Compliance · Controls · Component
The control set
Each control, what it addresses, and whether it prevents or detects — built into the process rather than checked afterwards.
The deliverable
What it is
A control built into the process happens by default; one that depends on remembering happens when people are not busy, which is exactly when it is least needed.
Preventive controls are cheaper to operate and harder to build; detective controls are the reverse. The mix should be a decision.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The controls
Each control, with what it is meant to prevent or catch.
3 attributes: Control · Addresses requirement · Type
LearnThe design
How the control actually works, including whether it can be bypassed.
3 attributes: Mechanism · Automated · Bypass
LearnThe coverage
Which requirements have controls, and which do not.
3 attributes: Requirement · Controls · Coverage
Learn
A control that can be overridden is detective at best. The override then needs its own control.