One complete kit · Nothing withheld
Every document your team would receive. Before you spend a dollar.
Most sessions are built to order, which makes them hard to evaluate. So here is one finished kit in full — the buyer brief, the customization intake your sponsor completes, the briefing your sponsor reads, and a completed session summary showing exactly what lands afterward.
Why is this on a public page
No compliance officer or general counsel puts a facilitated exercise in front of their executives based on a description alone. The question is never whether the training is good. It is whether something will be said in that room, in your organization’s name, that you would not have approved.
That question cannot be answered by a brochure, so we publish the documents instead. Everyone below is the real deliverable, from a real kit, with one change: pricing has been removed.
The kit shown here is Keep It Off the Dashboard, built for IT risk and GRC leadership. Every other session in the Leadership Edition uses the same document set and the same review sequence — only the scenario changes.
Four documents, in the order you would meet them
1 · Before you buy
Buyer Brief
What the session is, one sample decision, and what you receive. This is the document that circulates internally while you decide.
2 · Before we build
Client Scenario Brief — customization intake
Seven fields and a terminology map, completed with your sponsor on a 30-minute call. This is where the session becomes yours — and where you sign the assumption approval.
3 · Before the room
Sponsor Briefing
One page for the executive sponsoring the session, including the one rule that governs their own behavior in the room.
4 · After the room
Session Summary — a completed sample
The deliverable itself is filled in. Vote data per round, who was consulted and when, the sentences the room wrote, accepted actions with owners, and the questions the organization could not answer. This is the one worth reading closely.
Document one
Buyer Brief
Xcelus Decision Brief™ — Leadership Edition · Keep It Off the Dashboard
Buyer Brief
For CISOs, CIOs, Chief Risk Officers, and Heads of IT GRC
The problem you already have
Somewhere in your organization, a risk everyone knows about is not on the dashboard your board reads. The symptoms are familiar: unsanctioned SaaS riding in under the purchasing threshold; discovered risks aging quietly in assessment queues; “emerging risk” entries that carry no rating and no owner; findings from tabletops and exercises that never reach the register; and committee pre-reads that say less than your team knows — not because anyone lied, but because every delay arrived dressed as diligence.
“The committee meets in nine days. If this goes on Thursday’s pre-read, it goes to the board half-baked. Keep it off the dashboard until we actually understand it.”
The sentence this session is named after.
What happens in the hour
Sixty minutes, facilitator-led, for your GRC or IT-risk directors and managers plus three or four function seats (Enterprise Risk, InfoSec, Business Operations, Legal/Privacy). One realistic scenario — an unsanctioned AI tool discovered nine days before the board risk committee meets, operationally load-bearing and processing restricted data — through four decision rounds. Before every discussion, each decision-maker votes privately, before anyone senior speaks; the sponsor votes last by rule. Colleagues from the functions answer only when asked. Each round ends by scripting the exact sentence that travels upward. It is an operational exercise in the workflow your team owns — rating, reporting, exceptions, containment, escalation — and nobody is scored.
A sample decision (Round 1 of 4)
The dashboard locks in two days. The tool is unassessed, embedded, and processing restricted data — and the methodology’s exact requirements haven’t been confirmed. What does your director do?
A — Register entry this cycle: record it now with the assessment open and dated.
B — Assessment now, verbal brief: open the 30-day assessment and brief the committee verbally as an emerging item.
C — Assessment now, report next cycle: bring the committee a finished answer next quarter.
All three are defensible. Which one your team picks — before and after consulting the experts in the room — is the data.
What you receive
Initial-versus-final vote data for every round: what your team actually thinks before hierarchy speaks.
A consultation log — which functions were asked, when, and what — and the questions your organization could not answer in the room, each with an owner and a date.
The exact upward sentences your team scripted, along with commitments from owners, timelines, and checkpoints.
Everything classified conservatively: exercise observations and validation questions — never “findings.” A gap becomes real only when your team validates it. You review the draft summary before anything is final.
Delivery and confidentiality
Virtual (Teams or Zoom, producer-assisted) or in person. A true 60-minute participant commitment; a 45-minute compressed mode exists but does not test the final sequencing decision and produces a narrower evidence set. No recording. The scenario is entirely fictional; participants are instructed not to introduce actual pending matters or name real tools; the facilitator provides no legal conclusions and never analyzes a real matter; and before delivery, your team reviews and approves the scenario’s policy, reporting, and workflow assumptions — it runs on your words, with your sign-off.
Note: The full Buyer Brief closes with engagement options and pricing. Those are provided in conversation and are omitted here. The price reflects the whole engagement — discovery, configuration, preparation, facilitated delivery, reporting, sponsor validation, and follow-up — not an hour of facilitation.
Document two
Client Scenario Brief
This is the document that answers “Will this reflect our organization?” Completed with your sponsor on a 30-minute call before anything is built.
Customization Intake
These fields are what light customization means. A new workflow or decision structure is a bespoke engagement.
1 · Risk methodology and provisional ratings
How does your methodology rate an unassessed vendor processing restricted data? Does a provisional rating exist, and what is your scale called?
2 · Reporting thresholds and dashboard mechanics
What must appear on the committee dashboard, on what cadence, with what lock time? Do verbal or “emerging” items satisfy the reporting rule? Is there a deferral or footnote mechanism?
3 · Exception route
Who can grant a risk exception, for how long, with what sign-offs — and who monitors conditions?
4 · Containment and holds
Who can enroll or block an application in single sign-on, freeze seats, or apply data-loss rules — and how fast? What is the purchasing threshold below which software avoids vendor review?
5 · Functional ownership and seats
Who owns intake, asset inventory, vendor review, and incident response — and who fills the three or four function seats in this session?
6 · Accountability artifact
Which document carries risk-program status to leadership or a regulator? Its cadence, and who signs it.
7 · Escalation authorities
When a governance-relevant incident surfaces, who is notified, by title, in what order? The final round’s options adopt your titles.
Terminology map — session materials adopt your words
Provisional High-risk register / committee dashboard · emerging risk item · exception (risk acceptance) · annual cybersecurity certification · board risk committee — each replaced with your organization’s term.
Scope boundary
Included in every delivery: the seven fields above and the terminology map. Not included: new scenarios, altered decision structures, policy or legal analysis, or incident-response advice — those are separate engagements.
Client assumption approval — required before delivery
The client has reviewed and approved the scenario’s legal, policy, reporting, escalation, and workflow assumptions as customized above. Xcelus facilitates the approved exercise; it does not provide legal advice, render legal conclusions, or determine the handling of actual matters. Content changes directed by the client are the client’s responsibility to review. Signed by the client and mirrored in the statement of work.
Document three
Sponsor Briefing
One page, sent to the executive sponsoring the session. Note what it asks of them.
You are sponsoring a 60-minute decision exercise for your directors and managers. This page is everything you need — and one rule that matters more than the rest.
Your role — and the VP Rule
Open the session, sixty seconds. Validate realism — “This is our Tuesday.” Do not preview any views on the scenario.
Then go last. In everything. You vote last and speak last in every round. This is the VP Rule, and it is the price of the session’s most valuable output: if you speak early, the private votes collapse into agreement with you, and you learn nothing about what your team actually thinks. The facilitator will enforce this — warmly — including on you.
Close with the commitments. Every commitment leaves the room with a named owner, a timeline, and a checkpoint. Your presence is what makes those real.
What you receive afterward
Within 48 hours: the Session Summary — initial-versus-final vote data per round, the consultation log, the exact upward sentences your team scripted, commitments with owners and checkpoints, and the take-back register: the real policy questions your organization could not answer in the room. That last list is typically the session’s most immediately actionable output. Everything is classified conservatively — exercise observations and validation questions, never “findings.” A gap becomes real only when your team validates it, and an action exists only once accepted with an owner and a checkpoint. You validate the draft before anything is final.
One request
Please do not review the scenario materials in advance beyond this briefing. The session depends on the room meeting the injection’s cold — including you.
Document four — the deliverable itself
Session Summary — a completed sample
Filled in, as it would arrive within 48 hours. Entirely fictional — Wrenhaven Mutual Insurance Group and every name in it are inventions.
Scope, classification, and status
This summary reports a facilitated exercise, not an audit: nothing in it asserts that a control failed. Items are classified as exercise observations, validation questions, client-validated gaps, or accepted actions. Votes are tallies; no participant is named against a vote. Status: validated by sponsor.
Session
Wrenhaven Mutual Insurance Group — IT GRC leadership (fictional sample) · 60 min, virtual · Sponsor: Head of IT GRC
Votes by round — first vote, then re-vote after consultation
Round 1 1 / 3 / 1 → 3 / 2 / 0
Enterprise Risk, asked directly, confirmed a verbal “emerging item” does not satisfy the reporting rule — the pre-read is the record.
Round 2 2 / 1 / 2 → 1 / 4 / 0
With reporting fixed as the floor, Business Operations’ service numbers made full suspension look self-inflicted, and InfoSec priced the redaction protocol honestly.
Round 3 1 / 2 / 2 → 2 / 3 / 0
The exercise-findings history moved the program-entry voters. An honest split remained on when the committee hears “twelve tools” — retained as a validation question.
Round 4 1 / 3 / 1 → 2 / 3 / 0
Audit’s calendar inside the verification window ended with “complete the review first.”
Consultation log — excerpts
0:11 Enterprise Risk — what does the methodology require, and does a verbal brief count as reporting?
0:15 Business Operations — what does shutting the tool off actually cost in peak season?
0:22 InfoSec — what containment can hold without killing the tool mid-season?
0:37 Legal / Privacy — what do the clickwrap terms actually grant the vendor?
0:48 Legal / Privacy — what must be preserved, and who sequences the response?
Third-party risk / Procurement — never consulted. The owner of the intake lane at issue. Debrief question asked; see observations.
The upward sentences the room wrote
“An unassessed vendor has been processing participant hardship data for five months. It rates provisional High under our methodology, and it goes on Wednesday’s dashboard — with our containment plan beside it.”
“The threshold lane has produced twelve unsanctioned tools, two of them flagged last year and never registered. The systemic item goes to the committee as one entry, with an owner and a date.”
Accepted actions — owner, timeline, checkpoint
A1 Interim containment: single sign-on enrollment, seat freeze, redaction protocol; orphaned logins closed — InfoSec, 5 business days
A2 Provisional-High register entry and committee item drafted, instance and systemic — GRC Director, by lock
A3 Expense-data sweep extended firm-wide; triage of the eleven remaining tools — GRC Operations, 30 days
A4 Purchasing-card and software-intake gap closure proposal — Third-party risk lead, 20 business days
Validation and take-back register — excerpts
Does our methodology define provisional ratings in writing? — GRC Director, 10 business days
Do exercise findings have a defined route to the register? — Enterprise risk lead, 10 business days
What does our annual certification actually attest to about the register? — Sponsor, this cycle
Facilitator observations — exercise-level
The room voted in Round 1 before anyone confirmed the reporting rule; the Enterprise Risk consultation at 0:11 moved three votes — evidence the rule was available and unactivated.
Third-party risk and procurement — the owner of the intake lane at issue — was never consulted; the debrief surfaced that intake ownership is ambiguous in real life. Logged as a validation question.
The room collected “we’re still assessing” and “it’s being managed” in Round 2, then retired both in its own Round 3 wording drill.
Sponsor validation
Validated three business days after delivery, with one correction: a function seat had been combined, and the log now reflects it. Observations accepted as exercise-level.
What to notice
Four things in those documents are the actual product
Nothing is called a finding. Exercise observations and validation questions only. A gap becomes real when your team confirms it, not when a facilitator writes it down.
You sign the assumptions before anything is built. The scenario runs on your policy, your terminology, your escalation titles — approved by you in writing and mirrored in the statement of work.
The votes moved. Every round in that sample shifted after someone asked a function a direct question. That gap — between what the room thought and what it thought after asking — is the measurement the whole hour exists to produce.
The most useful line is a negative. One function was never consulted — the one that owned the lane through which the whole problem came. Nothing failed in the exercise. Something was learned about the organization.
A short checkpoint call is also available thirty days out, run off the accepted-action register: which actions reached their due date, which questions were answered, and what moved. One measure matters — at least one accepted action reached its checkpoint. If none did, that is the conversation.
That kit was built for IT risk. Yours would be built for your decision.
Choose the decision your leaders need to practice and bring us the policy behind it. The document set above is the same every time — only the scenario changes.
The documents above are real deliverables from one Xcelus Decision Brief™ — Leadership Edition kit, reproduced with pricing removed. Wrenhaven Mutual Insurance Group and all names, votes, and findings in the sample session summary are entirely fictional and were prepared to demonstrate the deliverable. Xcelus Decision Brief™ and Xcelus Decision Lab™ are trademarks of Xcelus LLC. Sessions are facilitated exercises and do not constitute legal advice.
Developed by Xcelus under the direction of Todd R. Corbett, MBA, Founder.
© 2005–2026 Xcelus LLC. All rights reserved.
© 2005–2026 Xcelus LLC. All rights reserved. This content is for training and discussion only and is not legal advice; consult qualified counsel about your organization’s specific obligations.