Anatomy of a defended number: one £2.4M assessment, line by line.

A board does not reject a governance programme because the work is thin. It rejects it because the headline figure cannot be traced. Somebody asks where the number came from, the room goes quiet, and a quarter of effort evaporates in a sentence. So when an assessment closed at £2.4M of quantified exposure and survived ninety minutes of questioning intact, we kept the working — and here we lay it out in full.

The firm is anonymised; the structure is not. What follows is the actual shape of the number: the four pillars it decomposes into, the ranges behind each, the method that produced them, and the half-dozen sources a sceptical CFO pulled on first. Nothing here is theatre. It is the arithmetic, exposed on purpose.

01Where the number comes from

Exposure is not a single quantity. It is the sum of four pillars, each modelled separately and each carrying its own confidence. Aggregating too early hides the line that matters; here, that line is revenue.1 Procurement friction and failed security questionnaires accounted for more lost pipeline than every other category combined.

Read that chart the way the board did. The instinct is to attack the largest bar, so the largest bar has to be the best-sourced. If revenue cannot be defended, the whole figure is suspect; if it can, the rest follows. That is why the method front-loads the work where the money is.

A figure of "£2.4M" invites a fight about precision. A figure of "£2.1M to £2.7M, 80% confidence" invites a conversation about assumptions — and that is the conversation you want. From the engagement working paper

02The method, in four moves

Every pillar passed through the same sequence. The discipline is that no figure advances to the next stage until it can name its source. A line that cannot be sourced is not conservative — it is simply absent.

1. Inventory the exposure surface

   Fourteen AI systems in production, pilot, or quietly shelved — each mapped to the contracts, processes, and obligations it touches.

   Days 0–14 · evidence only
2. Attach a financial mechanism to each gap

   A control gap is not a risk until it has a path to a pound. Each one maps to lost revenue, remediation cost, or a probability-weighted penalty.

   Days 15–35 · mechanism & source
3. Model in ranges, never points

   Low, expected, and high for every line, with the confidence stated. Point estimates are an invitation to argue about the wrong thing.

   Days 36–60 · range & confidence
4. Try to break it before the board does

   An uninvolved reviewer attempts to move the headline using only the cited sources. If they can shift it beyond the stated range, the model is not finished.

   Days 61–75 · adversarial review

The mechanism in move two is the part most programmes skip. It is also the part the board cares about most, because it is the only part that connects a governance word to a financial one. Here is the form it takes for a single line:

03The ledger, in full

This is the table the working paper opens to. Every pillar carries its expected figure, the 80%-confidence range around it, and the single source a reviewer would pull first. The total is the sum of expecteds; the range on the total is the sum in quadrature, not the sum of the extremes.3

Plotted as ranges rather than a column of numbers, the same ledger tells the board where the uncertainty lives. Revenue is both the largest pillar and the widest band — which is exactly where the next quarter of evidence-gathering should go.

04How a single line is computed

Transparency means the board can recompute any line themselves. The revenue pillar, for instance, is not a judgement call dressed up as a number — it is a function of three sourced inputs. Stripped of presentation, it looks like this:

# Lost pipeline attributable to AI-assurance friction
stalled_deals      = 7          # flagged in CRM, FY25
avg_contract       = 185_000    # £, trailing 12-mo mean
attributable       = 0.70       # share lost to assurance, sourced

expected = round(stalled_deals * avg_contract * attributable)
# → £905,500  ·  band ±18% at 80% confidence

Every figure on that line traces to a system of record: the deal count to the CRM, the contract value to finance, the attributable share to the post-mortems on each lost tender. None of it is invented. That is the whole trick, and it is not a trick at all.

05In the room

The number was not delivered as a slide. It was walked through at a table, one pillar at a time, with the working paper open and the sources within reach. The questions were sharp and the figure held — because it had already been broken once, in rehearsal, by people on our own side.

What survives a board meeting is rarely the most elaborate analysis. It is the one whose every figure can be traced back to something the room already trusts. The £2.4M held not because it was precise, but because it was legible — and a legible number is one a board can defend in its own words after you have left the room.

A number that cannot be argued with is not credible; it is opaque. The goal was never a figure beyond question — it was a figure worth questioning. The Govscape team