Recommendations & Suggestions — Unit 12, Upper-intermediate English

**From:** Risk Advisory **To:** Steering Committee **Subject:** Launch readiness — recommendations

Colleagues,

Following last week's review, we **would recommend** delaying public launch until pen-testing closes. It **is advisable to** keep billing inactive until UAT passes and rollback paths are verified. We **propose that** the board extend the pilot by four weeks rather than commit to a fixed go-live date.

A two-region deployment **is a viable option** if scope remains narrow. **Consider implementing** MFA org-wide before marketing scales spend. **Best practice** suggests segregating duties on payment approvals and limiting admin overrides.

External counsel **urge** written confirmation of scope before contracts are amended. We **suggest that** customer training **precede** any broad advertising campaign. **In my considered view**, rushing acquisition spend would undermine the **measured approach** we have taken so far.

**My preference would be** to fix churn in cohort B before scaling ads. Retention is **high on the agenda** this quarter, and a partner channel **is worth exploring** once core flows stabilise. The hybrid pricing model **merits consideration**, though we **would not rule out** a partial rollback if defects recur.

We **strongly advise** completing independent review of the payment stack. **It would be prudent to** delay marketing spend until support playbooks are signed off. **I would advocate** a **strategic move** toward phased billing rather than a single annual invoice. **We are cautiously optimistic about** EMEA uptake if these safeguards stay in place.

**What we are not recommending, and why**

Advisory notes are often read as a list of cautions, so it is worth stating explicitly where we think caution would be the wrong answer.

**We do not recommend delaying the EMEA pilot.** Several committee members have proposed extending the delay to the pilot as well as to public launch, on the reasonable ground that the same defects apply. We disagree. The pilot cohort is 340 accounts under a pre-release agreement, monitored daily, with a rollback path that has been exercised twice. Its purpose is to surface exactly the defects that concern the committee, and delaying it removes our best source of information about whether the delay was necessary.

**We do not recommend a full independent audit of the payment stack.** We recommended independent review, which is narrower and which we would expect to complete in three weeks. A full audit would take eleven and would examine components unchanged since 2022. **The distinction matters** because the committee's paper has already converted our recommendation into the broader one, and the cost difference is roughly £180,000.

**We do not recommend that MFA be made a launch gate.** It should be implemented org-wide, and we said so; making it a gate for this launch couples an unrelated programme to this timeline and gives two teams a shared deadline neither controls.

**We do not have a view on pricing.** The hybrid model **merits consideration** on commercial grounds, and we have been asked three times to endorse it. Risk Advisory has no basis on which to do so, and an endorsement from us would lend it a legitimacy it should earn elsewhere.

**A general observation.** Six of our last eleven recommendations were adopted in a stronger form than written. We would rather be quoted accurately than agreed with enthusiastically, and we would ask that our wording be reproduced rather than summarised.