Keep a control inventory organized by risk area

Compliance Monitoring & Testing policy, §2

Every control the program relies on is listed in one inventory, grouped by compliance risk area, so that monitoring and testing can be planned against it and an examiner can see what the Company claims to operate.

Continuous

Maintained as controls change; reviewed with the annual program review

List each control with its risk area, owner, cadence, and evidence. Add, retire, or reclassify controls whenever a product, vendor, or policy changes.

• Control inventory

  Register with one row per control: area, owner, cadence, evidence location

Compliance Officer

Leela can draft the inventory from your policies and keep it in step with them.

Tell Leela about your company to see whether this applies.