How do you evidence that a control is actually operating?
Hold the control against the process it governs, in the same model. The evidence usually exists but is scattered, so assembling it is manual every single time. When controls, owners and approvals live with the work, an audit becomes a query rather than a reconstruction.
The work we would model first
Examples, not a fixed list. Bring the process you already argue about and we will start there.
- Control mapping across the processes each control applies to
- AI systems, their owners and the approvals behind them
- Audit and assurance preparation
- Incident and breach response paths
What risk and compliance gets out of it
- Controls connected to the processes they govern
- Owners and approvals on the record rather than in memory
- Audit preparation as a query instead of a scramble
- AI use governed in the same place as the work it changes
Background reading
What does CPS 230 require you to document about your critical operations?
Written for risk, operations and compliance leaders in APRA-regulated entities, and the people they will ask to do the mapping.
Read thisWhat must an Australian business disclose about its automated decisions?
Written for privacy, risk and compliance leaders in Australian organisations, and the operations people they will ask.
Read this
Bring one process you already argue about.
We will run it through Omni with you on your own material. You keep the model either way.