# 7. The first ninety days

## Weeks 1 to 3: the method, written down

- Adopt the principles and the ladder in `plan/plan.json` as the house method, and write the playbook: how to establish a risk, how to place it, how to run an acceptance meeting, how to escalate.
- Set up the risk vault layout from `spec/risk-vault.md`, and the acceptance record from `spec/acceptance-record.md`.
- Build the acceptance audit from `prototypes/acceptance-audit.md` into a one-hour meeting.

**Done when:** the audit has been run on one real register, and the playbook survived it.

## Weeks 4 to 8: three design partners

- Sign three organisations for a quarter, one business unit each, at a reduced fee.
- For each: import the register from their GRC platform, establish their top twenty risks on facts, place them on the chain, and run the first round of acceptances.
- Keep a count of every refusal to accept, and why. That count is the most valuable data the company will have.

**Done when:** sixty risks are in the loop, each with a holder, an interval and an action.

## Weeks 9 to 13: the first expiries

- Run the first expiries: re-acceptances, escalations, incidents and funding decisions.
- Produce the first quarterly board pack for each partner.
- Approach one GRC vendor with the integration outline in `prototypes/grc-integration.md`, using the partners' platforms as the case.

**Done when:** at least one risk has been escalated, one funded and one closed on facts, and one partner has agreed to a paid second quarter.

## Team

Two to start: an engagement lead who can talk to a board, and a risk engineer who can read a configuration. An integration engineer by the end of the first quarter.