Calibrating Severity Before the Freeze Date

Severity arguments that surface the night before the board meeting are rarely about the finding itself. They are about unspoken definitions: does a control gap count as high when compensating controls exist? Does a one-off exception still warrant escalation?

We run calibration using two or three anonymised findings from the current cycle plus one from the previous year. Teams rate independently, then reconcile. The conversation surfaces the real criteria people already use.

Write the agreed matrix in plain language and attach it to the pack as a standing reference. New joiners and external attendees then share the same vocabulary.

Freeze the ratings at least five working days before distribution. After that, only factual corrections move—not re-ratings driven by presentation anxiety.