Control framework overview

🎯 purpose describes how the control system in this workspace fits together where controls are defined, how they are operated, tested and improved distribution specific control operation lives in distribution controls ; this document is the framework those operations follow 🧭 the control loop flowchart lr a\[define\nrisk register] > b\[operate\ninside sops] b > c\[attest\nmonthly csa] c > d\[verify\n2nd line + audit] d > e\[improve\nci pipeline] e > a define risks are identified in the operational risk register; each material risk receives named key controls, an accountable owner and a defined evidence artefact operate controls operate within sops and work instructions controls that exist only in a register are not considered operationally effective attest control owners complete monthly control self assessments supported by retained evidence verify second line reviews sample attestations quarterly, while internal audit performs risk based assurance reviews improve control failures, incidents and near misses are routed into the continuous improvement pipeline for remediation and optimisation 🛡️ design rules ℹ️ control design requirement every control must define one accountable owner, an operating frequency and an evidence artefact controls missing any of these elements must not enter the control register preventive beats detective where the process allows it controls are written into the sop step where they operate, with their register id (for example ctrl d 03), so procedure and register never drift apart 🔎 governance implementation guidance reference control ids directly within sop activities and operational procedures retain evidence in auditable repositories aligned to records retention requirements prioritise preventive controls where process architecture allows automation or hard stop enforcement review control effectiveness through recurring governance forums and operational metrics 🧩 three lines summary line who role here first process teams and owners operate and attest controls second risk and compliance frameworks, sampling, challenge third internal audit independent assurance