Where Controls Fit In

A control fits inside a process. It does not sit in front of one. A control objective says what has to be true. The control is the activity that makes it true. It has a trigger, an owner, inputs and a work product. Assurance is the sample of that work. A control that has none of these is a statement that something was considered.

The tick

A tick treats the control as a line that has been marked. There is no trigger, no owner, no input and no record that shows the control ran against a named system. The same mark can sit on every system in the estate. A tick is a useful reminder. It is not a control. It cannot be sampled. An assessor who asks what happened the last time the control was supposed to fire has nothing to look at except the mark.

This is the difference IT Governance draws between a document pack and a quality management system, and between a checklist library and a working management system. A file that describes design control, validation, data management, change control and post-market monitoring, written after the system was built and without those processes having run, fails the consistency test an assessor applies. Where the organisation is in scope of the EU AI Act, that is the test in Annex VI. A tick against a line is that file in miniature. The same test applies under ISO/IEC 42001: an assessor samples a working system, not a completed checklist.

Order of work

Set the control objectives first. Apply the intended-purpose, state-of-the-art and proportionality lens before controls are chosen. Determine the operating, supervisory, administrative and fiduciary controls. Prefer design-time prevention. Embed those controls in running processes. Then map scope. That is the Statement of Applicability. Then choose the assessment type from the environment that actually exists.

A Statement of Applicability is a scope artefact. It records which determined controls apply to which use, and which do not. It is not the system of internal control, and it is not an assessment of that system. Writing a SoA before the controls exist is how the map becomes the territory in the file and nowhere else. Accepting a SoA as proof that controls exist is the same mistake from the other side.

What a control looks like when it is in a process

In an ISO/IEC 42001 SI management system, a control sits inside a process that has an owner, a trigger and a work product. The control objective says what has to be true. The process runs the work that makes it true. The record is produced as the work is done. That is a control. It can be sampled. ISO/IEC 42001 is the international standard and travels with the organisation. The same pattern holds wherever the organisation chooses to apply it.

In a quality management system under EN 18286, where the organisation places systems on the Union market, a life-cycle stage has a gate. The gate checks that the stage's records exist, that verification and validation are done, and that the right roles have signed off before the work moves on. Separation of duties is built in. Whoever prepares a record cannot approve it. That is a control. It has a trigger, the stage being ready to close. It has an owner. It has a work product, the signed record. It can be sampled.

In a DORA or NIS2 incident process, where the organisation is in scope of those instruments, the control is the clock and the sequence. Awareness time is recorded. Deadlines run from it. A skipped stage is refused or flagged. The approved record is locked. That is a control. A field that says "incident reporting: complete" is not.

In AICOB, every material outcome has a governing-body role and a management owner. The control serves a control objective. The measure says how the organisation knows. Assurance samples the work product. Depth follows the system. The objectives stay the same. The practices scale.

Controls and the platforms

The IT Governance platforms embed controls in the process rather than offering them as a library to be ticked. The product name changes with the topic. The method does not. An SI management system under ISO/IEC 42001, a quality management system under EN 18286, an impact assessment, a governance workbench, or a CRA, DORA, NIS2 or DPO record: each is a set of processes in which controls are assigned, run and evidenced. ISO/IEC 42001 is the international standard and travels with the organisation. The EU systems are used where the organisation is in scope of those instruments. The fields on a page are the questions the organisation has to answer to operate that process. The people who own the duty fill them. The system keeps the record.

The platforms are available stand-alone, and on Nextcloud. Nextcloud is an open-source collaboration platform an organisation can host itself or have hosted. It adds file storage, user and group management, and federation, so a selected record can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. Federation does not create the control. It keeps the record of the control with the work, and lets that record cross an organisational boundary under controlled conditions.