely open, or whether there is a conclusion the institution needs. These questions are not hostile, but they can feel like they carry a judgement.

It tends to be better to have that conversation at the scoping stage, before the work is underway and before institutional expectations have hardened around a particular conclusion, than to discover which type of request it was after the document has circulated.

Writing to the type of request¶

An analysis document carries the full weight of the advisor’s independent judgement. Framing is open. Conclusions go where the evidence leads. Caveats reflect genuine uncertainty.

A validation document carries a different weight. The advisor is assessing a decision already taken, not constructing an independent view. This can be stated explicitly: “This assessment evaluates the decision to adopt approach X against the available evidence and identifies the conditions under which that approach is likely to succeed or fail.” Honest. Useful. Not the same as independent analysis, and presenting it as such would misrepresent what the advisor’s name is attached to.

A cover document is different again. The advisor’s name is being lent. What the document contains is the honest statement of what the advisor is lending it for, not a simulation of analysis that was not conducted.

Four versions of the same request¶

A mandate-driven institution has experienced a significant security incident. A senior official contacts the advisor: “Can you take a look at our incident response posture?”

Four versions of that request, each one something different.

Version 1, analysis request. The official is genuinely uncertain about the state of the posture. No institutional position has formed. The advisor is being asked for their model: what is the posture, where are the gaps, what does the incident suggest about systemic weaknesses. The response is the advisor’s honest construction of the situation, including findings the institution may not welcome.

Version 2, advice request. The institution has a sense of where the problems are and is approaching a decision. “Given what happened, we are considering three possible changes: which would you recommend?” The advisor is being asked to weigh in before the decision is made. The response is a recommendation, with reasoning. The advisor is still shaping the outcome.

Version 3, validation request. The decision has been made. The institution has decided to implement a specific framework. “Can you confirm that this approach is sound?” The advisor is being asked to assess the decision already taken. This can be done honestly: the approach is sound in these respects, it carries these residual risks, it is likely to succeed under these conditions and not under those. What it cannot be is independent analysis of the situation, and framing it as such misrepresents what the advisor was asked to do.

Version 4, cover request. The institution is facing external scrutiny of its incident response and needs documentation that an independent expert reviewed the posture and found it adequate. The advisor is being asked to provide that documentation. Not inherently unreasonable. The advisor’s contemporaneous note in their own files records that the request was for a review framed as institutional validation, that the scope was constrained accordingly, and that the document belongs in that context. The document itself carries framing that reflects what kind of assessment it was.

What the advisor’s name is on differs across all four versions. Knowing which version is being requested is the condition for knowing what to write.