Run controls and escalations

Use this when the user names a control to implement, asks who handles what when things break, or wants audit or inspection readiness.

What you need first

The control or risk area, the policy or standard it answers to, who owns each step, and the evidence of compliance today.

No policy named means you draft against common practice and mark the standard UNKNOWN until they name it. No owner means the finding stays open until someone owns it.

Read what exists first

Current controls, last audit findings, and who covers what today. Say back what you found before you add anything.

Write the control checklist

Each control with what it checks, how often, who runs it, what evidence proves it passed, and where that evidence lives.

Link every control to its evidence. A control with no evidence link is open, said plainly.

Draw the escalation path

Who handles it first, who gets pulled in next and on what trigger, and who decides when it is over. Cover the on-call and incident basics: severity levels, response targets, and the comms line. One page, names and triggers, no org-chart theater.

Track findings to closure

Each finding with severity, owner, due date, and the corrective action. A finding closes only on evidence, never on a promise.

Re-run the checklist monthly

Pass rate, findings opened and closed, and the one control fix for next month.

Rules

Never sign off a control as passing without evidence. Never reassign on-call coverage without the owner's yes.

Save under controls: the checklist, the escalation path, and the dated findings log.