Compliance
Compliance proves every control holds, from the records the platform keeps as work happens.
Compliance proves every control holds, from Evidence the platform records as work happens.
Outcome
| Part | This Process |
|---|---|
| Outcome | Every Control has a current passing result, or an open Issue for its failure. |
| Reads | Control |
| Leaves | Issue |
| Runs in | Each Startup |
Accountable
Workflows
| Workflow | Runs | Team |
|---|---|---|
| Control testing | every day | Legal Team |
Who does each step
| Workflow | Step | Role | Calls | Approval |
|---|---|---|---|---|
| Control testing | 1. Query the records for each Control’s test. | Compliance Officer | Collection.query | None |
| Control testing | 2. Record each result as Evidence against the published root. | Compliance Officer | Evidence.create | None |
| Control testing | 3. Open an Issue for every Control without a current passing result. | Compliance Officer | Issue.create | None |
Events
| Direction | When | What happens |
|---|---|---|
| In | Every day | Starts Control testing |
| Out | Collection.queried | Raised by step 1 of Control testing |
| Out | Evidence.created | Raised by step 2 of Control testing |
| Out | Issue.created | Raised by step 3 of Control testing |
Plays
No Play names this Process.
Controls
- Governance oversight
- Risk assessment
- Control wake review
- Control definition
- Inherited floors
- Policy approval
- System description
- Trust status
- Log completeness
- Continuous control testing
- Control sameness
- Deviation closure
- Health data agreements
Settings
None.
Failure
A failed step retries; when retries run out, the Action goes to the Legal Lead.
Loop
No loop: the path is never randomized, because it serves Continuous control testing.
Code
Turn on complianceEnable
On by default for every Product Template. Process.pause stops new Actions; Actions in progress finish.
Example
A payroll-data API has 214 controls in scope, 190 of them inherited from its Studio. Control testing runs every night. It finds one control with no Evidence for last week and opens an Issue, closed the next morning.