Skip to main content

Applications for the autumn mentorship cohort are open until 30 September. Apply now

Risk, Security & Legal

Evaluating Team and Delivery Risk

How to assess execution risk fairly: reading delivery history as evidence rather than reputation, spotting key-person and vendor dependencies, issue-spotting custody and change controls, matching mitigations to the size and reversibility of the ask, and recording it all in a delivery-risk register.

IntermediateCase study134 minv1.0.0 · effective Aug 9, 2026
Course catalogue

Learning outcomes

  • Read a delivery history as dated evidence, distinguishing delay from concealment and noting evidence of correction
  • Map key-person, permission and vendor dependencies, and test whether succession and fallback are real
  • Issue-spot custody and change controls — thresholds, separation of duties, recovery, monitoring — without giving security assurances
  • Propose mitigations proportionate to the amount, the reversibility and the evidence available
  • Produce a delivery-risk register with risk, evidence, likelihood, impact, mitigation, owner and open questions
134 minutes · 5 lessonsVersion 1.0.0 · effective 8/9/2026
Lesson 1 of 524 min read

Reading delivery history fairly

Delay, transparency, correction and evidence of learning - reading a track record as evidence rather than reputation.

What you will be able to do

Most funding decisions that go wrong do not go wrong on policy. They go wrong on execution: the work is late, thinner than described, or never arrives. That makes delivery history one of the highest-value things a representative can examine, and also one of the easiest to examine badly. Reputation is cheap to acquire and cheap to lose unfairly. This lesson replaces reputation with a procedure that produces the same reading whether you know the team socially or have never heard of them.

  • Separate each delivery claim from the artefact that would verify it.
  • Distinguish delay, disclosure failure and non-delivery, and date each one.
  • Find evidence of correction rather than evidence of contrition.
  • Record absence of history as missing evidence, not as negative evidence.

Definitions

Delivery claim
A statement by a proposer that some past work was completed. It is a claim until an artefact exists that someone else can inspect.
Artefact
A durable, inspectable output: a URL that serves, a repository at a commit, a published report, an on-chain transaction, a signed audit letter.
Slippage
The difference between a committed date and an actual date. It is a measurement, not a judgement.
Disclosure lag
The time between a team knowing a commitment would slip and telling the people who relied on it.
Scope drift
Delivery of something materially different from what was described, whether or not the delivery was on time.
Evidence of correction
An observable change in process following a failure - a new review step, a changed release cadence, a published post-mortem - as distinct from an apology or an intention.

Claims and artefacts

Begin by extracting every delivery claim in the proposal into a list, in the proposer own words. Then, beside each, write the artefact that would settle it. This is a mechanical step and it is where most of the value is: a claim such as "we built the analytics tooling used across the ecosystem" resolves into a question with a checkable answer - which tooling, at which URL or repository, and who besides the team uses it? A claim such as "we have five years of experience in the space" resolves into nothing checkable at all, which is itself worth recording.

Label each claim with one of four outcomes: verified, partially verified, unverified, or contradicted. Reserve contradicted for cases where the artefact exists and disagrees with the claim, and describe the disagreement factually. Unverified means you looked and did not find; it is not an accusation, and it is honest to say that a claim may be true and simply undocumented. Record the date you looked, because repositories move and sites go down, and a reader six months later needs to know when your snapshot was taken.

Weight artefacts by how hard they are to fabricate and by who else has an interest in them. A live service with independent users is strong. A repository with a long commit history from several contributors is strong. A screenshot in a slide deck is weak. A testimonial from a party related to the proposer is weak unless the relationship is disclosed, in which case it is at least honest. None of these weights are moral judgements about the people involved; they are statements about how much the evidence can bear.

Delay is information, not a verdict

Software is late. It is late in well-run organisations with experienced teams and generous budgets, and it is late for reasons that are frequently outside anyone control: a dependency changes, a specification is amended mid-flight, a contributor becomes ill. A reviewer who treats any slippage as disqualifying will systematically reject honest teams who publish real dates and reward teams who publish nothing. That is the opposite of the incentive the ecosystem needs, and it is worth stating explicitly in your own notes so that you hold yourself to it.

What carries signal is the pattern around the delay. Three questions do most of the work. First, disclosure lag: did the team announce the slip before or after external parties noticed, and how long after they knew? Second, revision behaviour: did the revised date hold, or was it revised repeatedly by small increments - a pattern that often indicates the team does not know the size of the remaining work? Third, scope behaviour: did the deliverable quietly shrink to meet the date, and was the shrinkage disclosed as such?

Distinguish these clearly from non-delivery, where the work never arrived and funds were consumed. Non-delivery is a materially different finding and should not be softened into "delayed" simply because the team still describes it as forthcoming. Equally, non-delivery on its own does not establish dishonesty. Projects fail for many reasons and the reviewer is not equipped to determine intent. Record what happened, note whether unspent funds were returned or accounted for, and stop there.

A worked reading

Fictional composite for training

A team requests funds for a governance data service. Their history section lists three prior deliveries. Claim one: "Delivered an open-source indexer, on time." A repository exists, public, with 400 commits from four contributors, last active six weeks before submission, and a tagged release dated within the committed quarter. Label: verified. Note: activity has slowed, which is a question rather than a finding. Claim two: "Delivered a public dashboard; minor delays." The dashboard URL serves. Milestone records show the committed date was March and the artefact appeared in July. Two public updates in April and May announced the slip and gave revised dates; the second revision held. Label: verified with slippage of about four months, disclosed proactively, revised date met. Note: this is a good disclosure pattern, and a reviewer should say so as readily as they would flag a bad one. Claim three: "Completed a security review of the contract suite." No published letter, no reviewer named, no summary. Label: unverified, checked 9 August. Question to the proposer: who performed the review, on what commit, and can the letter or summary be published? Note carefully: the reviewer records this as unverified, does not describe the contracts as unaudited, and does not offer any view on whether the contracts are secure - that judgement requires expertise this review does not claim.

The composite deliberately mixes strong and weak evidence, because real histories do. The output is not a verdict on the team. It is three labelled rows, a dated snapshot, and one specific question that the proposer can answer in a sentence.

Evidence of learning

The most predictive thing in a delivery history is not the absence of failure but the presence of correction. A team that missed a date, published a plain account of why, and then changed something concrete - added a staging environment, split milestones into smaller units, hired a second reviewer, moved from private status updates to public ones - has demonstrated a capability that a team with an unblemished but shallow record has not demonstrated at all.

Test for correction the same way you test for delivery: ask for the artefact. A post-mortem document, a changed milestone structure in the current proposal compared with the last one, a repository showing a new CI step introduced after the incident. "We have learned from this and improved our processes" is a sentence, not evidence, and asking what specifically changed is a fair and non-hostile question. Where a team can point to the change, record it as a strength with the same rigour you apply to weaknesses.

Counterexample: the pristine unknown

Consider two requests of similar size. Team A has three prior deliveries, one of which slipped badly and was openly documented, and one of which was cancelled with unspent funds returned and accounted for. Team B is new, has no prior public delivery, and has therefore never missed a date. A checklist that scores "missed deadlines" as a negative and has no row for "no evidence either way" will rank Team B above Team A. That ranking is an artefact of the checklist, not a finding about the teams.

The correct treatment is to record Team B as an unevidenced execution profile: you have less information, so the range of plausible outcomes is wider in both directions. That is a genuine consideration for how much money to release at once - which lesson four addresses through tranches and acceptance evidence - but it is not a character finding, and new teams must be able to enter the ecosystem or it ossifies. Say what you know, say what you do not, and let the mitigation carry the uncertainty.

Common mistakes

  • Accepting a delivery claim because the team is well known, or rejecting one because they are not.
  • Treating any slippage as disqualifying, which penalises teams who publish honest dates.
  • Failing to distinguish delay, disclosure failure, scope drift and non-delivery.
  • Recording UNVERIFIED as though it meant FALSE, or implying that a gap proves concealment.
  • Inferring fraud from delay. A reviewer is not positioned to determine intent and should not imply it.
  • Describing unverified security review status as "unaudited" or "insecure", which is an assurance you cannot give.
  • Omitting the date of your check, leaving later readers unable to interpret your snapshot.
  • Scoring a history numerically, which hides the evidence a later reader needs to disagree with you.

What this establishes

You can convert a narrative history into a dated, labelled evidence table: each claim in the proposer own words, the artefact that would verify it, whether you found it and when, and a factual label. You can characterise slippage by disclosure lag, revision behaviour and scope behaviour rather than by its length alone, and you can identify concrete evidence of correction. The table is reproducible by a stranger and applies the same standard to teams you know and teams you do not.

What remains unknown

History constrains expectations; it does not predict this delivery. Teams change composition, scope differs, and past success on a small build says little about a large one. You cannot see private context - an illness, a funding gap, a dispute - that may explain a failure entirely. You cannot determine intent, and should not try. And an unverified claim may be perfectly true; you have established only that you could not check it on the date you looked.

Takeaways

Convert every delivery claim into an artefact question, then label it verified, partially verified, unverified or contradicted, with a date.

Read slippage through disclosure lag, revision behaviour and scope behaviour, not through length alone.

Look for a changed process after a failure; that is evidence of learning, and an apology is not.

No history is missing evidence, not bad evidence - carry that uncertainty in the mitigation, not in a character judgement.

Takeaways

  • A delivery claim is only evidence when an artefact exists that a stranger could check.
  • Delay is common in software and is information, not proof of dishonesty; how it was disclosed carries more signal than the delay itself.
  • Evidence of learning is a changed process with a date attached, not a promise to do better.
  • No track record means you have less evidence, which is a different finding from bad evidence.

Applied activity

Verify three delivery claims

Take any three delivery claims from a funding request or from a team public history. For each, record: the claim in the proposer own words; the artefact you would need to verify it (URL, repository, transaction, published report); whether you found that artefact and on what date; and one of four labels - VERIFIED, PARTIALLY VERIFIED, UNVERIFIED, or CONTRADICTED, with the reason. Then write one sentence per claim describing what it does and does not tell you about future delivery. Do not attribute motive to any gap you find.

Deliverable: A three-row verification table with artefacts, dates, labels and one interpretive sentence per claim. · about 40 minutes

Sources

  • DRep Institute vote rationale template

    Cardano DRep Institute

    The Institute's rationale template, published in the resource library.

  • Project Catalyst milestone module(opens in a new tab)

    Project Catalyst

    A public example of milestone-based release of community funds and recorded acceptance evidence.

  • DRep Institute Standards of Practice

    Cardano DRep Institute

    The Institute process standards referenced by the classification lab.

Practical exercise

Delivery-risk register and mitigation memo

Take the fictional composite funding request used in this course, or a real request of your choice, and produce a delivery-risk register plus a short covering memo. The register has one row per risk with seven columns: risk (one sentence, stated as an event rather than a judgement of character), evidence (what you actually observed, with dates and links, or UNVERIFIED), likelihood and impact (your own labelled qualitative rating with the reason for it), mitigation (a specific control the proposer could adopt), owner (who would carry out the mitigation), and open questions (the neutral question you would ask). Cover at least: delivery history, key-person and permission dependencies, vendor dependencies, custody and change control, and reporting. The covering memo states the two largest execution risks, the mitigations you consider proportionate to the amount and reversibility of this ask, and an explicit list of what you could not verify. Do not allege fraud or misconduct, do not offer legal, tax, sanctions or security advice, do not state that any arrangement is secure or compliant, and do not state how anyone should vote.

Deliverable: A seven-column delivery-risk register covering at least five risks, plus a one-page memo naming the two largest risks, proportionate mitigations and an explicit uncertainty list.

  1. 1.What exactly is being asked for, in your own words, without the proposer's framing?
  2. 2.Which claims did you verify against a primary source, and which source was it?
  3. 3.Which claims could you not verify, and what would it take to verify them?
  4. 4.What is the strongest argument against your current reading of the evidence?
  5. 5.What would you publish so someone who disagrees with you can audit your reasoning?
Autosaves on this device0 / 20,000

Signed out: this draft stays on this device. Sign in to save it to your account and have it count towards completion.

Final assessment

Final assessment

Answer every question to complete this course. Your attempts are private to you.

8 questions · pass mark 70%Private result · unlimited attempts · never published

Sign in to submit an attempt. Assessments are graded on the server, so they cannot be taken anonymously.

  1. 1. A proposal states: "we built the analytics tooling used across the ecosystem." What is the correct first step?

    Think about claims versus artefacts.

  2. 2. A treasury uses a two-of-three multisig. All three keys are held by one person on one laptop. What should the review record?
  3. 3. A proposal names eight contributors, but only one person has ever deployed the system and only that person holds the deployment credential. How is this classified?
  4. 4. A proposal says responsibilities are shared and there is a plan if someone leaves. Which follow-up best tests whether the plan is real?
  5. 5. Team A has three prior deliveries, one badly delayed and openly documented. Team B is new with no public delivery history. What is the defensible treatment?
  6. 6. Which milestone completion criterion is written so a stranger could verify it without asking the team?
  7. 7. A team missed a committed date by four months, announced the slip publicly before anyone else noticed, gave a revised date, and met it. How should this be recorded?
  8. 8. Which entry belongs in a delivery-risk register?
Reference sheet

Delivery-risk register

A printable prompt sheet and register template for assessing execution risk the same way twice.

Definitions

Delivery claim
A statement by a proposer that some past work was completed. It is a claim until an artefact exists that someone else can inspect.
Artefact
A durable, inspectable output: a URL that serves, a repository at a commit, a published report, an on-chain transaction, a signed audit letter.
Slippage
The difference between a committed date and an actual date. It is a measurement, not a judgement.
Disclosure lag
The time between a team knowing a commitment would slip and telling the people who relied on it.
Scope drift
Delivery of something materially different from what was described, whether or not the delivery was on time.
Evidence of correction
An observable change in process following a failure - a new review step, a changed release cadence, a published post-mortem - as distinct from an apology or an intention.
Key-person risk
The exposure created when a critical activity can be performed by only one individual.
Bus factor
The number of people who would have to become unavailable before a project stalls. A bus factor of one is the condition this lesson looks for.
Knowledge dependency
Only one person understands how something works. Mitigated by documentation, pairing and handover time.
Permission dependency
Only one person can perform an action because they alone hold the credential, key or account. Mitigated by adding holders, thresholds and recovery paths.
Relationship dependency
Only one person can obtain something because they hold the relationship - a partner, a data provider, a community. Mitigated by contracts, introductions and shared contact.
Succession plan
A named person or process that takes over a role, together with the access and information needed to do it.
Vendor dependency
Reliance on an external supplier or service, including hosts, indexers, data feeds, auditors and payment processors.
Custody
The arrangement by which funds are held and the conditions under which they can be moved.
Multi-signature (multisig)
A scheme requiring signatures from several keys before a transaction is valid. On Cardano, native scripts and the CIP-1854 derivation standard describe how such wallets are constructed.
Threshold
The number of signatures required out of the total, written as m of n. It bounds both the risk of unilateral action and the risk of being locked out.
Signer independence
The degree to which signing parties are genuinely separate: different people, different devices, different locations, different organisations.
Separation of duties
A control principle under which no single party both initiates and approves the same sensitive action. The term is drawn from general control catalogues such as NIST SP 800-53.
Key lifecycle
Generation, storage, use, rotation, backup, recovery and destruction of keys. General guidance exists in NIST SP 800-57; applying it to a specific setup requires expertise.
Change control
The process governing who may alter code, parameters or permissions, through what approval, and with what delay before the change takes effect.
Proportionality
The principle that the burden of a control should match the exposure it addresses, judged on amount, reversibility, concentration and evidence.
Tranche
A portion of the total released on its own schedule or against its own condition.
Acceptance evidence
The artefact that establishes a milestone is met, checkable by someone outside the team.
Reversibility
The extent to which a decision can be undone, and at what cost, once funds are spent or a dependency is established.
Pause condition
A pre-agreed circumstance in which work and funding stop before the planned end, together with who may invoke it.
Discovery phase
A small funded piece of work whose purpose is to reduce uncertainty about the larger piece, producing a specification, prototype or feasibility finding.
Risk register
A structured table recording identified risks together with their evidence, assessment, planned mitigation, owner and outstanding questions.
Risk statement
A sentence of the form: if this event occurs, then this consequence follows. It names an event, not a person.
Likelihood
A qualitative label - low, medium, high - expressing how plausible the event is, always accompanied by the reasoning that produced the label.
Impact
A qualitative label describing the consequence if the event occurs, expressed in terms of funds, time, dependency or reputation.
Owner
The party who would carry out the mitigation. Usually the proposer; sometimes the community, an external reviewer, or the funder.
Open question
A neutral question whose answer would change a row. It is the mechanism by which a register improves rather than hardens.

Checklist / method

  • Register columns: risk | evidence (dated, linked, or UNVERIFIED) | likelihood | impact | mitigation | owner | open question
  • Delivery history: what has this team delivered, where is the artefact, and who verified it?
  • Was slippage disclosed by the team before it was noticed by others, and how quickly?
  • Is there evidence of correction - a changed process after a failure, not just an apology?
  • Absence of a track record is missing evidence, not negative evidence; record it that way
  • Roles: which named person does each critical activity, and what fraction of their time is committed?
  • Permissions: who can deploy, merge, sign, publish and pay? Is any of these held by one person?
  • Vendors: which external suppliers, hosts, indexers or auditors is delivery dependent on?
  • Succession: is the fallback named, informed and able, or is it aspirational?
  • Custody (issue-spotting only): what signing scheme, what threshold, held by how many distinct parties?
  • Are signers independent of one another, or would one incident affect several at once?
  • Recovery: what is the documented process if a key is lost, and when was it last rehearsed?
  • Change control: who can alter parameters, upgrade contracts or move funds, through what process and delay?
  • Monitoring: what is watched, by whom, and what triggers an alert to someone outside the team?
  • Proportionality: does the control burden match the amount, the reversibility and the evidence?
  • Tranches: is money released against acceptance evidence a stranger could check, or against dates?
  • Acceptance evidence: a URL, a hash, a published artefact - not a status adjective
  • Pause condition: what stops the work early, who can invoke it, and what happens to unspent funds?
  • Alternatives: is a smaller pilot, a longer discovery phase or a different structure available?
  • State clearly what you could not verify, and never imply that delay alone proves dishonesty
  • Nothing in this sheet is legal, tax, sanctions, accounting or security advice

Final template

  1. 1.What was asked - a plain restatement of the request.
  2. 2.What I verified - claim, source, and what the source actually says.
  3. 3.What I could not verify - the open list, with the question still outstanding.
  4. 4.Strongest counter-argument - stated in its best form.
  5. 5.Disclosures - relationships, holdings or history relevant to this action.
  6. 6.How I would publish this - the rationale a reader could audit.