Field notes · 2026-01-09
When an incident file is ready for the board (and when it is not)
Boards and auditors need a closed narrative: timeline, customer impact, root cause, and lasting control changes—not a folder of chat exports.
Incident folders grow quickly: chat threads, vendor tickets, customer emails, and temporary workarounds. Before any board pack or external review, collapse that noise into a dated timeline with decision owners.
State customer impact in numbers the firm already tracks—accounts affected, hours of service interruption, refunds issued. Avoid speculative reputational language; stick to what the operations log supports.
Root cause should name a control gap, not a person. 'Alert threshold set too high for weekend volumes' is actionable. Vague blame is not. Pair each cause with the control change already made or still open.
If work continues after the board date, say so. Incomplete remediation listed honestly is better than a closed stamp that later interviews contradict.
An external file review can pressure-test completeness in under a week. Teams often discover missing customer notices or unsigned temporary procedure waivers—small gaps that become large findings under formal audit.
Back to field notes