Defensibility

Being confident you made the right call is not the same as being able to show it. Challenges rarely turn on the outcome. They turn on whether there is documented reasoning behind it, real evidence under it, and a fair process around it — and organisations that are sure of themselves are often the ones with the least of that written down.

What it does. You paste the policy or decision text and name the threat you are testing it against — a pre-publication review, a complaint that has landed, an FOI or subject access request where you should assume daylight, hostile media and social media framing, or a board and governance challenge from trustees, a regulator or audit. Each context reshapes the analysis rather than relabelling it, so the same policy tested against a formal grievance and against a journalist returns different exposure. You can anchor it to your sector, which heightens scrutiny against sector-specific duties, and describe the particular challenge you have in mind.

What you get. A line-by-line read on where the position would hold and where it would break. Defensibility is judged on the quality of your reasoning, your evidence and your process, not on which outcome you reached — so what comes back is the weak links, not a verdict. Nothing is stored unless you save it.

Who uses it. EDI and governance leads before a decision goes live. HR and people leads holding a contested line. Legal and risk colleagues who want the exposure named before they are asked to defend it.

Where it fits. The Readiness check surfaces the need. It sits naturally after Proportionality Check — that tool builds the reasoning record, this one asks whether the record would hold — and beside Policy Hardener, which asks the same question of the document rather than the decision. What it finds is usually what Challenge Response has to answer for.