Page 232 - CyberSecurityEssentialsEnglish

distinguish a final figure from a provisional one, and it had no authority to choose a
recommendation on behalf of the decision owner. Quality therefore depended on the
attentiveness of whoever happened to be doing it, rather than on a workflow that could be

handed over, trained, and reviewed.

Mapping the as-is workflow revealed five weaknesses: some inputs arrived late, file names
were inconsistent, there was no dictionary for the fields, facts were mixed with

interpretations, and there was no clear record of what changed between one version and
the next. Initial measurement found that preparing the pack took about two days, and that
a large part of the time was lost searching for the right source and rewriting paragraphs that

had already been approved.

The to-be workflow began by defining the output: a five-page pack containing an executive
summary, three key indicators, a table of facts and sources, two or three options for the
decision, a risk log, and an action log. Before writing, a source pack is assembled containing

approved versions only, then a small data dictionary explains the fields, then a fact table links
every figure or claim to a source, a date, and a verification status.

The place of AI became specific: it is used to summarize the notes, extract recurring themes,
propose the structure of the summary, and turn decisions into preliminary tasks. The

calculations are performed in the spreadsheet, the figures are checked both automatically
and by a person, and the approval of recommendations stays with the authorized owner.

When confidence in extracting a figure is low, the path moves to an extended review instead
of sending the report directly.

Quality gates were placed at four points: when the inputs are accepted, after the facts are
extracted, before the recommendations are drafted, and before the final send. Each gate

has a short criterion: is the period defined? Is the source approved? Is the figure
comparable? Does the recommendation separate fact from opinion? Does every task have
an owner and a date? These simple questions protected the pack from errors that had

looked small but affected the decision.

After two months of trial operation, the success was not only that AI wrote faster. It was that
the team now knew where the time was lost and where the errors appeared. The time spent
searching for sources fell, rework decreased, and it became possible to hand the task to a

new person with a clear template. The most important lesson: we do not automate the
report; we design a path that makes the report repeatable, verifiable, and improvable.
5.13 Practical Lab: Building a Complete Institutional Briefing Pack
↻ The goal of this lab

To turn a set of notes, documents, a table, and correspondence into a briefing pack that

231