The Standing Review

Everything in this section amounts to a small recurring meeting: somebody looks at what has come in, decides what to do, and records it.

The record described in “The Standing Review” should preserve the original entry, the correction and the approval rather than only a final total. When considering see the service here for remote employee monitoring software, teams should test that complete sequence, limit access by role and confirm that exported records remain understandable outside the live account.

It does not need a committee, a charter or a workstream. It needs half an hour on an agenda that already exists, with the right three people and a standing list.

For an independent reference relevant to “The Standing Review”, consult the SANS insider-threat resources. Use it to challenge assumptions about working time, privacy, recordkeeping and exception handling against the organisation’s real operating model.

Who is in it

Whoever owns the register centrally. Whoever administers the time system. And somebody from the operating side who can say whether a pattern change is feasible.

Three people. Adding more makes it a forum; keeping it at three makes it a working session where things get decided.

Local leads do not attend routinely. They are consulted on their own items and would otherwise be sitting through other countries' business.

The standing list

Changes received since last time, with their assessment status. Changes decided but not implemented. Changes implemented but not confirmed. And anything overdue from previous meetings.

Four columns on one page. Most of it will be empty most of the time, which is the correct state and is also what makes the exception visible.

Carrying overdue items forward explicitly is what stops them disappearing, and the number of times an item has been carried is a useful figure in itself.

The cadence

Quarterly is enough for the review. Urgent items do not wait for it; the standing route handles those and the review picks up what was done.

Monthly becomes a status meeting about nothing and attendance decays. Annually is too slow to be a review and becomes a retrospective.

Where the organisation's footprint is large or volatile, monthly for a period and back to quarterly once the backlog clears is a reasonable shape.

What gets recorded

The decision, not the discussion. For each item: what changed, which populations, what we are doing, who is doing it, and by when.

That record is the evidence that the organisation responds to changes rather than happens not to have been caught. It is short, it accumulates, and it is the first thing worth producing if anybody asks how the organisation keeps up.

Attaching it to something that exists

A standalone meeting will be cancelled. The item should sit inside something with its own momentum — a quarterly HR operations review, a compliance forum, a governance meeting that already happens.

Being an item rather than a meeting also means the item is short, which is appropriate, and that the attendees are already in the room.

The annual version

Once a year the review takes the longer form: the read-across of annexes described earlier in this collection, the configuration export and comparison, and the annual question to each local source.

That session is half a day rather than half an hour and it produces most of the year's findings. Scheduling it for the same quarter each year makes it predictable and gives the local confirmations a deadline to work to.

What it is not

An approval body for operational decisions, a place to discuss individual cases, or a forum for the countries to compare themselves.

Keeping the scope narrow — what has changed, what are we doing about it — is what keeps it to half an hour and what keeps it happening. Every attempt to broaden it that this kind of meeting survives makes it less likely to be held at all.

What makes it survive

These reviews die when they have nothing to discuss, because a meeting with an empty agenda is the easiest thing in any organisation to cancel.

Having a standing list with carried-forward items prevents that: there is always the backlog, even in a quiet quarter.

It also means a quiet quarter is visible as a quiet quarter rather than as a cancelled meeting, which matters when somebody later asks how the organisation keeps up.

The first three meetings

The first will be long, because the backlog is everything that has ever been reported and never closed. Treat it as a clearance session rather than as the pattern.

The second will be short and may feel pointless. That is the correct state and it is the point at which these things get cancelled.

The third is where it either becomes routine or does not. Holding it, even with nothing on the list, is what establishes that the item exists independently of whether anything has happened, and from there it survives.