Business Core · Compliance · Module
Controls
The mechanisms that make compliance happen — built into how work is done, rather than checked afterwards.
The idea
How it works
A control built into the process happens by default; one that depends on remembering happens when people are not busy. The first survives pressure, the second is exactly what fails when it matters.
Controls must produce evidence as a by-product of operating. A control with no trace cannot be demonstrated to have worked, which for regulatory purposes is close to it not having worked.
Working with it
In practice
- 01
Prefer preventive to detective
A system that will not accept the wrong entry beats a report that finds it next month.
- 02
Name an owner per control
Someone accountable for it operating, not just for the policy existing.
- 03
Generate evidence automatically
Evidence produced by operating the control, rather than assembled before an audit.
- 04
Separate incompatible duties
The person who requests should not be the person who approves. Small organisations need a compensating control instead.
One level in
The components of controls
A component is something that exists afterwards which did not exist before — a deliverable or a mechanism, not an intention.
A control that depends on remembering fails exactly when the pressure is on. Build it into the process.
The other modules in compliance
Regulatory mapping
Establishing which rules actually apply — by jurisdiction, sector and activity — before deciding how to meet them.
LearnMonitoring
Checking that controls are actually operating, independently of the people who operate them.
LearnIncident response
What happens when something goes wrong — containment, notification and correction — decided in advance rather than during.
Learn