Exercise 3: Why "We Followed PTES" Outperforms "We Did What Seemed Reasonable" — Possible Solution ==================================================================== THE QUESTION ------------------------------ Explain why "we followed PTES" is a stronger position after an incident than "we did what seemed reasonable at the time," even if the actual steps taken were nearly identical. CONSISTENCY ------------------------------ Per this chapter, consistency means "the same engagement produces comparable results whoever runs it." "We did what seemed reasonable" describes a process that existed only in one tester's own judgment at the time — it can't be independently verified against anything, and a different reviewer has no fixed reference point to check the work against. "We followed PTES" points to a published, external document whose seven phases are fixed and checkable regardless of who executed them. COMPLETENESS ------------------------------ Per this chapter, a published framework "was built and refined by many practitioners over years specifically to avoid skipped steps," while "an individual's own improvised checklist has no such guarantee." Even if the actual steps taken were nearly identical in this specific case, "we did what seemed reasonable" carries no assurance that a similarly-improvised process would have avoided a skipped step on a different engagement. "We followed PTES" carries an implicit claim that a broader set of practitioners already vetted the process for gaps. LEGAL DEFENSIBILITY ------------------------------ Per this chapter's own explicit wording, "if an engagement is ever scrutinized after the fact... 'we followed a recognized, published standard' is a genuinely different, stronger position than 'we did what seemed reasonable at the time.'" This is the direct, load-bearing answer to the question: even with identical actual steps, only the first statement points a skeptical outside reviewer (a court, an auditor, an insurer) toward an independently-defined, externally recognized standard they can go verify for themselves. "Seemed reasonable" is inherently a subjective, after-the-fact judgment call that depends entirely on trusting the tester's own account — exactly the kind of claim that is hardest to defend once it's being challenged by someone with an adversarial interest in disputing it. WHY THIS WORKS AS AN ANSWER ------------------------------ It applies each of the chapter's own three named reasons individually to the specific comparison in the question, rather than treating "legal defensibility" as the only relevant one, and explains specifically why identical actual steps still don't make the two STATEMENTS equally strong.