Most governance numbers die the moment someone asks where they came from. The amber dot on the dashboard, the “we’re about 60% mature” line in the steering pack: they survive right up until a board member says “based on what?”
A defensible number is different. It has a range, not false precision. Every line traces back to a source. When someone pushes, you can walk them down the chain without reaching for a caveat.
You can build one by hand. Here’s the method, five steps, and what GovScape does for each.
01Write down what actually exists
Not what’s in the strategy deck. What’s running: the systems, the data, the AI tools people actually use, the processes that rely on them. For each one, capture what it does, who owns it and what data it touches.
The output is a register, not an essay. If you finish with fifteen systems and an honest note that says “three of these have no named owner,” that absence is already a finding.
In GovScape: talk through how the organisation works, or type it, and GovScape proposes the entries: AI tools, risks, processes and data. You accept or reject each one. Connect Microsoft 365 and it reads documents, accounts and licences for you.
02Sort by what’s at stake
Not every system matters equally. A tool that decides who gets a job or a loan, or holds client and personal data, matters far more than a spam filter. Record why each one matters, not just a label. “Holds client personal data, no owner” stands up; “high risk” on its own is a guess wearing a label.
In GovScape: each risk is scored by severity and likelihood, and the standards you choose (ISO/IEC 27001, UK GDPR, ISO/IEC 42001 and others) tell you which requirements apply.
03Map controls to evidence, and find the gaps
This is the step where the folder falls apart. That’s good: better now than in front of an auditor. For each requirement, ask the only two questions that matter: is there a control, and is there evidence it works? You’ll find four states:
- Controlled and evidenced: rare. Treasure it.
- Controlled, not evidenced: someone swears it happens, but nothing proves it. This is most of them.
- Evidence expired: there was proof eighteen months ago. It counts as a gap.
- No control: the honest red.
In GovScape: upload your policies and it proposes which clauses they cover. Evidence carries an expiry date, and once that date passes GovScape marks it expired overnight. Readiness is tracked clause by clause.
04Score risk twice
For each significant risk, score it before controls (inherent) and after the controls you’ve confirmed (residual). Only count the controls you confirmed, not the ones you wish existed. The gap between the two scores is the value your governance is delivering; what’s left is the risk you’re carrying.
In GovScape: every risk in the register carries both scores, with the controls and evidence that explain the difference.
05Put it in pounds, as two figures
A risk score isn’t yet a number a finance director can use. The last step turns it into money, and here’s the part most methods get wrong: it’s two figures, not one.
- Recoverable each year: the steady drag of manual work, wasted technology and revenue that leaks away. This is money already leaving the business.
- Risk exposure: probability × impact for the things that might go wrong. It’s kept separate, because it might never happen.
Write each one down as a range, with the working attached:
Recoverable each year: £578k – £2.0m, driven mainly by write-offs and manual work. Risk exposure, shown separately: £19k – £71k. Three fixes in the 90-day plan are worth about £296k a year.
In GovScape: this step happens first, not last. Sector benchmarks give you both ranges in your first session, clearly marked as estimates. They firm up as steps 1–4 replace benchmarks with your own evidence, and GovScape proposes the 90-day plan with the value of each fix beside it.
06What you do with it
Rerun the method every quarter and the number moves. You can finally show the gaps closing, and the cost recovered as they do, rather than governance just existing.
You can absolutely do this by hand the first time; plenty of good consultants do. GovScape means you start with a figure on day one instead of day five, and that the chain stays intact when someone pulls on it six months later.
But the method stands on its own: write down what exists, sort by what’s at stake, evidence ruthlessly, score risk twice, and price what’s left as two figures. Do that and you’ll walk into the next board meeting with the one thing the amber dot never had: an answer to “based on what?”
Governance, priced and closed.
