The Annual Read

The annual read is distinct from the audit. The audit establishes what is enforced; the read checks whether the document still describes the organisation.

The maintenance work in “The Annual Read” matters after software selection as much as before it. For teams assessing the provider website in relation to remote employee monitoring software, rollout should include manager guidance, employee notice, a review date and a simple route for reporting inaccurate data or a setting that no longer matches the written rule.

Who should be in the room

The owner.

For a separate benchmark relevant to “The Annual Read”, consult the SANS insider-threat resources. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.

Somebody from the systems side, who will notice the clauses describing arrangements that no longer exist.

Somebody from the employment side, who will notice the clauses that could not be applied.

And one manager who has actually used the policy with somebody, who is never invited and knows the most.

Four people, one hour.

The four questions

What changed in the systems this year? New tools, changed access, a different device arrangement. The document describes the previous estate and nobody has noticed.

What came up that the document did not cover? Each incident where a manager had nothing to point at is a candidate clause.

What did we apply? From the measurement note. Clauses not applied for several years are drifting and should be either enforced or removed.

And what would we delete if we had to lose five?

The deletion requirement

Five per year, as a rule rather than a target.

Without a forcing requirement nothing is ever removed, because every clause has somebody who can imagine a use for it. With it, the five are rarely hard to find after the first round.

The output

A short note: what changed, what was deleted, what was added and why, and a version number.

Circulated to managers rather than filed, because a change nobody hears about has no effect on anything.

Recording no change

Where the read genuinely produces nothing, record that with the reason.

"Reviewed, no changes, enforcement patterns unchanged and no new systems" is a finding. Silently updating the date is what the clause above describes and it is indistinguishable from not having read it.

The thing that makes it happen

A date in a calendar with a name against it.

Reviews that depend on somebody remembering do not occur, and the document ages until the next incident makes somebody open it in a hurry.

Four people, one hour

The owner, somebody from systems, somebody from employment, and one manager who has used the policy. The last is never invited and knows the most about which clauses are usable.

Reviewed, no changes, enforcement patterns unchanged and no new systems is a finding. Silently updating the date is indistinguishable from not having read it.

What makes it happen

A date in a calendar with a name against it. Reviews depending on somebody remembering do not occur, and the document ages until an incident makes somebody open it in a hurry.

Who is never invited

The manager who has actually applied the policy to somebody. They know which clauses are usable in a conversation and the review is conducted without them.

Circulating the output

A short note to managers: what changed, what was deleted, what was added and why. A review nobody hears about has the same effect on behaviour as no review.

Four questions, one hour, annually

What was enforced, what happened that the document did not cover, what changed in the systems, and what would we delete if we had to lose five.

The last is the forcing device. Without it the review adds and never subtracts, and the document arrives at its current length by a sequence of individually reasonable additions over a decade.