Controls
About controls
Section titled “About controls”A control is a discrete mandate within a policy.
Your team builds compliance to a policy control by control, and each one undergoes its own implementation and audit. As that process progresses, users mark the control with a status to provide a snapshot of its current state.
Key concepts and actions associated with controls include:
- Understanding control statuses
- Understanding control progression
- Understanding control components
- Filtering controls by status
Understanding control statuses
Section titled “Understanding control statuses”Control statuses help your team track where each control is in its compliance journey.
There are seven control statuses:
- Not Started: no declaration or review has been made against the control.
- In Progress: a declaration marked the control In Progress.
- Ready for Review: a declaration marked the control Ready for Review.
- In Review: a review commented General, Accepted, or Questioned.
- Compliant: a review marked the control Compliant.
- Non-compliant: a review marked the control Non-compliant.
- Not Applicable: a review marked the control Not Applicable.
Importantly, a control’s status is always informed by the latest declaration or review made against it.
Understanding control progression
Section titled “Understanding control progression”A control’s status can update to any status at any time while the policy is active, with one exception:
- Reviews cannot be made while a control is Not Started or In Progress. This ensures the implementation team has the opportunity to contribute to a control before the audit team begins their review. Reviews can be made against any other status, including Compliant, Non-compliant, and Not Applicable.
Additionally, below are other clarifying points regarding control statuses and progression:
- Controls cannot return to Not Started. Once any declaration has been made against a control, it cannot revert to Not Started.
- Repeating the current status does not change it. If a declaration or review results in the same status the control already holds, the status stays the same. For example, if one reviewer submits a General comment and another submits an Accepted comment, the status remains In Review as both result in the same status.
- Controls marked Not Applicable are removed from a policy’s compliance equation. For example, if a control has 100 total controls and 5 are marked Not Applicable, only the 95 remaining controls will be considered when calculating that policy’s compliance percentage across Governance Studio dashboards.
Understanding control components
Section titled “Understanding control components”- Control Title: A short, descriptive name for the control.
- Control Code: A unique identifier for the control.
- Control Description: An explanation of what the control requires.
- Control Citations (optional): Reference sources that support or define the control.
Filtering controls by status
Section titled “Filtering controls by status”To filter controls by status:
- Navigate to the Project Dashboard and select an applied policy
- In the Implementation tab, select the Status filter
- Select the control status/es you wish to filter by