01
Map
Watch how a real piece of work moves from request to done. The map is the path people use, including the side paths the official process does not mention.
Pick one job the week depends on. Follow it across the teams that touch it, and write the steps that are not in the diagram. A map that only repeats the policy is not a finding. The finding is the path the work actually takes when the official one stalls.
02
Name
Put one owner on each duty that can stop that path. If two people believe they own it, or nobody does, that is the finding.
Shared admin access, a vendor nobody renews, and a control whose evidence lives in a different system than the work are the same kind of gap. The name has to be a person who can change the outcome, not a committee and not a tool.
03
Join
Close the seams that matter first: a handoff, two records that disagree, access that is shared with no owner, or a brand that runs a different week.
Joining does not mean replacing the stack. The products already in use stay, unless a record cannot carry the work. Two sites do not get two operations. A company just acquired does not get to keep a second week beside the first.
04
Prove
Run the new cadence on a real week. Record what held, what slipped, and what changed, including SOC 2 and PCI evidence and the automation that keeps onboarding, offboarding, and access review current.
Proof is a week that already happened, not a slide. If the evidence for an audit describes a different operation than the one on the floor, the evidence is wrong. The same is true of a dashboard that leadership reads and the floor does not.
05
Leave
Hand over the owners, the cadence, and the record. The team should be able to run the next week without a consultant in the meeting.
Leaving is part of the method, not a hope. The engagement is finished when the people you already have can run it. A result that needs a consultant in the room every week is headcount by another name.