10. Management form of each rule¶
Each row states what a rule means when the "system" is an organization, a team, a project or a process. The IF / THEN / BECAUSE text in section 7 stays valid. Rules P5–P8, P18–P21, P35, P43, P52, P53, P62, P63, P69, P79 come from management sources and are already written for organizations; they are not repeated here. "Cross-reference only" in the Sources column means no management source was found; the transfer is the author's judgment (adoption gap, see section 1).
A. Responsibility¶
| ID | Rule name | Management name | THEN (management form) | Example (platform team / organization) | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P1 | Public safety first | Duty of care and ethics first | put the safety, health and legal rights of people (customers, the public, the own people) above cost, schedule and convenience | the manager stops a launch that would process personal data without a legal basis | ISO 9001:2026 launch: "ethical behaviour"; ISO 45001:2018 | strong |
| P2 | Work within competence | Competence management | give work only to people competent for it, and train them or add an expert otherwise | a team lead without labour-law knowledge asks HR before changing on-call rules | COSO ERM principle 5; ADP 6-0: principle "Competence" | strong |
| P3 | Sustainability | Environmental and social sustainability | include environmental and social impact in decisions across the whole life cycle, including procurement | cloud cost and energy reports reviewed with the budget | ISO 14001:2026 (via 2015 page); ISO 20400:2017; PMBOK 8: "integrate sustainability" | strong (standard text is paid; only the official summary was read) |
| P4 | Stop authority | Speak-up and stop-the-line | let every person raise a concern or stop work without permission and without retaliation; provide a confidential reporting channel and follow up every report | any engineer may pause a release; an anonymous channel exists for legal and ethical concerns | Directive (EU) 2019/1937, Art. 8(3) and recital 88; Deming point 8; Toyota: jidoka | strong (EU law: internal channels required for private entities with 50 or more workers) |
B. Knowledge and decisions¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P9 | Measurable requirements | Measurable objectives | write each objective with a measure, a target, a deadline and one owner, and link it to a customer or stakeholder need | "reduce median time to provision a namespace from 3 days to 1 hour by Q2", owner named | NIMS: management by objectives; Locke & Latham 2002 | strong |
| P10 | Decision records | Decision log | record each significant management decision with its reason, the alternatives considered and the owner | a decision log entry: "move to a shared on-call rotation; rejected: per-team rotation, because…" | COSO ERM principle 8 "Evaluates Alternative Strategies"; ISO 30401:2018 (supports) | moderate |
| P11 | Trustworthy evidence | Proper bookkeeping and records | keep business records so that no change hides the original entry, and so that the organization can demonstrate compliance | budget changes are new entries with author and date, not overwrites | § 239(3) HGB; GDPR Art. 5(2); ISO 15489-1:2016 | strong (German law for bookkeeping) |
| P12 | Model validity | Forecast validity (outside view) | check each estimate or business case against the real outcomes of a reference class of similar past projects, not only against the own plan | the migration estimate is compared with the last five migrations, which overran by 40 % on average | Flyvbjerg 2006 | strong (peer-reviewed) |
| P13 | Automated reproducible results | Reproducible reporting | produce management figures (KPIs, budgets, forecasts) through automated, documented steps from named data sources | the DORA dashboard is generated from pipeline data, not from a hand-edited spreadsheet | COSO ERM principle 18 "Leverages Information Systems" | moderate |
| P14 | Provenance | Supplier due diligence | know each supplier and the risks in its own supply chain, and act on what you find | a SaaS vendor's sub-processors and their data locations are known before signing | OECD Due Diligence Guidance (2018) | strong (OECD guidance; national supply-chain laws exist) |
| P15 | Precaution | Precautionary management action | when serious or irreversible harm is credible but unproven, take a proportionate protective step now | payments to a supplier are paused while a fraud warning is checked | cross-reference only | moderate |
| P16 | Set-based design | Keep strategic options open | evaluate several strategies or options in parallel and drop weak ones as evidence arrives | two vendors run a paid pilot before one contract is signed | COSO ERM principle 8 | moderate |
| P17 | Technology maturity | Maturity of new tools, vendors and methods | assess the maturity of a new tool, vendor or management method before it carries a critical process | a start-up vendor is not chosen for the payroll process without an exit plan | ISO 56001:2024 (supports) | moderate |
C. Design (organization and process design)¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P22 | Failure and interaction analysis | Pre-mortem and portfolio risk view | before starting, assume the initiative has failed and list the reasons; also list how parallel initiatives can interfere with each other | a pre-mortem before a cluster migration finds that two teams plan the same freeze window | Klein 2007 (HBR); COSO ERM principles 10 and 14 | moderate |
| P23 | Simplicity and modularity | Simple structures, few priorities | use the fewest layers, rules, meetings and priorities that meet the objective; stop work that is not needed | one team backlog with one ranked list, not three parallel priority lists | Agile principle 10 | moderate |
| P24 | Lifecycle and decommissioning | Plan the exit at the start | when starting a contract, project, product, data collection or role, plan how it ends: exit clause, closure, sunset, deletion, handover | every vendor contract has an exit and data-return clause; personal data has a deletion date | GDPR Art. 5(1)(e) storage limitation | strong (law for personal data) |
| P25 | Human factors | Work designed for real people | design roles, processes and tools for real people under real conditions: clear roles, plans and goals, and a workload people can carry | each team member can name their role and the team's current goal | Google re:Work: "Structure and clarity" | moderate |
| P26 | Design for testability | Auditable processes | design each process so that its controls leave evidence that a reviewer can sample | access approvals are stored as tickets that an auditor can sample | IIA Three Lines principle 4 (supports) | moderate |
| P27 | Robustness | Robust plans | make plans that still work when assumptions vary within a credible range | the roadmap still delivers its top objective if one engineer leaves | cross-reference only | moderate |
| P28 | Accumulated degradation | Sustainable pace | limit sustained overtime and track debt that builds up slowly (overtime, deferred maintenance, technical debt) | on-call load and overtime are reviewed monthly; no one works above 48 h per week as a pattern | WHO/ILO 2021; Pencavel 2014; Agile principle 8 | strong |
| P29 | Compatibility | Compatibility of teams, processes and cultures | before merging teams, organizations or processes, check that they are compatible, and plan the integration of the differences | before two platform teams merge, their on-call rules and release processes are compared | cross-reference only | moderate |
| P30 | Exact constraint | Single point of accountability, unity of command | give each objective, decision, risk and process exactly one accountable owner; each person reports to one person for a given task | one product owner per backlog; one incident commander per incident | NIMS: "Unity of command means that each individual only reports to one person."; PRINCE2 principle 3 | strong (US federal doctrine) |
| P31 | Design by selection | Controlled experiments | where you cannot predict which option works, test variants with real users, keep the best, repeat | two onboarding flows for the developer portal are A/B-tested | Kohavi & Thomke 2017 | strong |
| P32 | End-to-end | End-to-end ownership of the customer outcome | let the unit closest to the customer verify that the customer outcome is reached, instead of trusting each department's local result | the platform team measures time-to-first-deploy for product teams, not only its own ticket times | Deming point 9 | moderate |
| P33 | Strict interfaces | Explicit agreements between units | state what each unit delivers to the next (contract, service level, definition of ready) and return incomplete handovers instead of silently fixing them | a request without a cost centre is returned, not guessed | ISO/IEC 20000-1:2018 (supports) | moderate |
| P34 | Weakest-link scaling | Rare events become frequent with size | as the organization grows, expect rare events (fraud, misconduct, key-person loss) to happen regularly, and scale controls with size | at 500 people, a once-per-500-person-years event happens about every year | cross-reference only | moderate |
D. Protection¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P36 | Least privilege | Need-to-know and limits of authority | give each person only the information, data and decision authority their role needs; set written limits of authority | spending authority of team leads limited to an amount; personal data visible only to HR | GDPR Art. 5(1)(c) data minimisation | strong (law for personal data) |
| P37 | Fail-safe | Default decisions and fallback authority | define in advance what happens when a decision-maker is absent or a plan fails: deputy, default option, transfer of command | if the change approver is absent, the default is "no change", not "change without approval" | NIMS: "Establishment and Transfer of Command" | moderate |
| P38 | Hierarchy of controls | Hierarchy of controls for management risks | eliminate the risky activity, then substitute, then use system-enforced controls, then policies and training, and personal care last | instead of a policy "do not share credentials", remove shared accounts | ISO 45001 clause 8.1.2 (secondary text) | strong (required in ISO 45001) |
| P39 | Error-proofing | Build quality into the process | make the error impossible in the process (system checks, mandatory fields) instead of relying on later inspection | the purchase system refuses an order without a contract number | Deming point 3 | moderate |
| P40 | Defense in depth | Three lines | use independent lines: first line (management owns risk), second line (risk, compliance, security functions), third line (independent internal audit) | the platform team owns access risk, security monitors it, internal audit tests both | IIA Three Lines Model (2020) | strong |
| P41 | Compartments | Ring-fencing | separate units, budgets or legal entities so that a failure in one does not spread to all | a risky new product runs with its own budget and stop criteria | NIMS: "Modular Organization" | moderate |
| P42 | Two-person rule | Four-eyes principle at the moment of action | require two authorized people for critical, irreversible management actions (large payments, contract signature, dismissal) | a payment above a threshold needs two signatures | NIST: separation of duty (supports); see P43 | strong |
E. Capacity and continuity¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P44 | Margin | Reserves and slack | keep schedule buffers, budget contingency and free capacity of people; do not plan people near 100 % utilization | the team plans 70 % of its capacity and keeps 30 % for unplanned work | Little's law (with P52) | strong |
| P45 | Redundancy (N-1) | Deputies and succession | make every critical function survive the loss of one person: named deputy, trained successor, documented knowledge | each on-call skill is held by at least two people | ISO/TS 30433 succession metrics (via ISO TC 260) | moderate |
| P46 | Diversity | Diverse suppliers and diverse views | avoid a common cause hitting all copies: suppliers in different regions; decision input from people with different views | two cloud regions from different providers for the status page; a red team from another department | UK MoD Red Teaming Handbook | moderate |
| P47 | Graceful degradation | Prioritization and triage under overload | decide in advance which work stops first when demand exceeds capacity, and which activities must resume at a minimum capacity | under overload, feature requests stop first; incident response and security patches continue | ISO 22301:2019 RTO definition (via BCI GPG) | strong |
| P48 | Damping | Stable management cadence | change priorities, structures and plans on a fixed cadence, not on every new signal | priorities change at sprint boundaries, not daily | Scrum Guide: "No changes are made that would endanger the Sprint Goal" | moderate |
| P49 | Induced demand | Parkinson's law | expect work and spending to grow into added time or budget; manage demand as well as capacity | a larger budget is given with an explicit scope, not "more of the same" | Parkinson 1955 (text copy) | moderate (the original is a satirical essay; the general claim is weak, the budget case is widely observed) |
| P50 | Bottleneck first | Constraint first | find the step that limits output (often an approval, a meeting or a specialist) and improve it first | the security review queue is the constraint, so review capacity is added there first | section 9 (theory of constraints) | moderate |
| P51 | Shared demand signal | Share real end demand | give every stage of a chain the real end demand, not only the order of the next stage | the platform team sees product teams' roadmaps, not only tickets | Lee, Padmanabhan, Whang 1997 | strong |
F. Verification and review¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P54 | Verification and validation | Acceptance and benefits review | check that deliverables meet the specification (verification) and that the intended benefit is reached (validation); keep the business case valid during the whole initiative | the developer portal is accepted against its spec, and six months later adoption is measured | PRINCE2 principle 1 "Ensure continued business justification" | moderate |
| P55 | Find defects early | Early review of plans | review plans and business cases before money and people are committed | a one-page proposal is reviewed before a quarter of work is planned | Deming point 3 | moderate |
| P56 | Independent checker | Independent assurance, scaled to consequence | raise the checker's independence with consequence: peer review → independent second or third line → external audit; rotate long-serving external auditors | a team lead's budget is checked by finance; the company's accounts by an external auditor | IIA principle 5; EU 537/2014 Art. 17; UK MoD Red Teaming Handbook | strong (EU law for public-interest entities) |
| P57 | Test as you operate | Pilots and exercises under real conditions | test new processes, plans and organizations in real conditions before full rollout, and exercise continuity plans | a new on-call model is piloted with one team for one month; the continuity plan is exercised once a year | ISO 22301:2019 (supports) | moderate |
| P58 | Comparable measurement | Comparable indicators | define each indicator once (formula, period, population, data source), and show its normal variation before comparing teams or periods | lead time is measured the same way for all teams before teams are compared | ISO/TS 30433: "comparable measures" (via ISO TC 260) | moderate |
| P59 | Traceability | Obligation-to-control traceability | in regulated areas, link each legal or contractual obligation to a control and to a test of that control | each GDPR obligation in the register points to an owner, a control and an audit test | ISO 37301:2021 | strong (regulated areas; standard text is paid; only the official summary was read) |
| P60 | Codes as minimum | Compliance as the floor | meet laws and standards as a minimum, then apply the other rules | working-time law is the minimum; P5 and P28 go further | ISO 37301:2021 | strong (standard text is paid; only the official summary was read) |
| P61 | Qualified procedure and person | Qualified roles | where a result cannot be fully checked afterwards (hiring, audit, investigation, negotiation), use a proven procedure and trained people | only trained interviewers run structured interviews (P62) | EU 537/2014 (approved statutory auditors) (supports) | strong (statutory audit) |
G. Change¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P64 | Versioning and change review | Document control and management of change | version policies, processes and organization charts; review each change for its effects before it takes effect, and inform the people affected | the on-call policy is versioned in git and changed only by reviewed pull request | ISO/IEC 20000-1:2018; COSO ERM principle 15 "Assesses Substantial Change" | strong |
| P65 | Small verified steps | Iterative delivery and management stages | deliver and decide in small steps, and decide at the end of each stage whether to continue | a reorganization is piloted in one department before it rolls out | DORA: small batches; PRINCE2 principle 4 "Manage by stages" | strong |
| P66 | Isolation before work | Protected iteration | while a team works on a committed goal, protect it from unplanned changes; only the accountable owner may cancel the goal | new requests wait for the next sprint unless the Product Owner cancels the sprint | Scrum Guide 2020 | moderate |
| P67 | Critical path | Critical path | identify the longest chain of dependent tasks and protect it first | in an office move, network installation is critical; furniture has slack | section 9 (critical path method); ISO 21502:2020 | strong (standard text is paid; only the official summary was read) |
| P68 | Observational method | Tolerances with pre-planned responses | where outcomes stay uncertain until execution, set tolerances and planned responses in advance, monitor, and escalate when a tolerance will be breached | if the migration exceeds its time tolerance by 10 %, the steering group decides on scope | Scrum: inspection and adaptation; PRINCE2 principle 5 "Manage by exception" | moderate |
H. Operation and maintenance¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P70 | Monitoring in operation | Performance monitoring and going to see | track leading and lagging indicators, and regularly go to the place where the work happens | the manager joins an on-call shift each quarter, besides reading the dashboard | COSO ERM principle 16 "Reviews Risk and Performance"; Wikipedia: Genchi Genbutsu | moderate |
| P71 | Checklists | Checklists for rare management procedures | use checklists for rare, complex or time-critical procedures: onboarding, offboarding, month-end close, the first hour of a crisis | offboarding checklist: access removal, knowledge handover, equipment return | section 9 (surgery, rail); NIMS: incident action plans | moderate |
| P72 | Critical control points | Key controls | identify the few controls that prevent material loss or misstatement, give each a limit, an owner, monitoring and a test | access recertification for production is a key control, tested every quarter | cross-reference only | moderate |
| P73 | Response faster than harm | Recovery inside the tolerable disruption | set the recovery time objective of each critical activity inside its maximum tolerable period of disruption | payroll must resume within 3 days; the tolerable maximum is 5 days | ISO 22301 definitions (via BCI GPG) | strong |
| P74 | Maintenance by failure pattern | Review frequency by risk | set the frequency of audits, reviews and recertifications by how each control actually fails, not one fixed cycle for everything | high-risk access every quarter, low-risk tools once a year | cross-reference only | moderate |
| P75 | Actionable alerts | Management by exception | report to the next management level only when a tolerance is forecast to be breached; remove reports that lead to no action | weekly status shows only items outside tolerance | PRINCE2 principle 5 | moderate |
| P76 | Sterile critical phase | Focus time and crisis discipline | protect blocks of uninterrupted work; during a crisis, limit communication to the response | no meetings on Tuesday and Thursday mornings; one crisis channel with one commander | Mark et al. 2008; NIMS: "Integrated Communications" | moderate |
| P77 | Data as a dependency | Data governance for decisions | where decisions depend on data or models, version the definitions, check data quality and watch for drift | the headcount figure in the board report and in HR have the same definition | COSO ERM principle 18 | moderate |
| P78 | Asset inventory | Registers of assets, contracts, information and records | keep complete registers with an owner, condition and life-cycle stage | a contract register with end dates and notice periods | ISO 55000:2024; ISO/IEC 27001:2022; ISO 15489-1:2016 | strong (standard text is paid; only the official summary was read) |
I. Learning¶
| ID | Rule name | Management name | THEN (management form) | Example | Sources (management) | Evidence |
|---|---|---|---|---|---|---|
| P80 | Blameless root cause analysis | After-action review | after an event, discuss without blame what happened, why, and how to improve | after a failed reorganization: an AAR with all affected teams | US Army: Foundations of the After Action Review Process (DTIC); Deming point 8 | strong (doctrine) |
| P81 | Plan-Do-Check-Act | Regular reflection and adjustment | run the improvement cycle at fixed intervals and track actions to completion | a retrospective at the end of every sprint and quarter | Agile principle 12; ISO 9001:2026 | strong |
| P82 | Investigate anomalies | Weak signals and near misses | record and investigate deviations even when nothing went wrong, before they become normal | three projects in a row miss their deadline by two weeks → investigated as a pattern | CAIB report summary | strong |
| P83 | Preserve evidence | Legal hold | when litigation or an investigation is reasonably anticipated, stop routine deletion and preserve the relevant records | after a complaint about a dismissal, the related emails and chat channels are preserved | Sedona Commentary on Legal Holds, Guideline 1 | strong (US litigation duty) |