Program Review Guidelines

✅ Post Title: How to Run a GRC Program Review That Actually Moves the Needle 👋 Welcome to Week 12 of the series! ▪️ You’ve built policies. ▪️ You’ve assessed risks. ▪️ You’ve survived audits. But when was the last time you zoomed out and asked: 💭 Is our GRC program actually working? Many GRC programs just “exist.” Few are strategically reviewed. Fewer are improved. 🧠 The Real-World Challenge: You’re so busy doing GRC... you don’t stop to assess GRC itself. But leadership, regulators, and your own team want to know: ▪️ What’s working? ▪️ What’s stalled? ▪️ Where should we invest next? 📊 Best Practices for Reviewing Your GRC Program 1. Use a maturity model ▪️ Try NIST CSF, ISO 27001, or CMMI scales (1–5) ▪️ Assess across People, Process, and Technology 2. Collect honest input ▪️ Interview stakeholders across departments ▪️ Ask: “What frustrates you about our current GRC processes?” 3. Measure performance, not activity ▪️ Don’t just count risks reviewed—show % of critical risks mitigated ▪️ Don’t just show training completions—show behavior changes 4. Benchmark yourself ▪️ Compare against industry frameworks or peers ▪️ Highlight gaps and quick wins 5. Summarize in a story, not a spreadsheet ▪️ Use visuals and executive-level takeaways: “Here’s what we’ve improved. Here’s where we’re still at risk. Here’s what we’ll do next.” 🧠 Pro Tip: Make it part of your annual cycle. Your GRC program deserves the same review rhythm as Finance, HR, and IT. 📌 TL;DR GRC programs need reviews too Don’t just assess risk—assess your ability to manage risk Insight + roadmap > dashboard alone 📅 Coming Up: "Mapping Risk Scenarios to Controls" 💬 Have you ever reviewed your GRC program from the outside in? What did you learn? #GRC #RiskManagement #Compliance #Governance #SecurityLeadership #ProgramReview #MaturityModel #Cybersecurity #GRCBestPractices #ContinuousImprovement

You can’t have a good program without good evaluation ‼️ Over the last decade, I have designed and run a lot of programs. The most difficult and important part has always been the evaluation process I’ve learned to be wary of “perfect” feedback. When participants tell me a program was flawless and doesn’t need to change, it usually means I didn’t ask the right questions, or I didn’t create the conditions for honest reflection. It’s good for the ego and for reporting back to funders/external stakeholders, but it’s not useful for growth. Evaluation should surface what didn’t land, what could be clearer, and what needs to be rethought. It requires designing questions that go beyond “Did you enjoy this?” and instead get closer to answering “What actually changed for you?” or “What didn’t work in the way you expected?” When time and resources allow, a mixed approach tends to be the most meaningful. Surveys, short written reflections or even simple sticky note responses can capture immediate, unfiltered reactions. However, it’s often in post-program interviews where the depth really emerges. That’s where people articulate the nuances, the contradictions, and the things they wouldn’t write down. The goal isn’t just to prove that a program worked. It’s to understand how the next iteration can be meaningfully better.

In the last 10 years I've designed, delivered and assessed the impact of several large scale leadership development programmes. Want to know how I make sure they actually matter and aren't just a pretty certificate or a report of butts on seats? It's my 6 power questions. Start asking these and you're guaranteed to have leadership programmes that create long lasting behaviour change AND reportable outcomes. 1) What are the core leadership capabilities and behaviours we need both now and in the future? This is where you survey leaders at all levels to identify essential skills. If you're not talking to your audience then you're missing a HUGE piece of the puzzle. And for the love of god please incorporate strategy here too. What does the business need to achieve and what role does leadership play? 2) How will you assess current leadership competencies and development needs across the organisation? Are you using 360 reviews, skills assessments, interviews? 3) What development formats will allow for skills practice, real-world application and feedback? This could include workshops, cohorts, mentoring, job rotations, special project assignments... something that let's them practice is essential. 4) How will leadership development intersect with your talent management processes? The amount of times this isn't considered is staggering. Look at integration points with recruitment, promotion, succession planning and performance management. This is crucial. 5) What measures will define the success of this programme at the participant, leadership bench strength, and organisational level? Identify key leading and lagging indicators. Wanna know what these are? 💡 Leading = participation rates, completions of tasks, engagement surveys, tests etc. 💡 Lagging = leadership pipeline for critical roles, if your programmes affect things like EVP and brand, leadership retention, and your key metrics around profitability etc. Great programmes measure both ⬆️ 6) How will you evolve curriculums over time to meet changing business objectives and leadership needs? Build in processes for continuous review and refresh. This is my biggest non-negotiable. At a push you should review every 3 years but I suggest a review every year in line with strategy and business objectives + engagement surveys and employee data. Leadership development is a serious game friends. It's not just away days and leadership theory. This is how you future proof your organisation, and goes from grass roots through to established leadership. Anything I've missed that you would add?👇

Are your programs making the impact you envision or are they costing more than they give back? A few years ago, I worked with an organization grappling with a tough question: Which programs should we keep, grow, or let go? They felt stretched thin, with some initiatives thriving and others barely holding on. It was clear they needed a clearer strategy to align their programs with their long-term goals. We introduced a tool that breaks programs into four categories: Heart, Star, Stop Sign, and Money Tree each with its strategic path. -Heart: These programs deliver immense value but come with high costs. The team asked, Can we achieve the same impact with a leaner approach? They restructured staffing and reduced overhead, preserving the program's impact while cutting costs by 15%. -Star: High impact and high revenue programs that beg for investment. The team explored expanding partnerships for a standout program and saw a 30% increase in revenue within two years. -Stop Sign: Programs that drain resources without delivering results. One initiative had consistently low engagement. They gave it a six-month review period but ultimately decided to phase it out, freeing resources for more promising efforts. -Money Tree: The revenue generating champions. Here, the focus was on growth investing in marketing and improving operations to double their margin within a year. This structured approach led to more confident decision-making and, most importantly, brought them closer to their goal of sustainable success. According to a report by Bain & Company, organizations that regularly assess program performance against strategic priorities see a 40% increase in efficiency and long-term viability. Yet, many teams shy away from the hard conversations this requires. The lesson? Every program doesn’t need to stay. Evaluating them through a thoughtful lens of impact and profitability ensures you’re investing where it matters most. What’s a program in your organization that could benefit from this kind of review?

The CDC has updated its Framework for Program Evaluation in Public Health for the first time in 25 years This is an essential resource for anyone involved in programme evaluation—whether in public health, community-led initiatives, or systems change. It reflects how evaluation itself has evolved, integrating principles like advancing equity, learning from insights, and engaging collaboratively. The CDC team describes it as a “practical, nonprescriptive tool”. The framework is designed for real-world application, helping practitioners to move beyond just measuring impact to truly understand and improve programmes. I particularly like the way they frame common evaluation misconceptions, including: 1️⃣ Evaluation is only for proving success. Instead, it should help refine and adapt programmes over time. 2️⃣ Evaluation is separate from programme implementation. The best evaluations are integrated from the start, shaping decision-making in real time. 3️⃣ A “rigorous” evaluation must be experimental. The framework highlights that rigour is about credibility and usefulness, not just methodology. 4️⃣ Equity and evaluation are separate. The new framework embeds equity at every stage—who is involved, what is measured, and how findings are used. Evaluation is about learning, continuous improvement, and decision-making, rather than just assessment or accountability. As they put it: "Evaluations are conducted to provide results that inform decision making. Although the focus is often on the final evaluation findings and recommendations to inform action, opportunities exist throughout the evaluation to learn about the program and evaluation itself and to use these insights for improvement and decision making." This update is a great reminder that evaluation should be dynamic, inclusive, and action-oriented—a process that helps us listen better, adjust faster, and drive real change. "Evaluators have an important role in facilitating continuous learning, use of insights, and improvement throughout the evaluation (48,49). By approaching each evaluation with this role in mind, evaluators can enable learning and use from the beginning of evaluation planning. Successful evaluators build relationships, cultivate trust, and model the way for interest holders to see value and utility in evaluation insights." Source: Kidder, D. P. (2024). CDC program evaluation framework, 2024. MMWR. Recommendations and Reports, 73.

The "Framework for Program Evaluation in Public Health," published by the CDC in 1999, provides structured steps and standards for conducting program evaluations effectively. This Framework, which is widely recognized globally, was shaped in alignment with the Program Evaluation Standards developed by the Joint Committee on Standards for Educational Evaluation. These standards emphasize that evaluations should be useful, practical, ethical, accurate, transparent, and economically sensible. The Framework is adaptable and not specific about the focus, design, or methods of evaluation, making it compatible with various international approaches, particularly in humanitarian settings. Key aspects of the Framework include: 1-Engaging stakeholders: Involving those affected by the program and those who will use the evaluation results. 2-Describing the program: Detailing the program’s needs, expected effects, activities, resources, development stage, context, and logic model. 3-Focusing the evaluation design: Clarifying the evaluation’s purpose, users, uses, questions, methods, and procedural agreements. 4-Gathering credible evidence: Ensuring data quality and addressing logistical issues related to data collection and handling. 5-Justifying conclusions: Analyzing data, interpreting results, and making recommendations based on established criteria and stakeholder values. 6-Ensuring use and sharing lessons learned: Planning for the use of evaluation results from the start, engaging stakeholders throughout, and effectively communicating findings. This comprehensive approach aids in enhancing program evaluation and accountability across diverse settings worldwide. #PublicHealth #CDC #ProgramEvaluation

100 lines of code: reviewed in 10 minutes. 1000 lines of code: reviewed never. Code reviews exist to catch bugs, improve maintainability, and help teams write better software together. But most engineers treat them like assignments to pass instead of collaborative checkpoints. That mindset kills the process before it starts. ➧ When you're submitting a PR: 1. Keep it small Aim for 10-100 lines of code per pull request. Past 100 lines, reviewers start skimming. Past 500, they stop caring entirely. Large PRs are harder to review, take longer to approve, and make it nearly impossible to catch real bugs. Break your work into isolated, logical chunks. Yes, it's more work upfront. But it ships faster. 2. Write a description Give context. Always. Your reviewer might be on a different team, in a different timezone, or new to the codebase. Don't make them guess what you're solving. If you're fixing a bug, explain what broke and link to the ticket. If it's a visual change, add before/after screenshots. If you ran a script that generated code, paste the exact command you used. Context turns a confusing diff into a clear story. 3. Leave preemptive comments If part of your diff looks unrelated to the main logic, explain it before your reviewer asks. "Fixed a typing issue here while working on the main feature." "This file got reformatted by the linter, no logic changes." These small clarifications save back-and-forth and show you're thinking about the reviewer's experience. ➧ When you're reviewing a PR: 1. Be overwhelmingly clear Unclear comments leave people stuck. If you're making a suggestion but don't feel strongly, say it: "This could be cleaner, but use your judgment." If you're just asking a question, mark it: "Sanity check, is this intentional? Non-blocking, just curious." Over-communicate your intent. Especially with remote teams or people you don't know well. 2. Establish approval standards with your team Decide as a team when to approve vs. block a PR. At Amazon and now at Nielsen, we approve most PRs even with 10+ comments because we trust teammates to address feedback. The only exception: critical bugs that absolutely can't go to production. Without clear standards, people feel blocked by style comments and approvals feel arbitrary. Talk to your team. Set the rules. Stick to them. 3. Know when to go offline Some conversations don't belong in PR comments. If the code needs a major rewrite, if there's a design disagreement, or if you're about to write a paragraph, stop. Ping your teammate directly. Have a quick call. Save everyone time. Leave a comment like "Let's discuss this offline" so they know you're not ignoring it.

We didn’t fail because the product was bad. We failed because…….We never .... Reviewed it at the right time. Back in 2021, we built a new feature, rushed it to market, and celebrated the launch. Three weeks later, churn spiked. That was the day I learned: Product teams don’t need more features.better reviews. Here are 6 product reviews that every team should run (and when): 1/ Vision Review (At the start) → To align on the “why.” Ask: Are we solving the right problem? 2/ Strategy Review (Before roadmap planning) → To course-correct before investing. Ask: Is this the best way to reach our goal? 3/ Design Review (Before coding starts) → To remove UX friction early. Ask: Is this easy and useful for users? 4/ Pre-Launch Review (Right before release) → To catch what’s broken before users do. Ask: Is everything working as expected? 5/ Post-Launch Review (1–2 weeks after) → To measure what landed and what flopped. Ask: Did we get the results we wanted? 6/ Retro / Team Review (End of each sprint) → To grow as a team, not just a product. Ask: What slowed us down? What can we fix? If you're not reviewing consistently, you're just guessing with better tools. P.S. Save this list. Repost ♻️ if your team needs more reflection and fewer assumptions. #apm #career #review #careercoach #productmanager