EXIN Lean IT Foundation cheat sheet

Define customer outcomes and distinguish necessary control work from avoidable waste.

Map the end-to-end stream, including queues and rework.

Pull and WIP policies require actual capacity and operating rules.

Measure flow with consistent scope, units and quality needs.

A problem statement must not assume an untested cause.

Root-cause tools organize hypotheses that still need evidence.

PDCA, DMAIC and design methods address related but distinct needs.

Sustain improvement with ownership, representative measures and feedback.

Define numerator, denominator, population and collection method.

Specification and control limits describe different things.

Capability and sigma claims require explicit model assumptions.

Sponsors, owners and team members have distinct accountable roles.

Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register

Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence

Risk requires a threat, a vulnerability, and an impact; none alone is sufficient

Inherent risk is before controls, residual risk after them - always state which is being scored

Control effectiveness and uncertainty affect any expected-loss comparison.