The Manager Playbook for GRAA Using DVMS – The GRAA Management Series Part 6

David Nichols – Co-Founder and Executive Director of the DVMS Institute

Managers do not need another program to run. We already have plenty. What we need is an operating rhythm that makes governance executable, resilience repeatable, assurance provable, and accountability fair. That is what GRAA becomes when it moves from a concept to a management cadence.

Across this series, we have built the pieces. In Part One, governance evolved into boundary-setting, enabling decisions to be made at the edge without compromising control. In Part Two, resilience became a daily delivery behavior, especially in degrade-and-recover playbooks. In Part Three, assurance became operational evidence rather than compliance artifacts. In Part Four, accountability became decision rights, escalation obligations, and evidence ownership. In Part Five, we treated dependencies as seams that must be governed with the same boundary and evidence discipline as internal work. Now we pull those pieces into a playbook that managers can actually run.

This also closes the loop with the GRAA Leadership Series. In Part Six, “Running on CPD,” the point is that Create, Protect, and Deliver is the operational flow of the enterprise. In Part Seven, “You Do Not Need More Dashboards,” the key point is that status reporting is not a substitute for a thorough understanding of the system and operational evidence. The management version of those points is simple. If you can run CPD as an operating rhythm and produce evidence from regular work, you can govern and assure resilience without turning it into bureaucracy.

This article provides a clear and practical approach. It recognizes the existence of GRC and audit. It reduces the paper chase by making evidence a byproduct of operations. It also acknowledges that managers must make trade-offs under pressure.

The playbook in one sentence

Set boundaries for outcomes, design degrade and recover behaviors, gather evidence through regular work, assign decision rights and obligations, and update the system based on what you learn. That one sentence is the playbook. The rest is how you operationalize it.

Start with one outcome, not the whole enterprise.

Managers often get stuck because they think “operational resilience” means modeling everything. It doesn’t. It means being disciplined about what is critical and then making that critical slice governable.

Pick one critical outcome. If you are unsure how to pick, use a practical criterion. Choose the outcome that would cause the most customer harm, regulatory exposure, or business disruption if it failed for a day. Then treat that outcome as your unit of management. Not the system. Not the team. The outcome.

This aligns with the logic in Thriving on the Edge of Chaos: Managing at the Intersection of Value and Risk in the Digital Era. The book’s practical contribution is that value and risk appear at the same point in the system, where outcomes are produced. Managing outcomes is where resilience truly becomes a reality.

The four artifacts that matter, and why they are not “paperwork.”

To run the cadence, you need a small set of living management objects. Think of them as control surfaces, not documents. You need an Outcome Boundary Card. It defines what matters, tolerances, decision rights, escalation triggers, and evidence expectations. This comes from Part One.

You need a Degrade and Recover Playbook. It defines what happens when tolerances are threatened, including controlled degradation, recovery sequencing, and verification. This is from Part Two.

You need a Minimum Evidence Portfolio. It defines the evidence you maintain to show that the outcome can be sustained and recovered predictably. This came from Part Three.

You need a Decision Rights Map. It defines who can authorize, who must escalate, and who is responsible for maintaining specific evidence. This is from Part Four.

If you treat these as static documents, you will recreate the problem. If you treat them as living tools used in daily work, they become the mechanism that produces resilience and assurance.

The weekly cadence, 30 to 45 minutes

A weekly cadence should be short, focused, and grounded in operational reality. The goal is not to review everything. The goal is to maintain current boundaries and evidence, and to catch any drift before it becomes impactful. In a healthy weekly meeting, you cover four things.

First, you review operational signals, including incidents, near-misses, and exceptions. You also review changes that introduce unexpected variance, because change is where drift often begins. If you have key suppliers or internal dependencies, you include their variance signals as well.

Second, you check boundary health. Are we operating within tolerance? Are we approaching a tolerance threshold? Are there conditions that would trigger a controlled degrade if they worsen? This is where governance becomes real. The conversation is not “Are we green?” It is “Are we within boundaries, and what do we do if we are not?”

Third, you briefly review the evidence portfolio. The question is not “do we have documents?” The question is “do we have current proof?” If a restore test is due, a verification check is stale, or a drill is overdue, you will see it early.

Fourth, you record decisions. This is lightweight. If you decide to accept an exception, delay a change, update a tolerance, or schedule a drill, you capture the decision and the rationale. Two or three sentences are enough. The point is traceability.

That weekly rhythm gives you something managers value. It reduces surprises. It shortens time-to-decision when something happens because the boundaries and evidence are already current. It also has a side benefit. It makes audits easier. Evidence is already being produced and refreshed.

The monthly cadence is 60 to 90 minutes.

Monthly is where you validate behavior. Pick one scenario. It can be a short tabletop. It can be a limited technical drill. The point is to validate that your degrade and recover playbook still works, and that decision rights and verification steps are understood.

In the drill, focus on three things:

• Can we detect drift early enough to act within tolerance?
• Can we execute a controlled degrade predictably?
• Can we recover in sequence and verify integrity before declaring normal?

You will quickly learn where seams exist. Perhaps the dependency owner is unclear on escalation. Possibly, recovery sequencing is debated. Perhaps verification steps are missing or not automated. Perhaps manual modes are not realistic.

Do not try to fix everything. Choose one or two improvements. Update the playbook. Update the boundary card. Update the evidence portfolio. Then record that you did it. That record is evidence. It demonstrates that the system is not only documented but also thoroughly rehearsed. This is the operational version of what was described in the GRAA Leadership Series – Part Five, “From Chaos to Capability.” Capability is built through practice, and practice creates evidence.

The quarterly cadence, cross-team, and supplier alignment

Quarterly is where you make the ecosystem behave. A quarterly exercise should cross seams. That means it includes at least one key internal dependency and, where feasible, at least one key supplier. The goal is not to run a giant simulation. The goal is to validate boundary alignment and communication.

Here are the management questions a quarterly session should answer:

• Do our tolerances align with the dependency’s recovery behavior?
• Do we have a shared understanding of escalation triggers and communication paths?
• Do we have a shared view of what “restored” means, including integrity verification?
• Do we know what we need from each other during disruption?
• Do we have evidence from the last quarter that these behaviors were tested?

This is where managers build absolute confidence. Not the comfort of a report, the confidence that a system of organizations can behave predictably. This also reduces the “supplier surprise” problem we discussed in Part 5. Supplier management becomes outcome management.

How accountability is maintained without becoming punitive

Accountability is what makes this cadence stable. Without accountability, a cadence becomes a meeting. With accountability, it becomes an operating discipline. In this playbook, accountability is not about blame. It is about obligations.

• Someone owns keeping the Outcome Boundary Card current.
• Someone owns the Degrade and Recover Playbook and ensures it reflects real operational behavior.
• Someone owns the Minimum Evidence Portfolio, not as a librarian, but as a manager responsible for ensuring evidence exists and stays fresh.
• Someone owns decision rights clarity, especially when roles change.

These are not huge jobs if the scope is one outcome. The point is that they are explicit. When they are explicit, they survive turnover and pressure.

This aligns with the culture and structure themes from the GRAA Leadership Series. In Part Three, culture is described as the hardest control surface. In Part Four, the 3D model highlights misalignment. A cadence like this helps managers shape culture and align behavior. It makes escalation normal. It makes verification normal. It makes learning normal.

Where AE-P fits, without turning the playbook into a sales pitch

Since your enterprise offering will be delivered through partners and the platform is licensed, it is helpful to clearly state the platform’s role. A platform like Adaptive Edge Platform can help by making boundary objects visible, capturing evidence, connecting signals to tolerances, and maintaining traceability of decisions. It can reduce the overhead of gathering evidence by allowing it to be collected from operational sources rather than compiled manually.

It can also help scale the cadence across multiple outcomes, as consistency is challenging when every team invents its own approach. The key is that the platform supports the management discipline. It does not replace it. The discipline produces resilience. The platform reduces friction and improves consistency and proof.

This aligns with the intent of the GRAA Leadership Series – Part Seven, “You Do Not Need More Dashboards.” A platform should not be a prettier dashboard. It should support system understanding and evidence, tied to boundaries and decisions.

A practical rollout approach that managers can actually live with

If you want to introduce this playbook into an organization without overwhelming people, use a staged approach. Start with one outcome. Build the four management objects. Run the weekly cadence for a month. Run one monthly drill. Then select a second outcome.

When you expand, keep the same structure. The structure creates coherence. Variation should be in the tolerances and playbooks, not in the method.

If you are working with delivery partners, this is also how partner facilitation adds value. Partners can help teams create boundary cards, design playbooks, set up evidence capture, and run drills, while the enterprise retains ownership of outcomes and decisions.

How managers know it is working

Managers like measurable improvement. The playbook produces it. You should see decision speed increase during incidents, because decision rights and boundaries are clear:

• You should see recovery become more predictable because sequencing and verification are rehearsed.
• You should see fewer “surprise escalations” because escalation triggers are condition-based and drift is detected earlier.
• You should see audits become less painful because the evidence is current and linked to operational behavior.
• You should also see a subtle culture shift. Teams become more willing to escalate early. They become more consistent about verification. They become more comfortable making decisions within tolerances.

These are not soft outcomes. They are operational outcomes that managers can feel.

Make GRAA a cadence, not a campaign.

If you take one message from this series, let it be this. GRAA is not something managers should implement as a new campaign. It is something managers can run as an operating rhythm, anchored in Create, Protect, Deliver, and expressed through clear boundaries, consistent behaviors, tangible evidence, and effective accountability.

To begin, select one outcome and commit to a ninety-day timeframe. Conduct weekly boundary and evidence reviews. Hold one monthly drill. Include a quarterly seam exercise if possible. Keep it positive. Keep it practical. Keep it grounded in evidence.

You will not eliminate disruption. You will reduce chaos. You will make decisions more quickly and with greater confidence. You will recover with greater predictability. You will walk into audits with less dread because the system will already be producing proof.

That is what operational resilience looks like when it is managed, not merely described.

About the Author

Dave is the Executive Director of the DVMS Institute.

Dave spent his “formative years” on US Navy submarines. There, he learned complex systems, functioning in high-performance teams, and what it takes to be an exceptional leader. He took those skills into civilian life and built a successful career leading high-performance teams in software development and information service delivery.

Digital Value Management System® is a registered trademark of the DVMS Institute LLC.

® DVMS Institute 2026 All Rights Reserved