---
name: exec-narrative-patterns
description: Audience-specific tone and format guidance for leadership communications. Use when drafting any /report:* output to tune length, framing, and technical depth to the reader (board, audit committee, CEO, weekly CISO, regulator).
allowed-tools: Read
---

# Exec Narrative Patterns

Different readers want different things. The same findings should not land the same way in a board deck, a CISO 1:1, and a regulator response.

## Audience quick reference

| Audience | Length budget | Opening line wants | Technical depth | What they skip |
| --- | --- | --- | --- | --- |
| Full board | 1 page max | Strategic posture one-liner | Low. No control IDs in body. | Operational detail, acronyms, tables with >5 rows |
| Audit committee | 2 pages | Risk-and-assurance posture | Medium. Control families OK, not IDs. | Strategy monologue, vendor names unless load-bearing |
| Risk committee | 2 pages | Residual risk movement | Medium-high. Framework names, risk scoring. | Program branding, tool selection detail |
| CEO weekly | Half page | What changed, what's blocking, what's asked | Low. Translate everything. | Framework politics, tool comparisons |
| CISO weekly | 1 page | What moved, what's blocked, what's next | High. Control IDs, tool names, owner names fine. | Over-explained context |
| Regulator / auditor | As long as needed | Precise scope + evidence | Maximum. IDs, artifact paths, timestamps. | Narrative softening |

## Tone rules

**Board and audit committee**

- Past tense for what happened. Present tense for posture. Future tense only for asks.
- Numbers must be honest. Round where range matters more than precision. "Roughly 80%" beats "82.3%" if the instrument is noisy.
- Never start with control IDs. Start with impact.
- Name one person accountable per open item. Anonymous ownership reads as no ownership.

**CEO weekly**

- Assume 90 seconds of attention.
- Lead with the delta from last week. If nothing changed, say that.
- Asks come with the decision you want, not the full context. Attach the context.

**CISO weekly**

- Peer tone. You share context with the reader.
- Bullets, not paragraphs.
- Owner names and dates are load-bearing.

**Regulator / auditor**

- Precision. Timestamps, scope statements, evidence paths.
- Tone is neutral, not defensive. The facts do the work.

## Format conventions

- Headline row: one sentence, no hedging. If the week was quiet, the headline says so.
- Tables beat prose for multi-framework status. Prose beats tables for narrative arcs.
- Appendix is where detail lives. Body stays clean.
- Dates are `YYYY-MM-DD`. Periods are `YYYY-Q#` or `YYYY-W##`.

## Length tests

If you cannot defend every sentence as "the audience needed this to make a decision," cut it.

If the document opens with context before the point, invert it.

If there are three open items and no ask, you are reporting, not communicating. Add the ask.