Compliance: Templates
Four working templates: the obligation-to-control map, the control record, the gap register entry and the quarterly attestation.
Markdown. No sign-up, no email.
1. Obligation to control map#
The foundation. Reviewed quarterly.
| Obligation | Source | Applies because | Control | Control owner | Evidence | Gap? |
|---|---|---|---|---|---|---|
| [Regulation, contract or customer commitment] | [Jurisdiction, activity, data type] | [A name] | [Where it is kept] | ⬜ |
An obligation with no control is not a future risk. It is an uncontrolled obligation today, and it belongs on the gap register the day it is found.
2. Control record#
One per control.
| Field | Entry |
|---|---|
| Control | [What it prevents or detects, in one sentence] |
| Obligations satisfied | [Which. Often more than one] |
| Owner | [A name] |
| How it operates | [Automatic, or manual with a person and a frequency] |
| How it is evidenced | [Captured as work happens, or reconstructed. If reconstructed, say so] |
| Frequency | |
| Current state | [Operating / Failing / Unevidenced. Three states, never two] |
| Last evidenced | |
| Depends on one person? | [If yes, that is a finding of its own] |
3. Gap register entry#
| Field | Entry |
|---|---|
| Gap | [The obligation, and what is missing] |
| Found on | |
| Found by | [Monitoring / audit / self-identified] |
| Risk if exploited or examined | |
| Owner | [A name, not a team] |
| Remediation date | [Set when found, not when convenient] |
| Interim control | [What reduces this meanwhile, or explicitly none] |
| If accepted instead | [Accepter, and an expiry date. An acceptance without one is a permanent decision nobody admitted] |
| Escalated | [Anything past 30 days] |
4. Quarterly attestation#
Completed by a person reading evidence. Never generated.
| Control | Evidence reviewed | Operating? | Attested by | Notes |
|---|---|---|---|---|
| [What was actually read, with dates] | [Yes / No / Cannot say] | [A name] |
| Summary | |
|---|---|
| Controls attested operating | |
| Controls failing | |
| Controls I cannot attest to | [The honest row. "Cannot say" is a legitimate answer and a required one] |
| Gaps disclosed to leadership | |
| Attested by | [Name, role, date] |
"Cannot say" must stay easy to write. An attestation process that punishes honesty produces attestations that are worthless and, in some jurisdictions, personally risky for whoever signed them.
Using these together#
The charter sets out what compliance owns, the SOPs say when each is produced, the KPIs define what the gap register feeds, and the workflows name who receives each output. A control record whose state field says "operating" with a blank last-evidenced date is unevidenced, whatever it claims.