---
title: Control framework overview
slug: risks-and-controls
icon: {"lucideIcon":"ShieldCheck"}
docTags: 
createdAt: 2026-08-17T11:16:11.648Z
---

## 🎯 Purpose

Describes how the control system in this workspace fits together: where controls are defined, how they are operated, tested and improved. Distribution-specific control operation lives in **Distribution Controls**; this document is the framework those operations follow.

## 🧭 The control loop

```mermaid
flowchart LR
  A[Define\nrisk register] --> B[Operate\ninside SOPs]
  B --> C[Attest\nmonthly CSA]
  C --> D[Verify\n2nd line + audit]
  D --> E[Improve\nCI pipeline]
  E --> A
```

::::WorkflowBlock
:::WorkflowBlockItem
**Define**
Risks are identified in the operational risk register; each material risk receives named key controls, an accountable owner and a defined evidence artefact.
:::

:::WorkflowBlockItem
**Operate**
Controls operate within SOPs and work instructions. Controls that exist only in a register are not considered operationally effective.
:::

:::WorkflowBlockItem
**Attest**
Control owners complete monthly control self-assessments supported by retained evidence.
:::

:::WorkflowBlockItem
**Verify**
Second-line reviews sample attestations quarterly, while Internal Audit performs risk-based assurance reviews.
:::

:::WorkflowBlockItem
**Improve**
Control failures, incidents and near-misses are routed into the continuous improvement pipeline for remediation and optimisation.
:::
::::

## 🛡️ Design rules

:::hint{type="info"}
**ℹ️ Control design requirement**

Every control must define **one accountable owner, an operating frequency and an evidence artefact**. Controls missing any of these elements must not enter the control register.
:::

- Preventive beats detective where the process allows it.
- Controls are written into the SOP step where they operate, with their register ID (for example CTRL-D-03), so procedure and register never drift apart.

:::ExpandableHeading
## 🔎 Governance implementation guidance

- Reference control IDs directly within SOP activities and operational procedures.
- Retain evidence in auditable repositories aligned to records retention requirements.
- Prioritise preventive controls where process architecture allows automation or hard-stop enforcement.
- Review control effectiveness through recurring governance forums and operational metrics.
:::

## 🧩 Three lines summary

| Line   | Who                      | Role here                       |
| ------ | ------------------------ | ------------------------------- |
| First  | Process teams and owners | Operate and attest controls     |
| Second | Risk and Compliance      | Frameworks, sampling, challenge |
| Third  | Internal audit           | Independent assurance           |