CONTROL ENVIRONMENTS
A control is only real if it works when nobody is checking.
The situation
Controls are often designed for the audit that will examine them rather than for the failure they exist to prevent.
They are performed by people who did not design them, evidenced retrospectively, and assured against a description rather than a reality. The organisation then holds a large set of controls and a small amount of confidence.
The question
Which of our controls would we rely on if the consequence were serious?
The work
We start from the exposures that matter and ask which controls genuinely reduce them, then retire or simplify the ones that only produce evidence.
Design is made explicit: what the control prevents or detects, who performs it, how often, and what constitutes failure. Evidence is designed to be a by-product of the work rather than an additional task.
Assurance is then arranged proportionally, with the second line testing what matters instead of sampling everything equally.
The outcome
A smaller, better-owned control environment that leadership can rely on and explain, with evidence that appears as a consequence of doing the work.