Control framework overview
🎯 Purpose
Describes how the control system in this workspace fits together: where controls are defined, how they are operated, tested and improved. Distribution-specific control operation lives in Distribution Controls; this document is the framework those operations follow.
🧭 The control loop
flowchart LR
A[Define\nrisk register] --> B[Operate\ninside SOPs]
B --> C[Attest\nmonthly CSA]
C --> D[Verify\n2nd line + audit]
D --> E[Improve\nCI pipeline]
E --> ADefine Risks are identified in the operational risk register; each material risk receives named key controls, an accountable owner and a defined evidence artefact.
Operate Controls operate within SOPs and work instructions. Controls that exist only in a register are not considered operationally effective.
Attest Control owners complete monthly control self-assessments supported by retained evidence.
Verify Second-line reviews sample attestations quarterly, while Internal Audit performs risk-based assurance reviews.
Improve Control failures, incidents and near-misses are routed into the continuous improvement pipeline for remediation and optimisation.
🛡️ Design rules
ℹ️ Control design requirement
Every control must define one accountable owner, an operating frequency and an evidence artefact. Controls missing any of these elements must not enter the control register.
- Preventive beats detective where the process allows it.
- Controls are written into the SOP step where they operate, with their register ID (for example CTRL-D-03), so procedure and register never drift apart.
🧩 Three lines summary
Line | Who | Role here |
|---|---|---|
First | Process teams and owners | Operate and attest controls |
Second | Risk and Compliance | Frameworks, sampling, challenge |
Third | Internal audit | Independent assurance |