Guide 01 · Step 5 of 5

Review loop

Governance that is reviewed once is a project. Governed systems change, staff leave, vendors update their models under you. The loop is what makes the previous four steps hold.

Independent guidance from Synergy. ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. Always work from the published text of the standard.

Dashboard. Eight to ten indicators, no more. Things like: systems in register vs systems discovered, controls operating, incidents open, reviews overdue, agents with excess permissions.

Quarterly review. One meeting, documented. It reads the dashboard, reads the exceptions, and decides. The minutes are the artefact.

Board report. One page. What changed, what broke, what needs a decision, what it cost.

Decision and exception log. Every time someone is allowed to deviate, write it down with an expiry date. Undated exceptions become the new normal.

What this actually takes

Steps 1 and 2 take one motivated person a week. Step 3 takes two to three weeks and involves people who do not report to that person. Step 4 never ends and needs a named owner with time allocated — and that owner is usually also doing their original job. Step 5 requires someone senior enough to make the review real.

The pattern is consistent: the design is achievable. Maintaining it is what typically exhausts internal resources — and the gap appears exactly at the point where governance stops being a document and starts being a standing commitment. That is not a flaw in your company. It is the ordinary shape of the work.

If you get to step 4 and find that nobody has the hours, that is the honest finding, and it is the point at which buying in outside capacity is usually cheaper than watching a register go stale for two quarters and then starting again.