Compliance · Controls · Component
The control owner
Who is accountable for the control operating — not for the policy existing.
The deliverable
What it is
Controls fail most often through personnel change. The person who ran it leaves, and the control continues to exist on paper.
Ownership of the control operating is a different thing from ownership of the policy, and conflating them is why policies survive while controls lapse.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The competence
Whether whoever operates the control can actually do so.
3 attributes: Training · Judgement required · Last trained
LearnThe succession
What happens to the control when the owner changes role.
3 attributes: Deputy · In handover process · Last transferred
Learn
Add control ownership to the leaver checklist. Controls lapse silently at exactly the point someone changes role.
The other components in controls
The control set
Each control, what it addresses, and whether it prevents or detects — built into the process rather than checked afterwards.
LearnThe evidence trail
What the control produces as proof that it ran — generated by operating rather than assembled before an audit.
Learn