Compliance

1. Regulatory mapping

   Establishing which obligations apply to this organisation, in these markets, at this size — and keeping the list current as any of those change.

   Learn

2. Controls

   The mechanisms that make compliance the default rather than a matter of individual diligence. A control that depends on someone remembering is not a control.

   Learn

3. Monitoring

   Checking that controls are actually operating, as distinct from existing. The two diverge steadily and only testing reveals it.

   Learn

4. Incident response

   What happens when something goes wrong — detection, containment, notification and remediation. Designed in advance, because the first hours matter most and are the worst time to decide.

   Learn

1. The three lines model

   Institute of Internal Auditors · 1999

   Who owns a risk, who oversees it, and who independently checks both — kept as three distinct roles.

   The first line owns and manages risk in the work itself; the second sets policy and monitors; the third gives independent assurance to the governing body. The point is separation: assurance given by the people who would have to report their own failure is not assurance, whatever it is called.

   Reach for it when

   When setting up how compliance is organised, and when it is unclear who is actually responsible for a control.

   Where it stops

   Read as an org chart it produces bureaucracy and a first line that believes risk is someone else’s department. The 2020 revision exists largely because of that.

   Institute of Internal Auditors, position papers from 1999; The IIA’s Three Lines Model, 2020.

2. ISO 31000 risk management

   International Organization for Standardization · 2009

   A common set of principles and a process for identifying, assessing, treating and monitoring risk.

   It gives a vocabulary and a cycle rather than a checklist, and deliberately is not certifiable. Its most useful contribution to ordinary practice is the insistence that risk is defined against objectives — which means you cannot assess risk at all until someone has said what the organisation is trying to do.

   Reach for it when

   When building a risk process from nothing, or when everyone in the room means something different by the word risk.

   Where it stops

   It is a framework for process, not a source of judgement. It will not tell you what your risks are or how much of them to accept.

   ISO 31000, Risk management — Guidelines, International Organization for Standardization, 2009; revised 2018.

These are other people’s models, named here so you can go to the source and use them properly. The Omnigoal is not affiliated with their authors and is not endorsed by them; nothing of theirs is reproduced here — no canvas, no diagram, no wording. Each is described in our own words, with the originator credited, because the framework is a place to put thinking, not a replacement for the people who did it. Model names and trademarks belong to their respective owners and are used here only to refer to the work itself.

A control that depends on someone remembering is not a control. Test whether each one operates rather than whether it exists.