A one-page GRC decision memo: worked example and writing structure

A decision memo should make the requested decision easy to find. Lead with what needs to be decided, then give the evidence, meaningful options, recommendation and remaining uncertainty. Keep detailed records accessible by reference rather than reproducing the whole assessment history.

The memo below continues the fictional Marlow recovery case from the risk-register example. It is original teaching material, not an actual approval, professional assurance opinion or template required by a standard.

The decision is narrower than the entire risk

Marlow's scheduling entries were restored in a supervised exercise in a separate environment. Integration configuration was excluded, and the sponsor has not yet agreed a recovery-time requirement. The immediate question is whether to arrange a broader recovery exercise and confirm the business requirement before closing the assessment.

That is a specific decision a memo can support. “Please approve our security posture” would be much broader than the evidence.

Completed fictional memo

To: Marlow's designated assessment decision owner

From: Fictional assessment coordinator

Subject: MR-004 — proposed next step for scheduling recovery assessment

Decision requested: Confirm whether the team should define the scheduling recovery requirement and plan a broader authorized exercise before treating the service-recovery assessment as complete. Please identify the action owner and agree the next review date.

Current evidence: RT-01 records restoration of the covered scheduling entries in a separate environment. BK-02 describes the backup scope. The exercise excluded integration configuration. The business sponsor has described the scheduling dependency but has not agreed the recovery-time requirement or acceptable data loss for this exercise.

Assessment limit: The supplied result supports restoration of the covered entries under the recorded conditions. It does not establish recovery of the complete scheduling service within an agreed business requirement.

Option A — complete the missing scope: Ask the sponsor to define the operational requirement and the application owner to propose a suitable exercise covering the remaining service dependencies. This addresses the unanswered question but requires staff time and an approved exercise plan.

Option B — defer further work: Retain the open limitation and bring any proposed temporary acceptance to the authorized person under the organization's process. This avoids immediate exercise work but leaves the service-recovery question unresolved. The current package does not establish an adequate alternative arrangement.

Recommendation: Pursue option A. First agree the business requirement, then use it to define the exercise objective and scope. Do not represent the current result as complete service recovery. The next exercise should be planned and authorized before any action affecting systems is taken.

Follow-up: The sponsor owns the business requirement; the application owner owns the proposed technical plan. Confirm named individuals and feasible dates. Review MR-004 when those inputs arrive, and again after the exercise evidence has been assessed.

Decision record: Pending. This memo proposes a next step and records no acceptance or approval.

The memo deliberately leaves actual names and dates for the decision process. In a real document, replace role placeholders with confirmed owners and an agreed schedule before treating actions as assigned.

Why the recommendation is bounded

The memo recommends further assessment work. It does not guarantee that a broader exercise will succeed or that the resulting recovery capability will be acceptable. It also does not instruct anyone to disrupt a live system immediately.

Option B describes a possible decision path and its unresolved consequence. Listing it does not establish that temporary acceptance is permitted or that the proposed decision owner has that authority. Confirm the applicable process.

The evidence section includes both a positive result and its limit. Omitting the successful restoration would exaggerate the gap; omitting the integration exclusion would exaggerate the assurance.

Keep the supporting detail traceable

Attach or reference the risk record, scope description and exercise result through the authorized document system. Use stable identifiers such as MR-004 and RT-01 so the reader can connect a sentence to its support.

If the exercise report changes, review the memo before resubmitting it. A memo quoting a superseded scope can remain misleading even if the underlying risk register has been corrected.

After a decision, record who decided, when, what they decided and any conditions. Keep “recommendation” and “decision” as separate fields. Silence or a meeting invitation is not a decision record.

A reusable outline

Use these headings: decision requested; current evidence; assessment limit; options and consequences; recommendation; action owners; review trigger; decision record.

For a different case, change the reasoning and evidence, not just the names. A supplier onboarding memo might require different options and authorities from a recovery-assessment memo. The structure helps organize a decision; it does not determine the answer.

Review before sharing

Ask a reader to locate the requested decision in ten seconds. Then ask what the evidence establishes and what remains unknown. If their answer exceeds the scope of your evidence, tighten the wording.

For portfolio use, label the memo and all supporting files as fictional practice. The Risk & Evidence Portfolio Kit offers a larger coherent case with an actual ungated preview. The free evidence worksheet and field-note library remain available without purchase.

Compare the decision-memo project path to inspect a separate free exercise, the actual book fit and sample boundaries.