Lab Guide — Operating-Model Review

Facilitated exercise · 40 minutes · Fictional organisation

What this lab is

For a fictional organisation, your group assigns the three lines of defence, selects five metrics that matter, and drafts the five questions the board should ask each quarter. The aim is to leave with a reusable governance skeleton and question set.

Part A — Roles & lines (13 min)

Accountability

Assign the three lines of defence to real functions in this organisation.
State who owns the risk, who runs the programme, and where the board's oversight sits.

Part B — Metrics that matter (12 min)

Measure the right things

Pick five outcome metrics (detection time, restoration success, crown-jewel coverage…).
For each, name one vanity metric it should replace.

Part C — The board's questions (15 min)

Draft the quarterly five

Write five evidence-forcing questions the board should ask every quarter, and name who owns the answer to each.

✓ Self-check: your governance skeleton has clear risk ownership, five outcome metrics, and five questions that each demand evidence rather than a yes/no.