Promise
The exact answer communicated to the client.
Home / Method and evidence
Method and evidence
4P Assurance Method
Cross-check Promise, Policy, Practice and Platform before concluding that a response is substantiated.
Question addressed
Prevent a response that is accurate on paper from becoming inaccurate in operations.
When a European client asks "are privileged access rights reviewed every quarter?", four different truths coexist within your company: what the sales team answered, what the procedure states, what the team actually does on a Friday evening, and what the technical directory enforces or lets through. The 4P method consists of systematically cross-checking these four levels before a response is sent.
The interest here is not academic. Audit findings, lost renewals and crises of confidence almost always arise from a gap between two of these layers: a promise broader than the practice, a policy the platform cannot enforce, or a real practice that is never documented. By making the gap visible before the client does, the method turns an imposed risk into a deliberate decision.
Cross-checking the four planes
A response is only supportable once the gaps between the four realities have been made explicit.
Policy
The rule, the owner and the exceptions.
Practice
The practices observed on a real sample.
Platform
The configurations and logs that settle the matter.
Decision enabledYou know, ahead of your client, which of your responses will hold up to an audit — and you choose what to correct, rephrase or stand by.
Reading a conclusion
Read a conclusion without concealing discrepancies
The output does not seek an average across the four planes. It shows which one supports the promise, which one weakens it, on what sample the observation is based, and which decision must be taken before responding to the client.
The exit sheet names the plan supporting the response, the one undermining it and the arbitration needed before any communication to the client.
Starting questionPrevent a response that is accurate on paper from becoming inaccurate in operations.
- 01Promise: what is stated to the client
- 02Policy: what is organised and documented
- 03Practice: what teams actually do
Implementation
Move from the declared statement to observable reality.
- Promise: what is stated to the client
- Policy: what is organised and documented
- Practice: what teams actually do
- Platform: what the systems enforce and record
01
Isolate the exact promise
The exact wording given to the client is retrieved: a questionnaire question, an annex clause, a tender response, a verbal commitment confirmed in writing. It is this wording — not a rephrasing — that serves as the reference for everything that follows.
02
Compare against the policy
The internal rule covering this promise is identified: does it exist, who is responsible for it, when was it last reviewed, what exceptions does it provide for? A promise without a policy is already a finding waiting to happen.
03
Observe actual practice
On a representative sample, we look at what actually happens: tickets, approvals, absences, tolerated workarounds. This is the most instructive plan — and the one most often overlooked by documentary reviews.
04
Query the platform
The systems decide: configurations, exports, logs. What the platform enforces is solid; what it allows without tracing is fragile; what it contradicts invalidates the response, regardless of the quality of the document.
Terms of use
The questions to settle before reconciling the four plans.
They prevent a well-drafted policy or an isolated configuration from compensating for a failing practice.
How is this different from a traditional audit?
An audit samples controls against a framework. The 4P starts from each commitment made to a specific client and works down to the systems. The result reads in the language of the contract, not that of the framework.
Are all four plans required every time?
The scope is proportionate: a low-stakes questionnaire response may stop at the Policy and the Platform. As soon as a commitment is contractual or audited, all four planes are documented.
What does a 4P analysis actually produce?
One conclusion per commitment — supported, partially supported, not supported or to be reviewed — with the associated evidence, any gap, its commercial impact and the action that closes the gap.
Continue reading
Review a response when the four plans do not yet tell the same story.
The applied matrix shows how a client response changes when policy, practice and platform do not yet tell the same story.