Compliance: Workflows
How obligations become controls, controls become evidence, and evidence becomes an attestation, plus the handoffs with Legal, Security, Engineering and Audit.
Markdown. No sign-up, no email.
Compliance is a translation function. Obligations arrive as prose written by lawmakers and have to leave as things a system does and records.
What arrives#
| From | What | Becomes |
|---|---|---|
| Legal | Obligations that apply to us | Controls, or gaps |
| Security | Control state, incidents | Evidence, and sometimes findings |
| Engineering and DevOps | Change and access records | Evidence, collected as work happens |
| HR | Training, joiners and leavers | Access and awareness evidence |
| Customers | Security questionnaires and DPAs | Commitments that become obligations of our own |
| Auditors | Findings | Remediation with owners and dates |
Customer commitments are obligations too, and the row most often forgotten. A security questionnaire answered optimistically in a sales cycle is a promise that lands here.
What leaves#
| To | What |
|---|---|
| Every function | The controls they own, and the evidence expected |
| CEO | Gap register, expired acceptances, anything needing a decision |
| Auditors | Evidence, and a disclosed gap list |
| Sales | What we can honestly claim about our posture |
| Legal | Where an obligation cannot be met with a control |
The chain#
The last lane is the one that cannot be automated. Everything before it can.
Handoff contracts#
With Legal. They decide what applies; compliance decides how it is controlled and evidenced. A regulation without a control is escalated jointly, because the answer is sometimes a control and sometimes a decision to exit an activity.
With Security. Overlapping and not identical. Security stops bad things happening; compliance proves the mechanism exists and operated. A company can be secure and unable to demonstrate it, which fails an audit and loses enterprise deals.
With Engineering. Controls are built into how work happens, not added as a review step. A control that depends on someone remembering is a control that fails during a busy week.
With Sales. What we can honestly claim. Answering a security questionnaire optimistically creates an obligation and a future finding at the same moment.
Cadence#
| Continuous | Monitoring and evidence capture |
| Monthly | Gap register, unevidenced controls, expired acceptances |
| Quarterly | Obligation mapping, human attestation |
| Annually | External audit if in scope |
The failure this design is built against#
An organisation that passes its audit and has a control which stopped operating in March. Nobody lied. The control was tested on audit day, evidence was reconstructed for the rest, and the state in between was never actually known.
Continuous monitoring with a separate unevidenced category is the specific answer to that, and keeping attestation in human hands is what stops the monitoring quietly becoming the assertion.