From Findings to Follow-Through: Turning Risk Assessments and Exercises into Measurable Improvement

A cybersecurity assessment identifies weaknesses. A tabletop exercise reveals uncertainty about incident-response responsibilities. An after-action review captures lessons from a disruption. Each provides valuable insight into how an organization can strengthen its operations.But what happens next?

For public safety, justice, and government organizations, the value of these activities depends on what happens after the report is delivered or the exercise concludes. Findings need to become decisions, assigned responsibilities, and improvements that work in everyday operations.

September’s risk-management blog explored how effective change management helps organizations address risk and test assumptions before an incident occurs. The next step is ensuring that the issues those activities uncover receive sustained attention and lead to measurable results.

Why Good Recommendations Lose Momentum

Consider a hypothetical 911 center that completes an exercise involving a compromised vendor connection that supports its computer-aided dispatch system. Personnel recognize that disconnecting the vendor could help contain the incident but also could interrupt essential support or functionality.

The exercise reveals several questions: Who can authorize the disconnection? Who evaluates the operational consequences? What alternate procedures would personnel use? Who coordinates with the vendor?

Now let’s say that these questions made it into the after-action report, along with a recommendation to clarify decision-making authority and update response procedures. The findings are useful. However, if no one is assigned responsibility, no completion date is established, and leadership never revisits the issue, the same uncertainty may exist when a real incident occurs.

Follow-through can stall for understandable reasons. Personnel have competing responsibilities. Improvements may require funding or coordination across departments. Recommendations may be too broad to translate easily into action.

An effective governance, risk-management, and compliance (GRC) program provides a structure for working through those barriers.

Set Priorities Based on Mission Impact

An assessment or exercise can produce more recommendations than an organization can address immediately. Consequently, leadership needs a practical way to determine where to begin.

That starts with understanding how each finding could affect the mission. Could it disrupt emergency communications? Compromise sensitive records? Delay court proceedings? Prevent personnel from restoring an essential service?

Useful questions include:

• Which services, systems, or information could be affected?
• How likely is the issue to cause or contribute to an incident?
• What safeguards already reduce the exposure?
• Does the improvement depend on another action, department, or vendor?
• Are there applicable deadlines or obligations that affect the schedule?

This approach helps organizations establish a realistic work sequence. Straightforward improvements can move forward quickly, while more complex issues receive the planning and resources they require.

When a significant issue cannot be resolved immediately, leadership should understand the remaining exposure, identify interim safeguards where feasible, and establish a date to revisit the decision.

Give Each Improvement an Accountable Owner

Recommendations such as “improve communication” or “update incident-response procedures” express an intended direction, but they provide limited guidance for execution.

Each improvement should identify an accountable owner, a specific action, a target date, and the evidence needed to demonstrate completion. Supporting departments and resource needs also should be clear.

The owner could coordinate with operations, the IT department, leadership, and the vendor(s) to establish decision authority, document service dependencies, and define alternate procedures. The owner does not have to perform every task personally. Rather, that person is responsible for coordinating the work, tracking progress, and bringing unresolved decisions or barriers to leadership.

A corrective-action tracker or plan of action, including milestones, can help organize this work. Linking those actions to the associated risks gives leadership visibility into both progress and the exposure that remains.

Decide What ‘Complete’ Means

Before work begins, organizations should agree on what successful completion will look like. Updating a procedure is an important step. The organization needs confidence that the procedure is approved, accessible, understood, and practical for the personnel expected to use it.

In the 911 center example, completion could include:

• Documented authority for restricting or disconnecting vendor access.
• Defined coordination and notification responsibilities.
• Alternate procedures for maintaining essential operations.
• Briefings for affected personnel across applicable shifts.
• A focused exercise or demonstration to validate the revised process.

These expectations make progress easier to evaluate and reduce the chance that an action is closed prematurely.

The same principle applies to technical improvements. If a finding concerns recoverability, a successful backup procedure provides useful information, but a restoration test provides stronger evidence that the organization can recover the information or system it needs.

Verify That the Improvement Addresses the Risk

Follow-up validation should be proportionate to the issue. Some actions can be verified through a document review or a sample of records. Others may require a demonstration, technical retesting, or a focused operational exercise.

The purpose is to determine whether the action addressed the original weakness and whether meaningful exposure remains.

For example, after revising the vendor-disconnection procedure, the 911 center could conduct a short scenario review with the personnel responsible for making and carrying out the decision. Participants would explain how they evaluate service impacts, obtain authorization, communicate the decision, and activate alternate procedures.

If uncertainty remains, the action needs further refinement.

Validation also can reveal unintended consequences. A new approval process might clarify authority while creating delays when the designated decisionmaker is unavailable. Identifying that problem during follow-up gives the organization an opportunity to establish backup authority before an actual incident.

Keep Leadership Engaged

Sustained improvement requires a regular review process. Leadership should be able to see which significant risks remain unresolved, which actions are overdue, and where decisions or resources are needed.

A very useful measure involves identifying the following: overdue actions associated with high risks; recurring findings; improvements awaiting validation; and deferred items approaching their review dates.

Doing so provides context that a simple count of completed tasks cannot. Closing several minor actions may represent progress, while one unresolved dependency continues to threaten an essential service.

Reviews should result in decisions: remove a barrier, adjust a schedule, provide resources, revise an action, or reconsider how the remaining risk will be managed.

Make Follow-Through Part of Everyday Governance

Assessments, exercises, and after-action reviews give organizations opportunities to understand their weaknesses before those weaknesses cause greater harm. Their lasting value comes from a repeatable process for prioritizing findings, assigning ownership, implementing changes, and verifying results.

For public-sector organizations, that process supports the outcomes that matter most: dependable services, informed decisions, protected information, and personnel who understand their responsibilities.

Before closing the next assessment or exercise, leadership should be able to answer three questions: Who owns the improvements? When will they be completed? How will we know they worked?

Those answers help turn identified weaknesses into stronger operational capabilities.

Jason Franks is an MCP risk-management consultant. Email him at JasonFranks@MissionCriticalPartners.com.