Internal audit: useful when nobody is defending a number
Internal audit checks whether controls actually work. How to plan by risk, write findings people act on, and stay independent without becoming the police.
Succession planning is a list of roles you cannot afford to lose and what happens if you do. How to build one small enough to maintain and honest enough to use.
Succession planning is the exercise of deciding, in advance and in writing, what happens when a role you depend on becomes empty. Most companies do a version of it in their heads and discover the gaps on the day a resignation letter arrives. The written version is not much more work, and its value is almost entirely in the conversations it forces: which roles genuinely cannot be left vacant for three months, and who — specifically, by name — would step in.
A plan where every critical role has a ready-now successor is a plan nobody checked. "No internal candidate" is the most useful entry in the whole document, because it is the one that changes a hiring decision.
Be careful what you promise. Telling someone they are the successor creates an expectation you may not be able to meet, and telling them nothing wastes the development time the plan was supposed to buy. The usual middle path is to discuss the development, not the appointment: what they would need to be ready, without stating that the job is theirs.
Ettex Records keeps one record per critical role — impact, time to hire, named successors and their readiness, review date — so the plan is a short filterable list rather than a slide deck rebuilt each year. Restrict it: a succession plan readable by the whole company causes more problems than it prevents, and the readiness ratings in particular are not for general circulation. It sits alongside the training matrix, which is where the development actions the plan generates should end up. Ettex does not assess anyone’s readiness and has no view on who should get the job.
No, and treating it that way is the common mistake. The single most disruptive vacancies in small companies are often technical or administrative — the one person who knows the payroll process, or holds the certification the contract requires.
One line per role that a reader can act on beats a competency framework nobody maintains. If the document takes more than an afternoon a year, it will quietly stop being updated.
That is the argument for documentation and access over named individuals. People move; the record of how the work is done is what survives, and it is the part of the plan that keeps its value regardless of who is on the list.
Internal audit checks whether controls actually work. How to plan by risk, write findings people act on, and stay independent without becoming the police.
A supplier code of conduct sets what you require of the people you buy from. What to include, how to make it enforceable, and why long codes get signed and ignored.
A certificate of analysis states what was tested and what was found. What has to be on it, the checks that take a minute, and why filing it unread is the risk.