DTA Practice Note 02 — The Policy Rigour Test

Status: non-normative practice material. Not part of the Transformation Decision Record standard.

What it is

Ten questions asked of one policy, to establish whether that policy is governed as a document or as a connected collection of decisions.

It is a diagnostic a reader can run on their own estate. It produces a finding about traceability. It is not an assessment, a maturity score or a benchmark, and no result from it should be compared across organisations.

The condition

Answer all ten without rereading the full policy estate, convening the original authors, or reconstructing meeting history.

That constraint is the whole test. Almost any organisation can answer these questions given enough archaeology; the question is whether the answers are retrievable.

The ten questions

1. Which consequential decisions does this policy currently contain?
2. Which statements are external obligations you inherited, and which are internal interpretations, organisational choices, delegated decisions, controls or evidence requirements?
3. Who held the authority for each, and under what mandate?
4. What was chosen, against which alternatives and on what evidence?
5. What binding effect, boundary and validity does each carry?
6. Which systems, processes, contracts, controls and mandates implement each one?
7. Which evidence shows each is operating as intended?
8. Which later decision superseded or narrowed any of them?
9. What else must be reconsidered if one of them changes?
10. Would an authorised person and an authorised machine retrieve the same current answer, for the same authorised view?

Reading the result

If those answers require document archaeology, the policy is governed as a document rather than as a connected decision collection.

That is the finding. It is structural, not a judgement about the people who wrote the policy — a document designed to communicate a position is not designed to keep each decision inside it independently retrievable. Most were never asked to.

Question 10 is the one most often misread. It is not about automation. It asks whether the answer is stable and retrievable, and it says for the same authorised view deliberately: two authorised people may legitimately receive different views of the same estate, and that is the discipline working, not a failure.

Two boundaries

External rules are obligation collections. Internal policies are decision collections. A regulator sets the obligation; the firm decides how to interpret and meet it. Only the second is the firm’s own judgement, and separating them is what makes the firm’s position retrievable at all.

A principle is often a decision that has not finished deciding — it becomes operationally useful when someone supplies authority, effect, boundary and validity. Some principles are deliberately enduring constraints and should stay that way. Do not force every principle into a decision record.

Scope

Run it on one policy that a live change touches. Running it across a policy estate turns a diagnostic into a programme, which is not what this is for.

Version history

0.1 — 26 July 2026. First issue. The ten questions were previously carried inside an article draft; they are published here so the article can point at something versioned rather than restate them.

---

Digital Transformation Advisory. Practice material, published separately from the open standard it sits above. All Practice Notes.