Chapter 39: Control Issues, Changes, Configuration, and Decisions

The change that was only a software change

It is November at Meridian, and the item has been sitting in the platform backlog for six weeks, sized, owned, and waiting, and nobody in the room has once asked what it actually is. Marcus Chen reads it aloud at the platform review because the release after the third Friday is being planned and the item finally has a cycle: “Add the referral field to the discharge form.” Two points. Platform work. It arrived the way most new information arrives, through the door that was open, which is to say through the vendor’s intake on the software stream, and it was logged where it landed, which is the first and quietest failure of control systems everywhere: the item is not a software change, and the form’s field is not what the district has actually changed.

Dana Okafor has the referral pathway policy on the screen, the one the steering committee discussed in the wave-three session, and the policy is one paragraph with consequences in six documents. From the first of the new year, clinics hand patients to the hospital through a new referral form, with a new data field for the receiving unit, and a new handoff procedure that obliges the clinic to confirm receipt in writing before the patient leaves the consulting room. The policy is mandatory, the district has said so, the regulator’s audit trail will record what the field records, and the final wave of clinics opens in December, which means the policy lands inside hypercare, the weeks when the new clinics are still being supported after opening, with the super-users rosters, the double-booked trainers, the certification assessment on the calendar, and the grant’s clinic-month arithmetic running in the background, two hundred fifty thousand units a clinic-month, the December gate’s value, the wave that must not slip.

“Two points,” Marcus says. “It can ride the release.”

“It can ride the release,” Dana says, “and the clinic will still hand patients over on the old form, because the release does not train the staff, does not change the workflow standard, does not touch the acceptance criteria, and does not make the audit trail record what the new field records. The item is not wrong. It is incomplete. The software change is the visible tip of a change that touches the workflow, the training, the data, and the acceptance, and we logged the tip and lost the rest.”

The room does what every room does when it hears this, it goes quiet, because the sentence is uncomfortable in a specific way. Nobody logged the policy badly. The policy arrived, it was turned into an item, the item was sized and owned and scheduled, which is exactly what a well-run adaptive stream does with new information, and the system still lost the change, because the system had no path from the arrival of the policy to the assessment of its full footprint, no triage that asked what the policy touched before it was turned into two points of platform work, and no record that would have held the six documents together. The platform’s empirical loop is not broken. It is well-run and incomplete, and the incompleteness is the subject of this chapter.

What the room needs is the control system the book has been building in pieces: the risk register of chapter 22, the decision records of chapter 4 and the decision log of chapter 27, the baseline-change record and the configuration register of chapter 31, the escalation clock of chapters 27 and 30, the obligations register of chapter 24, and the routing question of chapter 33. This chapter assembles the pieces into one path from new information to assessed and authorized action, the evidence-to-decision flow, with its fast path for the changes that fit inside existing authority and its formal path for the changes that cross streams, touch floors, or move the baseline. The policy on the screen is the worked case: one policy, six documents, five streams, five owners, one record, and a decision the steering committee must make with the wave gate weeks away and the mandatory date fifty days out.

The chapter’s claim is stated once, because everything else is the machinery of it: a project does not fail because new information arrives, it fails because new information arrives and there is no clear path from the evidence to the decision, and when there is no path, the information does not disappear, it travels sideways, through the corridor conversations, the unrecorded decisions, the drift between the documents and the field, until the clinic opens in December with the old form and the first mis-routed referral is discovered in January, at the moment when the cost of the discovery is highest. Control is the path. The path is what this chapter builds.

Every new fact needs a home

The first discipline is the inventory of what arrives, because most control systems fail before the triage, at the moment of classification, when a thing that exists now is filed as a risk, or a thing that might happen is filed as an issue, or a change to the agreed work is filed as a defect. The file determines the verb, and the verb determines everything that follows. Six kinds of new information arrive at a project; each has its home and its verb, and the discipline of the intake is naming both before the item moves.

An issue is a condition that exists now, the reconciliation drift, the clinic running the old form, the certificate delayed, the field that the hospital no longer accepts, and its home is the issue log, and its verb is resolve, with an owner and a date, because a condition that exists now does not want a response strategy, it wants a resolution, the chapter 22 lesson in operating form. A risk is an uncertain future effect on an objective, the audit guidance that may require longer retention, the hospital interface team that may not confirm the message format in time, and its home is the risk register, and its verb is respond, with a trigger and an owner, because a risk is not resolved, it is managed, watched at its trigger, and retired with evidence. A defect is the work failing its requirement or its acceptance, the handoff that mis-routes because the clinician used the old form, the integration test that fails at design load, and its home is the nonconformance record, the NCR of chapter 31, and its verb is dispose, rework, use-as-is, concession, or reject, with the disposition decided by the authorized party, because the defect is a decision, not a discussion. A change is a proposed modification to the baseline, the scope, or the agreed work, the new referral field, the operator’s re-timetabling, the vendor’s substitute tool, and its home is the change request, and its verb is assess and authorize, because the change is not adopted by momentum, it is adopted by decision. A decision is a choice that must be made, whether to pilot the new form at one clinic before the wave, whether to hold the December gate, whether to defer the archive, and its home is the decision log, and its verb is decide, with the record and the review date, because a decision that is not recorded and dated is a decision that will be defended past its truth. And an action is a task with an owner and a date, update the training plan, confirm the interface format, print the new forms, and its home is the action log, and its verb is do, with the evidence of the doing, because an action without an owner and a date is a hope, and a hope has no home.

The homes assemble into the integrated RAID-and-decision model, and the name is worth explaining because the acronym is a practitioner convention that has drifted in meaning. The model holds the project’s stock of uncertainty in four registers: the risks, the uncertain future effects; the assumptions, the beliefs treated as true until evidence disproves them; the issues, the conditions that exist now; and the dependencies, the things outside the project’s control that the work needs — the hospital’s interface team, the certification body’s calendar, the regulator’s decision. The model adds the two registers of action and choice: the decisions, the choices the project has made and must make, and the actions, the tasks the decisions have authorized. Six homes, four of uncertainty, one of choice, one of action, reviewed on the cadence of the decisions they feed. The model is only as good as its intake: the register that never receives the item cannot act on it, and the register that receives everything acts on nothing.

The failure pattern of the intake is the kitchen drawer of chapter 22: the one register that holds the issue that exists now, the risk that might happen, the assumption that might be wrong, the dependency that has no owner, the decision that was made in a corridor, and the action that everyone believes is someone else’s. The drawer cannot act on any of them, because the drawer asks every row for the same verb and the rows demand different verbs. The field signal at Meridian is already on the screen: the policy sits in the platform backlog as a software change, and the sentence “add the referral field” asks the work for the verb of the platform, while the change is simultaneously asking the workflow standard, the training plan, and the acceptance criteria for verbs they never received. The repair is not a bigger register. The repair is the intake: every piece of new information enters through one door, is named for what it is, and is routed to its home, and the naming happens before the item is sized, because the size belongs to the verb, and the wrong verb was never going to produce the right size.

The second discipline of the intake is the question that decides the home when the item is ambiguous, and the question is about the verb, not the tone. The sentence “the hospital may not be ready” is a risk, because it is about the future, and the sentence “the hospital has not confirmed” is a dependency, because it is about what the project needs and does not control, and the sentence “the hospital rejected the message format” is an issue, because it exists now, and the sentence “the message format must change” is a change, because it proposes to modify the agreed work, and the sentence “we will change the format” is a decision, and “the interface team will update the spec” is an action. The same fact, five sentences, five homes, and the project that files the first four under the fifth, the way the policy was filed under the platform, has not lost the information, it has mis-routed it, and mis-routed information is information that will arrive late, in the corridor, after the decision that should have carried it has already been made.

The intake has the machine’s boundary, the one the book has drawn since the estimation chapter. The machine can classify by vocabulary — the sentence with “may” and “might” clustering toward the risk, the sentence with “has” and “did” toward the issue, the sentence with “must change” toward the change — and the draft classification is useful exactly as a draft, the first pass the project leader corrects at the intake, because the classification is about the world, not the words. The machine can draft the register rows from the intake, the fields prefilled. The classification, the home, the verb, the owner, and the routing stay human, and the record stays the human’s, because the register is only as honest as the naming, and the naming is a judgment about what the item is, and judgment does not delegate.

Triage before action

The intake names the item and sends it home. The triage decides what happens next, and it is the second discipline of the chapter, the four-question gate every item passes through before it moves, and the four questions are the ones the manifest of this book set for control: urgency, impact, reversibility, and authority.

Urgency is the question of how fast the decision must arrive, and it is answered by the deadline and the consequence of waiting, never by the volume of the requestor and never by the calendar’s convenience. The referral policy is urgent because the mandatory date is the first of January and the final wave opens in December, and every week of waiting moves the training into hypercare, where the double-booked super-users are at their busiest. The operator’s request to repaint a station entrance is not urgent, whatever the operator’s tone, because the paint does not move the opening. And the regulator’s answer on the sub-processor amendment is urgent because the certification assessment runs six weeks after the amendment closes, and the December gate does not wait. The discipline of urgency is the deadline written with its date and its owner, because the item whose urgency nobody can state is the item whose urgency is manufactured by the requestor, and manufactured urgency is how the fast path gets jammed with the routine.

Impact is the question of what the item touches, and it is answered by the footprint: the streams, the documents, the floors, the objectives, the commitments the item changes if it is acted on. The referral policy touches six documents, five streams, the workflow, the training, the data, the acceptance, the certification evidence, and the wave gate’s definition of done, and the impact is large not because the field is large but because the footprint is wide. The repaint touches one station, one drawing, one contractor, and the impact is small. And the change that touches a floor — the settlement promise at KijaniPay, the fraud-loss guardrail, the privacy certification, the clinical continuity at Meridian — makes the impact large regardless of the size of the change, because the floor is the nonnegotiable that the project protects with the gate, the obligations register of chapter 24, the row that never degrades into a provisional. The discipline of impact is the footprint written down before the assessment, because the impact assessment that starts with the footprint ends with the right decision, and the impact assessment that starts with the price ends with the price.

Reversibility is the question of what it costs to undo, and it is the question that most distinguishes the fast path from the formal path, because the reversible change can be acted on and corrected, and the irreversible change must be assessed before it is adopted. The change that can be rolled back — the configuration flag, the draft form tested at one clinic, the release with a rollback — can ride the fast path with a record and a verification. The change that cannot be undone — the concrete poured, the contract signed, the certification granted, the policy trained into six clinics and then changed — must pass the formal path, because the cost of the wrong irreversible decision is the cost the fast path exists to avoid. The discipline of reversibility is the rollback written before the adoption, the sentence that says what would happen if the change proved wrong, because the project that cannot say how it would undo the change has not assessed it, it has hoped about it.

Authority is the question of who may decide, and it is answered by the governance map of chapter 8 and the delegation board of chapter 26: the map that says which decisions live at which level, the platform lead’s authority over the backlog, the workflow owner’s authority over the standard, the steering committee’s authority over the baseline, the gate, and the floors, the executive’s authority over the contract and the commitment. The item within the authority — the field reordered in the backlog, the font change to the form, the action item assigned — is decided by the accountable person at the cadence. The item above the authority — the policy that moves the scope, the cost, the schedule, and the certification — is decided by the body the map names. And the item that no map names is the item the map was missing, the seam between the streams, the gap between the workflow and the training, and the seam item escalates with the decision request, because the item that no one may decide is the item that will be decided by whoever acts first.

The four questions produce the two paths, and the primary visual of the chapter is the flow, because the flow is the argument: every piece of new information enters one door, is triaged, and moves down the fast path or the formal path, and both paths end in the same place, the record, the configuration baseline, and the verification and audit that close the loop.

Figure 39.1: The evidence-to-decision flow. New information enters
one door and is triaged; fast items move within existing authority,
formal items pass through assessment and authorization; both paths
end in the record, the configuration baseline, and the audit.

   NEW INFORMATION: an issue, a risk, a defect, a change,
   a decision, a decision request, a fact that arrived
   this morning, from the field, the vendor, the regulator,
   the operator, the meeting, the corridor, the audit
                          |
                          v
              THE TRIAGE GATE
   urgency: how fast must the decision arrive?
   impact: what does it touch, and does it touch a floor?
   reversibility: what does it cost to undo?
   authority: who may decide, by which map?
       |                      |
       v                      v
  FAST PATH               FORMAL PATH
  within the              above the threshold,
  delegation map,         crosses streams or
  below the               touches a floor or
  threshold,              the baseline:
  reversible:             a change request,
  log it, assess          an impact assessment
  it minimally,           across the eight
  act, record,            dimensions, a decision
  verify on the           by the authorized body
  cadence                 with conditions, a
                          baseline-change record,
                          a configuration update
       |                      |
       +----------+-----------+
                  |
                  v
   THE RECORD: the decision log with
   its review dates and expiry dates,
   the action log with its owners,
   the configuration baseline with
   its status accounting, the
   registers with their rows
                  |
                  v
   VERIFY AND AUDIT: the field matches
   the record and the record matches
   the field, checked independently,
   on a cadence, before the gates

The fast path is the path of the small, the reversible, the within-authority, and its discipline is that it is not the unrecorded path. The fast path logs the item, assesses it minimally, acts, records, and verifies on the cadence, and the record is the difference between the fast path and the shortcut, because the item that is acted on and not recorded will be re-decided by someone who does not know it was decided, and the re-decision is the drift. The fast path’s cadence is the rhythm of chapter 30: the action item at the standup, the backlog item at the iteration, the small change at the review, and the record at each, the action log with the owner and the date, the decision log with the one line, the verification with the evidence. The fast path’s failure is the fast path that never verifies, the small change that is logged and acted on and never checked, the form field that is deployed and never tested at the point of work, and the field signal is the item marked done with no evidence attached, the chapter 29 checkbox in its decayed form.

The formal path is the path of the large, the irreversible, the above-authority, the cross-stream, the floor-touching, and its discipline is the sequence: the change request, the impact assessment, the decision by the authorized body with its conditions, the baseline-change record if the baseline moves, the configuration update, and the verification and audit. The formal path is slower than the fast path, and the speed is the price of the assessment, not the failure of the process, and the project that is ashamed of the formal path’s speed is the project that will take the short cut — the policy routed as a software change, the variation approved in the corridor, the baseline edited to match the forecast — and the short cut is the expensive path in its true cost. The formal path’s failure is the ceremony: the change request that is filled and filed and never assessed, the impact assessment that quotes the price and skips the footprint, the decision body that meets and rubber-stamps, and the field signal is the formal item that changes nothing, the change approved and the work unchanged, the audit that finds the register current and the field obsolete.

The triage itself has its failure patterns, and the chapter names three because they are the three shapes of the jammed door. The everything-is-urgent project triages by volume: the loudest requestor gets the fast path, the regulator’s date waits while the repaint sails through, and the field signal is the fast path that carries the formal items, the change that was never assessed because it could not wait. The everything-is-formal project triages by fear: every change goes to the committee, the font change and the policy sit in the same queue, the committee becomes the bottleneck, and the field signal is the review that decides the trivial and defers the consequential, the chapter 27 postponement machine in control form. And the everything-is-fast project triages by convenience: the threshold is informal, the authority is whoever acts, the floor-touching change rides the backlog like the routine change, and the field signal is the item that moved the baseline without a record, the drift that will be discovered at the gate. The repair is the same in all three: the four questions written, the thresholds written, the authorities written, the paths written, and the review that audits the triage itself, the quarterly question of which items took the wrong path, and what the wrong path cost.

The triage lands at Meridian the morning of the platform review, because the policy finally gets what the intake never gave it. Dana names the item for what it is, a change, not a software change, and the triage runs: urgency, high, the first of January is fifty days out and the gate is in December; impact, wide, six documents, five streams, the certification evidence, the wave gate’s definition of done, the floor rows of the audit trail; reversibility, low, the policy once trained into the clinics is costly to untrain, and the mis-routed referral once happened is a patient event, not a flag; authority, above the platform lead’s, the change moves the scope, the schedule, the cost, and the certification, and the map sends it to the steering committee. The item leaves the platform backlog’s software shape and enters the formal path as a change request, and the room’s relief is the relief of the named path: the change no longer has to be carried by a sentence it outgrew.

The change request and the eight-dimension impact

The change request is the formal path’s first instrument, and its minimum viable form is smaller than most organizations believe, because the change request is not a form, it is a decision instrument, and the instrument’s job is to make the impact assessable by the body that must authorize it. The minimum viable change request names the change in one sentence — the current state, the proposed state, and the reason — names the requestor and the date, names the footprint, the streams, the documents, the floors, the objectives the change touches, and names the decision needed — approve, approve with conditions, reject, or defer — with the authority the map gives. Everything else belongs in the impact assessment that the request commissions, because the request is the question and the assessment is the evidence, and the body that receives the question without the evidence will decide on the requestor’s enthusiasm, which is the decision the formal path exists to prevent.

The impact assessment is the second instrument, and it is the chapter’s central tool: the systematic walk of the eight dimensions the manifest of this book set for change — value, scope, schedule, cost, quality, risk, operations, and benefits. They are the eight places a change can move the project, and the assessment’s discipline is that the change is walked through all eight before it is authorized, because the change that is priced and not value-checked is the change that saves a million and destroys the mission, and the change that is scheduled and not operations-checked is the change that ships on time and fails in use. The assessment is not eight paragraphs of ceremony. It is eight questions, each answered with evidence, and the answer that is not evidence is a claim, and the claim is marked as a claim.

Value is the first dimension, and the question is what the change does to the project’s reason to exist, the outcome the charter and the business case named. At Meridian the referral policy is a value change before it is anything else: the handoff is the access pathway, the route by which patients reach the hospital, and the policy’s new form and new procedure exist to make the handoff safe and recorded, which serves the grant’s access outcomes, the wait times and the screening uptake that the grant officer counts, the outcomes that chapter 1 promised and chapter 5 priced. The value assessment asks whether the change serves the outcome, and the answer is yes: the policy is not a burden the project absorbs, it is the outcome the project exists to deliver, arriving in a form the project must adopt. It is also the place where the change that serves nothing is exposed — the vanity feature, the operator’s preference, the vendor’s upgrade — and the discipline is the sentence that connects the change to the outcome, because the change that cannot be connected to the outcome in one sentence is the change that should not be adopted.

Scope is the second dimension, and the question is what the change does to the agreed work, the deliverables, the requirements, the documents that define them. The Meridian change moves the scope across six artifacts: the discharge form gains the field, the data dictionary gains the definition, the hospital interface specification gains the message element, the workflow standard gains the handoff procedure, the training materials gain the procedure and the competency check, and the acceptance criteria gain the readiness row. The scope assessment is the footprint made explicit, and its discipline is that the footprint is written before the work, because the scope change that is discovered mid-delivery, the field deployed and the workflow still describing the old handoff, is the scope change that has already moved the project without a record. The scope question is also the question of what the change does not touch — the construction, the migration of the legacy records, the reference tables — and the negative footprint matters as much as the positive, because the assessment that lists what the change does not touch keeps the change from leaking into the unaffected streams.

Schedule is the third dimension, and the question is what the change does to the dates, the milestones, the gates, and the forecast, and the schedule assessment is the arithmetic the room must do with the clocks the streams run on. At Meridian the arithmetic is the chapter’s worked example, and it is worth doing in full because the schedule is where the change’s true cost lives. The platform runs two-week cycles at three items a cycle, and the field, the interface element, and the test are the three items, riding the release after the third Friday, about two weeks out, comfortable against the wave gate in December and comfortable against the first-of-January date. The workflow standard needs the clinical governance review, the session Hana convenes with the clinicians, and the review’s next date is three weeks out, with the standard amended, issued, and distributed a week after, so the workflow lands about four weeks out as well. The training needs the cohort: Sam’s final wave has three of six cohorts complete, the remaining cohorts run in the weeks before the gate, and the new handoff procedure means the remaining cohorts train on the new form, with the super-user roster for the wave double-booked across the existing clinics, the capacity question that chapter 33 raised in the corridor. The acceptance needs the evidence: Nora’s wave gate definition of done gains the referral row, and the row’s evidence is the pilot, the proof that the new form works at the point of handoff, run at the existing clinic from the week after the steering session so the evidence lands before the gate and before the first of January. And the certification needs the audit trail: Esther’s assessment records what the field records, and the new field must be in the records of processing and the audit trail before the certification body’s calendar turns. The latest date decides the change: the platform’s two weeks, the workflow’s four, the training’s final cohort before the gate, the pilot’s evidence before the first of January, and the change is done when the slowest stream is done, the seam owner’s rule of chapter 33, and the slowest stream is the training, because the double-booked super-users and the cohort calendar carry the real clock.

Cost is the fourth dimension, and the question is what the change does to the money, the budget lines, the forecast, the funding gates, and the discipline is that the cost is estimated with its basis — the time-and-materials on the platform at the vendor’s rate, the training materials and the super-user time, the printing and the distribution — and read against the value, not against the budget alone. At Meridian the cost is modest in absolute terms, the field and the interface element on the vendor’s time-and-materials, the amended training materials and the added cohort hours, a few thousand units against the wave’s economics. The discipline is the sentence that says what the change costs and what the change buys, because the policy’s true cost is not the field, it is the coordination — the five streams, the seam owner, the review — and the true value is not the form, it is the certification that holds and the handoff that does not fail in January. The cost assessment is also where the change that is free to implement is exposed for what it costs in the streams it touches: the sentence “it is only a field” that priced the field and skipped the training, which is the chapter’s opening scene in assessment form.

Quality is the fifth dimension, and the question is what the change does to the standards the work must meet, the acceptance criteria, the certification, the safety and the security of the outcome. The Meridian change is a quality change in its core: the handoff procedure exists to make the referral safe, the confirmation of receipt before the patient leaves the consulting room is a patient-safety control, and the audit trail must record what the field records is a certification requirement. The quality assessment asks whether the change’s own quality is assured — the field tested at the point of work, the procedure observed in a live consult, the audit trail exercised before the certification. It is the place where the change that moves a floor is named as a floor change, and the floor is the reason the change goes formal regardless of its size: the referral data is personal health data, the audit trail is the certification evidence, and the change that touches either touches the nonnegotiable, the obligations register row that never degrades into a provisional.

Risk is the sixth dimension, and the question is what the change does to the project’s uncertain future effects: the risks the change introduces, the risks it retires, the residual risk it leaves. The Meridian change introduces the risk of the mis-routed referral in the transition, the clinic that opens in December and hands patients over on the old form because the training did not reach it, the chapter 33 ordering in risk form; the risk that the hospital’s interface team does not confirm the new message format before the release, a dependency wearing a risk’s coat; the risk that the pilot’s two-week run is too short to surface the handoff failures; and the risk that the certification assessment finds the audit trail incomplete. The risk assessment is the chapter 22 discipline applied to the change: the risks named with their triggers and their owners, the response chosen — mitigate, the pilot, the confirmation call, the early evidence — and the residual risk accepted with its owner and its date. It is also where the change’s effect on the existing register is reconciled, the risks the change retires — the policy that was logged as a software change retires the risk that the workflow never saw the policy — and the register is updated on both sides, introduced and retired, because the risk assessment that only adds rows has not noticed what the change solved.

Operations is the seventh dimension, and the question is what the change does to the people and the systems that will run the outcome after delivery: the clinics, the staff, the super-users, the hospital intake, the hypercare roster, the operators, the users — the people the book has insisted on seeing as agents with interests, not obstacles. The Meridian change is an operations change by nature: the new form changes what clinic staff do at the point of handoff, the confirmation procedure changes the flow of the consulting room, the hospital intake must receive the new message format, the super-users must be trained before the gate, and the hypercare team must reinforce the procedure in the weeks after opening, the weeks when the policy becomes mandatory. The operations assessment is the chapter 11 discipline applied to the change: the environment before the behavior, the training at the point of work before the classroom, the super-user rostered at the desk, the competency check observed. It is the dimension that most often exposes the incomplete footprint, because the change that the platform built and the training never saw is the change that operations will discover in January, at the desk, with a patient waiting.

Benefits is the eighth dimension, and the question is what the change does to the measurable advantages the project exists to deliver: the wait times, the screening uptake, the settlement promise, the fraud-loss guardrail, the grant’s clinic-month economics. The discipline is that the benefit assessment is measured, not asserted — the baseline read before the change and the forecast after — because the change that improves the outcome and the change that merely changes the form are different changes, and only the measurement tells them apart. The Meridian change is measured in the access outcomes: the handoff that is safe and recorded serves the wait-time target and the screening uptake, and the change’s benefit forecast is the grant’s own arithmetic, the clinics that open in December carrying the referral policy from the first of January contributing to the access outcomes that the grant counts. The change’s benefit is also the negative benefit it avoids: the certification that holds, the mis-routed referral that does not happen, the clinic-month that does not slip.

The eight dimensions close the assessment, and its output is the decision brief the steering committee will read: the change request with its footprint, the eight answers with their evidence, the options with their costs and their dates, and the recommendation with its conditions. The discipline is the one the whole chapter teaches: the footprint written before the price, the evidence marked from the assumption, the floor named as a floor, the risk named with its trigger, the operations named with its people, and the benefit named with its measure, because the assessment that walks all eight dimensions makes the authorization a decision instead of a hope.

Thresholds: who may decide, and when

The triage routes the item, and the threshold decides which path the item takes, and the threshold is the project’s own written answer to the authority question, stated per dimension and dated, the boundary between the decision the accountable person may make on the cadence and the decision the governing body must make with the record. The threshold is the operational form of the governance map of chapter 8 and the delegation board of chapter 26: the map says who may decide, the threshold says what they may decide, in units the project can check, the cost, the schedule, the scope, the floor, the contract, the commitment.

The threshold is written in the project’s own units before the changes arrive, because the threshold written during the change is the threshold written by the change, and the threshold written by the change is the threshold that will approve the change. It names the limits per dimension: the cost below which the stream owner may absorb the change in the budget line, the schedule impact below which the team may re-sequence within the float, the scope crossing beyond which the change touches more than one stream or document, the floor that the change must never touch without the gate, the contract clause that the change must never trigger without the commercial lead, and the commitment — the public date, the grant date, the certification date — that only the authorized body may move. The threshold is reviewed on the cadence of the governance, because the threshold set for the planning phase is wrong for the commissioning phase, the threshold that served the build is dangerous in hypercare, and the review that does not re-examine the thresholds lets them decay into the informal, the everything-is-fast project in threshold form.

The predictive environment makes the threshold its sharpest instrument, because the predictive baseline is the promise, and the threshold is the boundary of the promise’s movement. At BlueLine the baseline moves only through formal change, the discipline of chapter 31, and the threshold is written in the units the corridor’s governance can check: the cost threshold that sends the variation to the steering committee, the schedule threshold that sends the milestone slip to the review, the scope crossing that sends the interface change to the change path, and the floors, the certification, the safety evidence, the revenue-critical ticketing, that never move without the gate. The corridor has lived both sides of the threshold: the eastern segment’s variation of 38 million units went formal, through the decision briefs and the exception report of chapter 27, because the cost crossed the threshold and the schedule crossed the gate calendar, and the operator’s re-timetabling, which changed the interface’s environment, never went anywhere, because the threshold was written for the project’s documents and not for the operator’s timetable, and the load profile drifted until the dry run failed at design load, NCR-031, the threshold’s gap discovered at the moment when the repair was most expensive. The predictive lesson is the threshold’s field of view: the threshold that counts the change’s cost but not the environment’s drift is the threshold with a blind side, and the blind side is where the load profiles and the timetables change.

The adaptive environment makes the threshold a different instrument, because the adaptive baseline is not the schedule, it is the outcome commitment, and the threshold separates the decisions that move the means from the decisions that move the commitment. At KijaniPay the backlog refresh is the change control, the discipline of chapters 30 and 32: the item that reorders the backlog by outcome, risk, and evidence is a means change, decided by the product council on the iteration, and the item that changes the outcome commitment — the settlement promise, the fraud-loss guardrail, the target the sponsors hold — is a commitment change, decided by the governance that set the commitment, with the record. The threshold is the boundary between the two: the reordering is fast, the outcome change is formal, and the item that cannot wait for the iteration is not a backlog item at all, it is an escalation with a decision request, the chapter 30 lesson in control form. The adaptive failure is the threshold that is never written, the outcome that drifts through the backlog one item at a time, the guardrail that moves because the calendar pressed, and the field signal is the product goal that changed without a decision record, the chapter 32 baseline drift wearing the backlog’s clothes.

The hybrid environment makes the threshold the routing rule, the discipline of chapter 33: the change that crosses streams crosses through all their paths, at the speed each stream’s clock runs, and the threshold is written per stream — the construction’s cost and schedule, the platform’s outcome and floor, the workflow’s standard, the training’s cohort, the certification’s gate — and the change that crosses a stream’s threshold takes that stream’s formal path while the other streams carry their parts on their own clocks. The Meridian policy is the hybrid threshold in full form: the field crosses the platform’s release threshold only in size, and rides the release, but the same change crosses the workflow’s standard threshold, the training’s competency threshold, and the acceptance’s gate threshold, and each crossing takes its path, with the seam owner integrating the dates and the record carrying the full footprint: one change, five paths, five owners, the latest date.

The crisis environment compresses the threshold to its minimum, and the minimum is the floor: at Northstar the floors, the safeguarding, the cold chain, the sanctions, never move, and everything else is reforecast daily, the discipline of chapters 23 and 29, and the threshold in crisis is the distinction between the floor and the rest, because the crisis is when the informal threshold is deadliest, the floor that moves because the night is hard, the safeguard that relaxes because the schedule is dire. The crisis threshold is written before the crisis, by the people who will not be in the room when it hits, and it is the one threshold that is not reviewed in the crisis, because the crisis is the review of it.

The threshold has its failure pattern, and the chapter names it because it is the quietest: the threshold that moves when the calendar presses. The threshold is set in the calm — the cost limit, the schedule float, the floor — and it is moved in the storm, the meeting where the date is close and the change is large, and the threshold that moved is not a threshold, it is a preference, and the project that moved the threshold once will move it again, and the second move is cheaper than the first, and the third is invisible. The field signal is the change that was approved by a body that had no authority over it, with the minutes recording the approval and the map recording the authority, the two documents disagreeing, the drift between the delegation and the decision. The repair is the threshold that is written, dated, owned, and audited, the quarterly question of which decisions were made above their authority, and what the overreach cost, because the threshold is a governance decision, and a governance decision is only as real as its record.

The thresholds land at Meridian the way the triage landed, as the written map the policy finally travels by. The platform’s threshold lets the field ride the release under Marcus’s authority. The workflow’s threshold sends the handoff procedure to the clinical governance review under Hana’s. The training’s threshold sends the procedure and the competency check into Sam’s cohort plan. The acceptance’s threshold sends the readiness row into Nora’s wave gate definition of done. And the certification’s threshold sends the audit trail into Esther’s records of processing. Five thresholds, five owners, one change, and the change request carries the footprint that the thresholds drew, because the threshold is the map’s answer to the question the intake asked, and the question was never about the field, it was about what the field touched.

The field that lives in six documents

The impact assessment walks the footprint, and the footprint leads to the third instrument of the chapter, the configuration system, because the change that crosses documents must be carried by all of them or it is carried by none, and the discipline that keeps the documents true is configuration management, the practice the book first met in the predictive register of chapter 31 — the configuration register and the rule that only authorized versions are used for work — and the practice that this chapter completes, because the configuration system is where the change’s footprint becomes durable.

Configuration management is the discipline of the controlled items: the things the project cannot afford to have drift — the drawings, the specifications, the forms, the data dictionary, the interface definitions, the workflow standards, the training materials, the acceptance criteria, the versions of everything the work is built from — and the rule that the version used for work, procurement, inspection, and acceptance is the current authorized version, and the rule that the change to a controlled item flows through the change process even when the change is small, because the small change is the one that is absorbed without a record, and the unrecorded change is the drift. The discipline matured in the mid-century aerospace and defense programs where a single obsolete revision could ground a fleet, and it survives in the standards that still govern it, ISO 10007 among them, the general framework the book describes in its own words: identification, the controlled items named and versioned; status accounting, the register that says which version is current and where it is authorized; verification, the check that the item works as the record says; and audit, the independent check that the record matches the field.

The four acts of configuration are worth walking at Meridian because the referral field is the perfect configuration object, one logical item living in six artifacts, and the field is the chapter’s second visual, the map that the configuration register provides.

Figure 39.2: The referral field is one configuration item that
lives in six artifacts. A change to the field must update every
artifact or the drift repeats; the configuration register is the
map that says which artifacts carry it, and status accounting,
verification, and audit keep the map true.

   THE REFERRAL FIELD, one logical item, one version
     |  carried by
     +-- the discharge form          (the form set, versioned)
     +-- the data dictionary         (the field definition)
     +-- the hospital interface spec (the message element)
     +-- the workflow standard       (the handoff procedure)
     +-- the training materials      (the cohort plan, the
     |                               competency check)
     +-- the acceptance criteria     (the wave gate row, the
                                     certification evidence)
   STATUS ACCOUNTING: the register says which version of each
   artifact is current and authorized, where it is issued, and
   which artifacts carry the field.
   VERIFICATION: the field works as the record says, tested at
   the point of work, observed in a live consult.
   AUDIT: an independent check that the register matches the
   field and the certification evidence, on a cadence, before
   the gates.

Identification is the first act, and its discipline is naming the controlled items before they are needed, because the item that was never identified is the item that will drift unobserved. The identification question at Meridian is the footprint question asked of the configuration: which artifacts carry the field, and the answer is the six — the form, the data dictionary, the interface specification, the workflow standard, the training materials, and the acceptance criteria — and the identification is the map that the change request’s footprint drew, now made durable in the register. The identification failure is the item identified too late, the interface specification without a load profile, the chapter 31 lesson, the specification that carried the message format and not the peak-hour load, because the load profile was never identified as a controlled property of the seam, and the property that is not identified cannot be versioned, and the property that cannot be versioned will change without a record.

Status accounting is the second act, and its discipline is the register: the current authorized version of every controlled item, its state, its owner, its issue date, its history, updated by the change process and read by the work, because the register that is not read is the museum, the chapter 30 failure in configuration form, the filing system that lists the versions and never informs the field. The status accounting question at Meridian is the version question: the form set gains the field in revision B, the data dictionary gains the definition in its next issue, the interface specification gains the message element with the format agreed with the hospital, the workflow standard gains the procedure after the clinical review, the training materials gain the procedure in the next issue, the acceptance criteria gain the row in the wave gate definition of done, and the register says, for each artifact, which revision is current, who owns it, and where it is authorized. The discipline is that the field’s six artifacts move as one change, because the field that moves in the form and not in the workflow is the field that the clinic will type and the handoff will ignore.

Verification is the third act, and its discipline is the check that the item works as the record says: the field tested at the point of work, the procedure observed in a live consult, the message format exercised against the hospital’s interface, the audit trail populated and read back, because the configuration that is recorded and not verified is the configuration that is believed and false, and the belief is the expensive thing — the dry run that fails at design load because the design load was never specified, the form that works in the test environment and breaks in the clinic. The verification question at Meridian is the evidence question: the field works when a clinician completes the new form in a live consult and the hospital receives the message, the procedure works when the confirmation of receipt is recorded before the patient leaves the room, and the verification is the chapter 21 acceptance discipline applied to the change, the evidence before the gate, never the gate before the evidence.

Audit is the fourth act, and its discipline is the independence: the check that someone who did not make the change verifies that the register matches the field, on a cadence, before the gates, because the verification done by the people who made the change finds what they expect, and the audit finds what they did not. The audit question at Meridian is the certification question: the audit trail must record what the field records, Esther’s certification evidence, and the configuration audit before the wave gate checks the six artifacts against the register and the field against the six artifacts — the form in the clinic matches the form in the register, the workflow at the desk matches the standard, the training delivered matches the plan, the audit trail carries the field — and the audit’s finding is the change’s final verification, the independent proof that the change that was authorized is the change that was delivered, and the change that was delivered is the change that works. The audit failure is the audit that is not independent, the register checked by the person who updated it, the field checked by the team that built it, and the field signal is the audit that has never found anything, because the audit that never finds anything is the audit that is not looking, and the chapter 24 lesson holds in its strongest form: the independence is the value, and the value is only as real as the authority to say no.

The configuration discipline closes the change’s loop: the impact assessment walked the footprint, the threshold routed the change, the authorization approved it with conditions, and the configuration system carries it — identified, accounted, verified, audited — and the change is done not when the field ships, but when the six artifacts carry the field, the register says so, the verification proves it, and the audit confirms it, which is the definition of done the configuration gives the change, and the definition is the one the wave gate will check, because the gate that accepts the field and not the six artifacts is the gate that accepts a change that has not happened.

Decisions expire

The change’s path ends in the decision, and the decision’s discipline is the fourth instrument of the chapter, the decision log with its expiry dates, and the expiry is the instrument that most projects never build, because the decision log exists in most projects, the ledger of chapter 27, and the expiry is the step that the ledger omits, and the omission is the quiet cost.

The decision record is the form the book has carried since chapter 4 — the context, the options, the evidence, the decision, and the triggers that would reopen it — and the decision log is the running ledger of the records, each decision with its date, its owner, its review date, its outcome, and the log is the project’s memory, the place the audit reads, the evidence of the decision cadence, the decisions made, postponed, reversed. Chapter 39 adds the instrument the ledger needs: every decision in the log gets a review date, the date by which the decision must be re-examined against the evidence whether or not anything seems wrong, because a decision is a bet on a future, and the future arrives, and the bet that is not re-examined at its expiry is the bet that will be defended past its truth.

The logic of the expiry is the logic the forecast taught in chapter 38: the forecast is a set of assumptions about what persists, watched at the trigger, revised on a cadence, and the decision is the same object on the other side of the flow, a choice made under assumptions about what would be true, and the choice is only as durable as the assumptions, and the assumptions have a clock. The decision to defer the archive at the December gate assumed the reconciliation rate would hold, and the decision expires at the date the rate would have moved the date. The decision to pilot the referral form at one clinic assumed the hospital’s interface team would confirm the format, and the decision expires at the confirmation date. The decision to hold the December gate assumed the certification assessment would close, and the decision expires at the certification date. The expiry is not the reversal. The expiry is the obligation to re-decide, to look at the decision with the evidence that has arrived since it was made, to confirm, revise, or reverse it, with a record, and the expiry is the scheduled moment that the corridor decision, the one made in the hallway and never revisited, never gets.

The expiry calendar is the instrument’s operating form: the list of the decisions, their owners, their review dates, read at the governance cadence, and the calendar’s discipline is that the review date is set when the decision is made, not when it seems needed, because the decision that is revisited when it seems needed is the decision that is revisited when it is too late, and the decision that is revisited on its date is the decision that is revisited while there is still time to change it. The calendar’s failure is the expiry that is never set, the decision made and recorded and never dated, and the field signal is the decision that is defended in a meeting with no review date in the log, the sentence “we decided this in September” that cannot say when September’s decision was supposed to be re-examined, and the September decision that was right in September and dangerous in January is the decision that the expiry existed to catch, and the catch happened too late or never.

The expiry’s failure pattern is the decision that outlives its assumptions, and the pattern is worth drawing because it is walked by competent people for honorable reasons. The decision was right, the people who made it were careful, the evidence was the best available, and the decision worked, and then the world changed, quietly, the rate slipped, the regulator moved, the operator re-timetabled, and the decision that was right became wrong, and the people who made it became its defenders, not because they are dishonest, but because the decision is their work, and the work is their identity, and the re-examination feels like the repudiation. The chapter 22 threat bias, the loss aversion, the chapter 25 identity, all the human machinery the book has built, converge on the decision that has expired, and the expiry is the institutional counterweight, the date that was set when the decision was made, by the people who made it, when they could still see their own assumptions, the date that turns the re-examination from the repudiation into the routine, the scheduled look, the confirmation, the revision, or the reversal, with the record.

The expiry has the machine’s boundary, the same one the book has drawn: the machine can draft the calendar from the log, the decisions with their review dates, the overdue reviews, the flags, and the flag is useful exactly as a flag, the first pass that makes the review look. The review itself — the reading of whether the decision still holds, the confirmation, the revision, the reversal, and the record — is human, because the review is the judgment about the world, and the judgment does not delegate.

The expiry lands at Meridian in the log the steering committee keeps. The decision to authorize the referral change with conditions gets its expiry at the pilot’s review, the date the pilot’s evidence decides whether the rollout continues on the plan or the plan changes. The decision to hold the December gate gets its expiry at the certification date, the date the assessment’s outcome decides whether the gate holds. The decision to run the final wave’s training on the new form gets its expiry at the last cohort’s completion, the date the competency evidence decides whether the clinics open trained or the hypercare carries the reinforcement. The decision log’s dates are the governance’s calendar, the reviews the committee holds because the decisions said so, the instrument that keeps the decisions honest the way the forecast’s triggers keep the forecast honest, because the decision that is made and dated and reviewed is the decision that the project can trust, and the decision that is made and never revisited is the decision that the project will defend until it breaks.

Escalation is a decision request

The triage sends the item above the authority to the formal path, and the formal path sends the item above the project’s authority — the body that can decide, the sponsor, the steering committee, the regulator, the executive — to the escalation, and the escalation is the fifth instrument of the chapter, and its discipline is the quality of the request, because escalation is not the transfer of the problem, it is the request for the decision, and the difference is the whole craft.

The escalation is the chapter 28 brief in control form, and its minimum viable shape is the sentence that carries the decision: the context, what the item is and where it came from; the evidence, what the project has learned and tried; the options, the ways forward with their costs and their dates; the recommendation, the option the project’s judgment favors and why; the decision needed, the specific question the receiver must answer; and the deadline, the date by which the answer must arrive, set by the item’s urgency, not by the receiver’s convenience. The escalation that carries the six carries a decision the receiver can make in the time available, and the escalation that omits any of the six transfers the work: the context omitted means the receiver must reconstruct the project from memory, the evidence omitted means the receiver must trust the tone, the options omitted means the receiver has no choice, the recommendation omitted means the receiver has no judgment to react to, the decision needed omitted means the receiver does not know what is being asked, and the deadline omitted means the receiver has no clock, and the transfer without the clock is the delay that nobody owns.

The escalation clock is the instrument the book has carried since chapters 27 and 30, the rule that bounds the wait: the blocked item escalates past its owner on a stated clock, the hours for the item that touches the floor, the days for the item that stops a stream, the week for the structural block, and the escalation carries the record — what is blocked, what was tried, what is needed — to the person with the authority and the date by which the answer is due. The clock is the escalation’s enforcement, and the enforcement is the difference between the escalation that is answered and the escalation that is filed, because the escalation without the clock is the letter that arrives and waits, and the letter that waits is the decision that is delayed, and the delay is the drift in its slowest form.

The escalation has its failure patterns, and the chapter names four because the escalation is where the control system most often decays into the human theater. The dumper escalates the problem without the decision request, the message that says “the hospital has not confirmed, please advise,” and the receiver must do the project’s thinking before the receiver can do the deciding, and the dumped escalation is the project’s judgment gap wearing the receiver’s calendar. The vacuum accepts the escalation and never answers, the escalation that was received and filed and forgotten, and the vacuum is the control system’s hole, the answer date set and missed, the owner changed and not recorded, and the field signal is the escalation that the project has to chase, the second escalation asking where the first one went, the cost of the vacuum paid in the relationship and the delay. The escalator escalates everything, the person who sends every decision upward because the upward decision is safer than the owned one, and the escalator is the delegation map’s failure, the authority that was granted and returned, the chapter 26 lesson in escalation form, and the field signal is the queue of escalations from the one owner, the reviews that decide the trivial because the consequential was sent away. And the escalation theater escalates nothing, the meeting that agrees to escalate and never sends, the decision that was supposed to go to the committee and was made in the corridor anyway, and the theater is the formal path’s decay, the record that says escalated and the decision that says made, the two documents disagreeing, the drift between the process and the act.

The escalation’s quality bar is the sentence the chapter repeats because it is the whole instrument: never escalate a problem without a decision request, and never accept an escalation without an answer date, and the record carries both, because the escalation is the control system’s last seam, the boundary between the project and the body that can decide, and the seam is only as strong as the requests that cross it, the decision requested, the date given, the answer recorded, the loop closed.

The escalation lands at Meridian where the policy’s path crosses the project’s authority, in the steering committee that must decide the change, and the escalation is the decision brief the impact assessment produced: the eight dimensions, the options, the recommendation, the decision needed, approve with conditions, and the deadline, the date by which the pilot must start if the training is to reach the final cohorts. The committee receives the escalation as a decision request, not as a problem, and the difference is the chapter’s whole instrument in the room: the committee can decide in the time the deadline leaves, because the assessment did the work, and the committee that can decide is the committee that will decide, and the decision that is made on the assessment is the decision that the record can carry — the decision log entry with its expiry, the baseline-change record if the baseline moves, the configuration update, the verification, the audit, the whole path of the chapter closing on the decision the escalation requested.

The baseline is a promise, the forecast is a bet

The change is authorized, and the last instrument of the chapter is the one that keeps the project’s two documents honest through it all, the baseline and the forecast, the promise and the bet, the separation the book has defended since chapter 31 and that the control system exists to protect, because the change control is not the paperwork, it is the machinery that keeps the promise from drifting and the bet from freezing.

The baseline is the promise with a process: the authorized model of the work, the scope, the schedule, the budget, the measurement rules, the thing that moves only through authorized change, and the baseline-change record is the instrument of its movement — the before, the after, the reason, the authority, the date, the record that says when the promise changed and who changed it and why. The forecast is the current evidence-based expectation, the bet on the future, built from the actuals, the trends, the assumptions, revised on the cadence, and the forecast is the instrument of its movement, the windshield of chapter 38, the range, the assumptions, the triggers, the revision. The change control’s discipline is the separation of their movements: when the change is authorized, the baseline moves through the record, and the forecast recomputes from the new evidence, and when the change is rejected, the baseline holds, and the forecast still moves if the evidence moved, because the evidence does not wait for the change.

The two diseases are the ones chapter 31 named and the control system exists to prevent. The baseline drift is the promise that quietly moves to match the model, the schedule re-baselined without the record, the scope absorbed without the change request, the outcome edited one item at a time, and the drift’s field signal is the baseline that no one can reconstruct, the plan that says one thing and the field that does another, the question “when did this change?” that has no answer in the record. The frozen forecast is the bet that holds to match the promise, the forecast that stops moving because the baseline must hold, the date that is defended past the evidence, the chapter 38 theater in control form, and the freeze’s field signal is the forecast that has not moved while the actuals have, the windshield that stopped showing the road, the report that explains the month and never commits to the future. The change control is the discipline between the two: the change that is authorized moves the baseline with the record and the forecast follows, the change that is rejected leaves the baseline and the forecast still follows the evidence, and the project that does both, the record and the recompute, is the project whose promise and bet are both true, the model honest because the promise is protected, the promise honest because the model is recomputed.

The Meridian change is the worked case, and its movement is the chapter’s whole discipline in one decision. The referral policy is authorized with conditions, and the baseline moves where the authorization says: the platform backlog gains the field and the interface element, the workflow standard gains the procedure in its next issue, the training plan gains the procedure in the final cohorts, the acceptance criteria gain the readiness row, the configuration register gains the six artifacts in their new revisions, and the baseline-change record carries the movement — the before, the after, the reason, the authorization, the date. The forecast recomputes from the same decision: the integrated forecast of chapter 33, the wave gate in December, the streams’ rates, the migration’s twelve and a half weeks, the certification’s eight, the training’s final cohorts, now carrying the change’s dates, the platform’s four weeks, the workflow’s four, the pilot’s two-week run, and the forecast’s answer is the range the steering committee hears — the gate holds in the base case, the change done by the first of January on the conditions, the pilot’s evidence the trigger that moves the plan if it fails — and the forecast page carries the change the way the baseline carried it, the promise and the bet moving together, each with its record.

The record is the chapter’s closing instrument, and its discipline is the one the whole book has carried: the record is the project’s defense against its own drift — the change request, the impact assessment, the decision record with its expiry, the baseline-change record, the configuration register, the escalation with its answer date, the verification evidence, the audit finding, the record that makes the project auditable, the chapter 30 lesson in control form. The record’s failure is the record that is filled and filed and never read, the museum, the register that lists the versions and never informs the field, the decision log that holds the decisions nobody consults, because the record that is not read is the record that does not exist, and the audit that reads it is the record’s resurrection, the independent check that the field matches the record and the record matches the field, the loop of the chapter’s visual closed: new information, triage, the path, the decision, the record, the audit, and the audit’s finding the evidence that the next piece of new information will be routed by.

The steering session

The change request reaches the steering committee on the first Friday of December, three weeks before the wave gate, and the session is the chapter’s resolution, the room where the instruments the chapter built are used for what they were built for, the decision made on the assessment, the record written as the decision is made, the baseline moved with the record, the forecast recomputed, the configuration updated, the verification and the audit scheduled, the whole path run in one meeting.

Elena Marchetti, the sponsor, reads the change request first, because the sponsor owns the commitment, and the request carries what the intake should have carried in November: the current state, the discharge form without the field and the handoff without the confirmation; the proposed state, the new form, the new field, the new procedure, the six documents, the five streams; the reason, the district’s policy, mandatory from the first of January, the certification’s audit trail, the access outcomes. Each owner carries their stream’s part — Marcus the field and the interface element riding the release, Hana the procedure through the clinical review, Sam the final cohorts trained on the new form, Nora the readiness row and the pilot’s evidence, Esther the audit trail recording what the field records — and the seam owner integrates the dates.

The committee runs the triage the room already ran, and the triage has not changed: urgency, the first of January; impact, the six documents; reversibility, the pilot; authority, this room. The decision is the one the assessment prepared: approve with conditions, and the conditions are the assessment’s own rows — the field rides the next release, the workflow standard through the clinical review, the final cohorts trained on the new form, the pilot at the existing clinic from the week after the session, the readiness row in the wave gate’s definition of done, the audit trail amended before the certification, and the change done when the slowest stream is done, the seam owner integrating the dates. The option to defer the whole policy until after the wave is rejected, because the policy is mandatory from the first of January and the deferral would hand the new year over on the old form, the chapter 33 ordering in decision form, the mis-routed referral discovered in January. The option to fast-path the change as a software change is rejected, because the software change was never the change, it was the tip, and the tip without the footprint is the six documents drifting apart.

The record is written in the room: the decision record in the chapter 4 form — the context, the options, the evidence, the decision, the triggers that would reopen it, the pilot’s failure, the hospital’s rejection, the certification’s finding, and the expiry, the pilot’s review date, the certification date, the last cohort’s completion date, the dates that the committee will meet because the decisions said so. The baseline-change record carries the movement: the backlog, the standard, the training plan, the acceptance criteria, the configuration register, the before, the after, the reason, the authorization, the date. The forecast page recomputes: the gate holding in the base case, the change’s dates on the page, the pilot as the trigger, the first of January as the commitment, the range spoken, the assumptions named. And the audit is scheduled, the configuration audit before the gate, the independent check that the six artifacts carry the field, the field works, the register is true, the certification evidence complete, the audit’s finding the change’s final verification.

The session closes the way the control system closes, not with the applause but with the record, and the room’s own measure of the session is the one the chapter taught: every piece of new information that arrived in the room — the policy, the platform’s dates, the workflow’s review, the training’s cohorts, the acceptance’s row, the certification’s calendar — was routed through a path, named for what it was, assessed for what it touched, decided by the body with the authority, recorded with its expiry, and carried by the configuration, and the change that was logged as a software change in November is, by the first Friday of December, a change that the project can trace from the policy to the field, the assessment, the decision, the baseline movement, the configuration update, the verification, and the audit: one change, one record, the path made.

Control is the path

The durable principle of the chapter is the one the corridor learned in the seam package, the clinic learned in the referral policy, and every project learns when the new information arrives: new information is not the project’s disruption, it is the project’s fuel, and mastery is not the prevention of the change, it is the path from the evidence to the decision, the intake that names the item, the triage that routes it, the fast path and the formal path that carry it at the speed its stakes allow, the impact assessment that walks the eight dimensions, the threshold that says who may decide, the configuration system that carries the change through every document it touches, the decision log with its expiry dates that keeps the choices honest as the future arrives, the escalation that requests the decision instead of transferring the problem, and the baseline and the forecast kept true through it all, the promise moved with the record, the bet recomputed with the evidence, the audit closing the loop. The path is the control, and the control is the record, and the record is the trust.

The most common next failure is the one the room will face in the weeks after this chapter ends, and it is the failure every control system faces when the path has been built: the decision made and the record written and the review skipped, the change authorized and the verification deferred, the configuration updated and the audit scheduled and the schedule broken, the pilot’s evidence arrived and the meeting not convened, the expiry date passed and nobody noticed, the escalation answered and the answer not acted on — the system that was built and then believed. The chapter 31 warning holds: the baseline is not the work, it is the model of the work, and the control system is not the decision, it is the path to the decision, and the path must be walked, every item, every time, because the item that is not walked is the item that will travel sideways, through the corridor, until the drift between the documents and the field is discovered at the gate, at the moment when the cost is highest. The discipline is the walking, and the cadence is the walk’s clock, and the audit is the walk’s check, and the project that walks the path is the project that can answer the auditor, the sponsor, the regulator, and the field with the same record, and the answer is the trust.

And the next chapter turns from the path to the telling: once the decision is made and the record written, the project must report it, with candor, with data used wisely, and with the machine applied where it helps and kept from the judgment it cannot hold — the KijaniPay risk summary that a machine drafted and that invented a control and omitted a data-residency issue — the reporting discipline that turns the control path of this chapter into the decision support of the next, because the path that is not reported is the path that is not trusted, and the report that hides the range, the assumption, the decision, and the confidence is the report that has rebuilt the wall the control system exists to tear down.

Practice

One. A quick check: name the item and its home. For each sentence from a project, name what kind of item it is, issue, risk, defect, change, decision, or action, name its home, and name its verb. (a) “The hospital has rejected the message format we proposed.” (b) “The regulator may require longer retention of referral records under the new guidance.” (c) “The discharge form asks for a ward number the hospital no longer uses.” (d) “The district has announced the handoff procedure will change again next quarter.” (e) “We will pilot the new form at clinic three before the gate.” (f) “Update the training materials for the final cohort by Friday.”

(a) is an issue: the rejection happened, the condition exists now; home, the issue log; verb, resolve, with an owner and a date. (b) is a risk: the retention requirement may arrive; home, the risk register; verb, respond, with a trigger, the guidance’s publication, and an owner. (c) is a defect: the form fails its requirement; home, the nonconformance record; verb, dispose, rework the form, with the disposition decided by the authorized party. (d) is a change: a proposed modification to the agreed handoff procedure; home, the change request; verb, assess and authorize, because the announcement is the trigger for the assessment, not the authorization itself. (e) is a decision: a choice that has been made; home, the decision log; verb, decide, with the record, the context, the options, the evidence, and the review date. (f) is an action: a task with an owner and a date; home, the action log; verb, do, with the evidence of the doing. The common error in all six is naming the item by its topic — the referral, the regulator, the form — and missing the verb, because the verb is the home, and the home is the path.

Two. A field drill: write the triage rule for your own project. Take the project you lead, or the one you work on, and write the control system’s door on one page. (a) Name the six homes, the issue log, the risk register, the assumption log, the dependency register, the decision log, the action log, and the change path, and say which of them exist today and which are corridors, the items that travel by memory instead of by register. (b) Write the four triage questions with the project’s own answers: what makes an item urgent, what counts as the footprint, what is reversible, and who may decide at each level, the stream owner, the lead, the committee, the sponsor, the executive. (c) Write the thresholds in the project’s own units, the cost below which the stream owner decides, the schedule impact below which the team re-sequences, the scope crossing that goes formal, the floors that never move without the gate, and say which thresholds are written and which are informal. (d) Write the fast path and the formal path for the project, the fast path’s record, the formal path’s sequence, the change request, the impact assessment, the decision, the baseline-change record, the configuration update, the verification, the audit, and name the seam the paths do not cover.

The drill passes when the page is specific and dated. The most common failure is the page that names the registers and the paths and leaves the thresholds vague, the cost limit unwritten, the authority unstated, because the threshold is the instrument that makes the path real, and the threshold that is not written in units is the threshold that will be written by the first change. The second failure is the page that describes the system the organization believes it has, the registers that exist on the intranet and the decisions that are still made in the corridor; the drill’s test is the five questions a stranger could answer from the page: who decides a change of 10,000 units, who decides the schedule slip of a week, who decides the floor, what is the fast path’s record, and when does the decision expire. The third failure is the page that names the formal path and no fast path, or the fast path and no formal path, and the repair is the same in both: the threshold that says which is which, because the path is not the point, the routing is the point, and the routing is only as real as the threshold.

Three. A field drill: run the eight-dimension impact assessment. Take a change that is facing your project, or one that recently landed, and run the assessment this chapter worked for the referral policy. Write one paragraph per dimension, value, scope, schedule, cost, quality, risk, operations, and benefits, with the evidence for each answer, and mark each answer as evidence or assumption. Then write the footprint, the list of every document, stream, floor, and commitment the change touches, and the option set, two or three ways forward with their costs and their dates, and the recommendation with its conditions, and the decision the authorized body must make.

The drill passes when the footprint is written before the price. The most common failure is the assessment that starts with the cost, the change priced and the streams never walked, because the price is the last thing the eight dimensions reveal, and the change that is priced and not footprinted is the change that will be discovered mid-delivery wearing the unassessed cost. The second failure is the assumption written as evidence, the sentence “the team can absorb this” with no owner and no date, and the repair is the marking: the evidence named for its source, the assumption named as an assumption with its owner and its trigger, because the decision that is made on the assumption is the decision that expires when the assumption does, and the expiry is the log’s job. The third failure is the assessment that walks the dimensions and never lands on the decision, the eight paragraphs and no recommendation; the repair is the last page, the options, the recommendation, the conditions, and the decision needed, because the impact assessment is a decision instrument, and the assessment that does not end in the authorization is the path that stops at the evidence.

Four. A decision room: the operator’s notification. It is month twenty-three at BlueLine, and the operator’s general manager attends the control review with a notification, not a change request: the operator will re-timetable the buses from the next service change, reassigning buses to gates and changing the peak-hour load on the ticketing-to-traffic interface, the seam that chapter 20 let under the shared-savings contract, whose specification defined the message format and never the load profile, and whose dry run at design load is scheduled for month twenty-four. The notification has no form, no footprint, no impact assessment, and the operator is certain it is not the project’s business, the timetable belongs to the operator. The options: (a) accept the notification as the operator’s business and record it in the minutes, the timetable is the operator’s and the dry run will test what it tests; (b) treat the notification as a change to the interface’s environment, run the impact assessment, the load profile, the specification, the dry run at the new design load, the certification evidence, the acceptance criteria, and route it through the formal path with the operator as the change’s joint owner; (c) demand a formal change request from the operator before the project does anything, because the timetable is the operator’s and the form is the project’s; (d) fast-path it, note the load change in the interface register and watch the dry run. Decide the move, defend the trade, and say what the record must carry.

The defensible answer is (b), and the reasoning is the chapter’s instruments in order, and the corridor’s own history is the forecast this decision can prevent, because the seam’s true story is already in the record of chapter 31, the dry run that failed at design load in month twenty-four, NCR-031, because the load profile was never specified and the re-timetabling was never registered. The intake names the item: the re-timetabling is a change to the interface’s environment, the load profile is a controlled property of the seam, the property that was never identified, and the identification is the repair. The triage: urgency, high, the service change is dated and the commissioning window is short; impact, wide, the specification, the dry run, the certification evidence, the acceptance criteria, the operator’s own operations; reversibility, low, the timetable once changed is costly to re-change, and the dry run once failed is the failed evidence; authority, the change crosses the project-operator boundary and the map names no single owner, so it escalates with the decision request. The impact assessment walks the eight dimensions: the load profile is the quality and the risk and the operations dimension in one, the dry run at the new design load is the verification, and the operator is the joint owner because the seam is owned by the seam, the chapter 20 lesson in control form. (a) is the chapter 31 failure in its original shape, the environment change absorbed without a record, the minutes as the register that never registers, and the dry run at the old design load as the verification that tests the wrong load, the failed dry run that the corridor actually lived; the minutes are not the configuration register, and the timetable that belongs to the operator still changes the load that belongs to the seam. (c) is the form worship that costs the relationship, the demand for the operator’s form when the project’s own instrument, the interface register, is the home the change needs, and the demand that makes the operator the enemy is the escalation that the chapter refused to teach. (d) is the fast path for a formal item, the note that is not an assessment, the dry run as the experiment, and the failed dry run is the expensive verification, the chapter’s argument that the fast path is for the reversible, and the load profile is not reversible inside the commissioning window. The record must carry the re-timetabling as a change to the interface’s environment with the joint owner, the impact assessment with the new load profile, the specification amendment through the configuration register, the dry run at the new design load scheduled with its evidence, the decision record with its expiry at the dry run’s date, and the baseline-change record if the specification’s change moves the baseline, because the corridor learned the lesson once, and the repair is the path, the chapter 31 repair made whole by the chapter 39 machinery.

Five. A decision room: the regulator’s field. It is August at KijaniPay, and the regulator has notified the platform that the settlement report must include a new data field, the transaction’s originating channel, from the next reporting period, which is nine weeks out. The platform runs two-week cycles, the settlement report is a floor, the settlement promise of 99.5 percent and the audit trail that the regulator inspects, and the new field touches the report’s schema, the settlement pipeline, the reconciliation checks of chapter 21, the audit trail, and the support team’s exception work. The product lead has already sized it as a small backlog item, one cycle, and the natural instinct is to let it ride the next iteration like any other item. The options: (a) fast-path it, add the item to the backlog, the small field rides the iteration, the regulator’s date met by the report’s deadline, no further governance; (b) treat it as a floor-touching change and run the formal path, the impact assessment across the eight dimensions, the settlement promise, the audit trail, the reconciliation, the support, the decision by the product council with its conditions, the verification against the regulator’s acceptance, the record; (c) defer it to the iteration after the reporting period and send the report with the current schema, on the argument that the regulator’s notice is guidance and the field can follow; (d) escalate the notification to the executive as a compliance matter and let the executive direct the work. Decide the move, defend the trade, and say what the record must carry.

The defensible answer is (b), and the reasoning is the threshold’s logic. The adaptive environment’s baseline is the outcome commitment, and the settlement report is a floor, the audit trail that the regulator inspects, the row of the obligations register that never degrades into a provisional, and the change that touches the floor is the change that goes formal regardless of its size, the chapter’s rule in its sharpest form, because the floor is not the size of the field, it is the consequence of the field failing, the regulator’s finding, the settlement promise’s evidence, the trust that the audit trail carries. The impact assessment walks the dimensions: the value, the regulator’s trust and the merchants’ settlement; the scope, the schema, the pipeline, the reconciliation, the audit trail; the schedule, nine weeks, four cycles, comfortable if the decision lands this week and expensive if it lands in the week of the deadline; the cost, the schema change, the reconciliation rule, the support team’s exception work; the quality, the field must reconcile to zero unexplained gaps like every other field, the chapter 21 discipline; the risk, the field that is added and not reconciled, the exception that appears in the report’s first period; the operations, the support team that will answer the merchants’ questions about the new field, the exception handlers; and the benefits, the settlement promise held and the regulator satisfied. The decision by the product council with its conditions, the field in the next release, the reconciliation rule updated, the audit trail verified against the regulator’s acceptance, the support team briefed, and the expiry at the reporting period’s date, the review that confirms the field works in the regulator’s eyes. (a) is the fast path for a floor item, the small change that rides the iteration because it is small, and the size is the wrong measure, the floor is the measure, the chapter’s argument in one decision. (c) is the deferral that converts the guidance into the failure, the report sent without the field and the regulator’s finding the verification that the project did not schedule, the frozen compliance wearing the backlog’s clothes. (d) is the escalation that bypasses the path, the compliance matter that the executive decides without the assessment, and the executive’s decision without the assessment is the corridor decision wearing the executive’s rank, the chapter 4 lesson in control form. The record must carry the notification as the change request’s trigger, the impact assessment with the eight dimensions, the council’s decision with its conditions, the backlog item with its release and its acceptance evidence, the verification against the regulator’s acceptance, and the decision log entry with its expiry at the reporting period’s date, because the adaptive clock’s change control is the threshold between the means and the commitment, and the floor is the commitment’s edge.

Six. The mastery drill: route ten items to the correct control path. A regional health network is opening its final clinics in December, with the referral policy due from the first of January, the case of this chapter. Route each of the following ten items to its correct control path: name the item’s kind, issue, risk, defect, change, decision, or action, name its home, and name the path, fast or formal, with the authority that decides. (1) A clinic reports that the current referral form asks for a ward number the hospital no longer accepts. (2) The regulator’s new audit guidance may require storing referral records for two additional years. (3) In the January hypercare, a patient handoff is mis-routed because the clinician used the old form. (4) A super-user requests a larger font on the new referral form for readability at the desk. (5) The district announces the handoff procedure will change again, effective the following quarter. (6) The hospital’s interface team has not yet confirmed it can receive the new message format. (7) A clinician proposes an urgent-referral flag on the form to speed emergency handoffs. (8) The steering committee must decide whether to run the one-clinic pilot before the wave gate. (9) Sam’s training plan must be updated with the new handoff procedure for the final cohort. (10) A vendor proposes substituting an alternative mapping tool that would change the hospital interface specification.

The drill passes when the routing is argued from the chapter’s four questions. (1) is an issue: the form asks for a field the hospital rejects; home, the issue log; path, fast; authority, the workflow owner; verb, resolve, because the correction is within the form’s owner’s authority, recorded and verified at the point of work. (2) is a risk: the retention requirement may arrive; home, the risk register; path, fast; authority, the risk owner; verb, respond, with the trigger, the guidance’s publication, and the retention plan as the response, because the effect is uncertain and the response is managed, not resolved. (3) is a defect: the handoff mis-routed; home, the nonconformance record; path, fast; authority, the quality lead with the disposition; verb, dispose, rework — the clinician retrained, the process corrected, the record closed with the disposition and the evidence, because the defect is a decision, not a discussion. (4) is a change: the font change is small, reversible, within the form’s owner’s authority; home, the change request; path, fast, below the threshold; authority, the workflow owner; and it is recorded and verified, the fast path’s discipline, not the shortcut. (5) is a change: a proposed modification to the agreed handoff procedure; home, the change request; path, formal; authority, the steering committee, because the change crosses the streams — the workflow, the training, the data, the acceptance — and the floor, the audit trail, and the impact assessment must run before the authorization, with the date’s cost assessed like the first policy. (6) is a dependency: a thing the project needs and does not control; home, the dependency register; path, fast with the clock; authority, the seam owner; verb, confirm, with the owner and the date, and if the confirmation does not arrive on the clock, the dependency escalates with the decision request, because the dependency without the clock is the delay that nobody owns. (7) is a change: the urgent-referral flag is the chapter’s footprint in miniature; home, the change request; path, formal; authority, the steering committee, because the flag crosses the streams and touches the handoff procedure and the acceptance, and the impact assessment walks the eight dimensions before the committee decides — the option set, the pilot, the staged rollout, the rejection with the record. (8) is a decision: a choice that must be made; home, the decision log; path, formal; authority, the steering committee; verb, decide, with the record, the context, the options, the evidence, the decision, and the expiry at the pilot’s review date, because the pilot is a bet on the handoff, and the bet is re-examined at its expiry. (9) is an action: a task with an owner and a date; home, the action log; path, fast; authority, the training owner; verb, do, with the evidence of the doing — the updated materials, the cohort’s completion — because the action is the training’s part of the approved change, and the action without the owner and the date is the hope. (10) is a change to a controlled item: the hospital interface specification is a configuration item; home, the change request with the configuration impact; path, formal; authority, the platform lead within the change’s threshold and the steering committee above it, because the substitute tool changes the interface specification, the message format, the verification, the audit trail, and the certification evidence, and the change to the configuration item flows through the change process even when it looks like a vendor’s convenience, because the small change is the one that is absorbed without a record, and the unrecorded change is the drift. The common errors in the ten are the ones the chapter named: the item routed by its topic instead of its verb, the small change fast-pathed because it is small when it touches a floor, the dependency filed as a risk with no clock, the action assumed to be someone else’s, and the configuration item changed without the change path, and the repair is the same in all ten: the four questions, the verb, the home, the threshold, the authority, because the routing is the mastery, and the mastery is the path.

Seven. The transfer question. On the project you lead, or the one you work on, what is the door: where does new information enter, and does it enter through the register or through the corridor — the conversation, the inbox, the meeting that never wrote the item down — and what arrived last week and traveled sideways, and what did the sideways travel cost? Can you name the last ten items that arrived, and their kinds and homes, or are they all in the one drawer, the register that holds the issue and the risk and the hope, asking them all for the same verb? What are your thresholds, written in units, and who may decide what, and which change was approved above its authority, and did the record notice? What are your controlled items, and is the version the field uses the version the register authorizes, and when did a document quietly stop being true, and what did the drift cost — the load profile, the timetable, the field, the form? Do your decisions have expiry dates, and when did you last re-examine a decision because the log said so, and what is the decision you are defending that the world has quietly changed, and who set its review date? What did you escalate last, and did the escalation carry the decision request, the options, the recommendation, the deadline, or did it transfer the problem, and what did the receiver have to reconstruct, and what did the answer cost in the waiting? Does your baseline move only through the record, and does your forecast move with the evidence, or is one drifting and the other frozen, and can anyone reconstruct when the promise last changed, and by whom, and why? And the question underneath all of them, the one the clinic learned in November and the committee learned in December: when new information arrives, is there a path from the evidence to the decision, and is the path walked, every item, every time, because the durable principle of this chapter is the one the corridor and the clinic and the platform all prove: new information is the project’s fuel, the intake names the item, the triage routes it, the threshold says who may decide, the assessment walks the eight dimensions, the configuration carries the change through every document, the decision log holds the choices with their expiry dates, the escalation requests the decision, the baseline and the forecast stay true, and the audit closes the loop — and the project that walks the path can answer for its changes with the record instead of the memory, and the record is the trust. The most common next failure is the one the room will face in January: the pilot’s evidence comes back and the meeting is not convened, the expiry date passes and nobody notices, the change is delivered and the verification is skipped, the system is believed because it exists, and the belief is the drift, which is why the control has its cadence, its expiries, its verifications, and its audits — the instrument that is built and not walked is the instrument that becomes the museum. And the next chapter turns from the path to the telling: the decisions of this chapter, the forecasts of the last, and the evidence of the whole part must be reported, with candor, with data used wisely, and with the machine applied where it helps and kept from the judgment it cannot hold — the reporting discipline that turns the control system of this chapter into the decision support of the next, because the path that is not reported is the path that is not trusted, and the report that hides the range, the assumption, the decision, and the confidence is the report that has rebuilt the wall the control system exists to tear down.*

Notes

• The composite cases remain author-created illustrative material. The Meridian November platform review, the referral pathway policy sitting in the platform backlog as a software change, the change request and its eight-dimension impact assessment, the threshold routing across the five streams, the six-artifact configuration footprint of the referral field, the steering session on the first Friday of December, the pilot at clinic three, the decision log entries with their expiry dates, the configuration audit before the wave gate, and all named characters are teaching constructions consistent with the facts established in earlier chapters: the six-clinic program, the shared platform, the grant window at month thirty-six, the December wave gate, the clinic-month economics of two hundred fifty thousand units, the referral pathway policy mandatory from the first of the new year, logged as a software change, touching the workflow standard, the training, the data fields, and the acceptance, from chapters 5, 13, and 33; the platform’s two-week cycles at three items a cycle, the migration at forty-one thousand of sixty-six thousand records, the training at three of six cohorts with the double-booked super-users, the certification subject to the sub-processor amendment, and the five streams, from chapter 33; the wave gate’s definition of done with its five windows and five owners and one gate, from chapters 24 and 29; the adoption corridor and the competency check at the point of work, from chapter 11; the obligations register, the floors, the privacy certification, and the audit trail, from chapter 24; the baseline-change record, the configuration register, the nonconformance report, the concession, and the rule that the baseline moves only through authorized change, from chapter 31; the decision record in the chapter 4 form and the decision log of chapter 27; the escalation clock, from chapters 27 and 30; the risk register, the issue log, the assumption inventory, and the dependency discipline, from chapters 22 and 34; and the forecast as the windshield with its range, assumptions, and triggers, from chapter 38. The BlueLine operator’s re-timetabling, the load profile that was never specified, and NCR-031 are established facts from chapters 20 and 31, and the decision room’s treatment of the notification is a teaching construction that repairs them through this chapter’s path. The KijaniPay regulator’s reporting field and the reporting period nine weeks out are an author-created teaching scenario consistent with the settlement promise guardrail of 99.5 percent, the reconciliation discipline of chapter 21, and the adaptive control of chapters 30 and 32. The teaching numbers introduced here, the policy’s fifty days to the mandatory date, the platform’s four weeks, the workflow’s four weeks with the clinical review, the pilot’s two-week run, the final cohorts’ timing, and the wave gate three weeks after the steering session, are author-created teaching constructions stated with their assumptions, consistent with the established gate and cycle facts. The standards and sources are described in the book’s own words: the configuration-management discipline, identification, status accounting, configuration verification, and configuration audit, follows the general framework of ISO 10007:2017, Quality management: Guidelines for configuration management, as introduced in chapter 31, described here at the level of its existence and purpose in the author’s own words, with the historical note that the discipline matured in mid-century aerospace and defense programs, a general characterization, not a claim about any specific program; the general guidance on monitoring and control, changes, and configuration as ongoing parts of project management practice follows ISO 21502:2020, Project, programme and portfolio management: Guidance on project management, described entirely in the author’s own words; the PMBOK Guide, Eighth Edition (Project Management Institute, November 2025), per the book’s reference baseline of 1 August 2026, treats change, configuration, and decision-making among its general practice frames, described here in the author’s own words as general frames rather than quoted; the RAID-and-decision model, the six kinds of incoming information, the triage by urgency, impact, reversibility, and authority, the fast path and the formal path, the eight-dimension impact assessment, the change threshold, the decision expiry, and the escalation quality bar are the author’s own method-neutral instruments, named and described in this book’s own words; the risk, issue, assumption, and dependency vocabulary follows the treatment established in chapter 22, in the author’s own words. This book remains independent of PMI, ISO, and all standards bodies, and no proprietary certification manual, commercial text, or framework guide is reproduced or paraphrased here.