About Control Implementation Workflows

Overview

The Default Control Workflow allows users to manage the entire control implementation lifecycle. The workflow has four stages that provide guidance to control owners and approvers on what actions need to be completed in each stage. Users can easily advance to the next stage or revert to a previous stage by clicking the name of the stage in the workflow on the Control Details screen.



The Default Control Workflow will be disabled if the controls are in one of the following statuses:

  • Not Doing

  • Retired

  • Suggested

Once a suggestion is accepted for a control in the Suggested status, the Default Control Workflow will be enabled. Controls in the Not Doing and Retired status must be moved to Pending or Implemented status to enable the Default Control Workflow.

Important:

Controls with the Implemented status will automatically move to the Monitoring stage. If the control status changes from Implemented to Pending, the workflow stage will not change. All controls moved to the Monitoring stage will auto-update to the Implemented status. If the control in the Monitoring stage is moved to a previous stage, the status will be changed to Pending.

Workflow Stages

Pending

In the Pending stage, the newly identified control requires further review by the compliance or risk manager to decide if it is applicable.

  • If the control is applicable, assign a control owner to begin the implementation.

  • If the control is not applicable, the control status should be changed to Not Doing on the Control Details screen.

Implementation

Once a control advances to the Implementation stage, the control owner is actively working on the control implementation. The owner decides which actions are needed to successfully implement the control. Once the implementation is complete, the control owner should provide implementation evidence and submit the control for review.

Review

In the Review stage, the control approver reviews the implementation and either approves or rejects the implementation work. When a control enters this stage, the control approver will receive an email notification.

  • If approved, the control approver moves the control to the next stage.

  • If not approved, the control approver sends it back to the control owner for more information.

Monitoring

During the Monitoring stage, the control implementation is complete. The control will continue to be monitored to ensure it is always working as expected.

Note:

The control status will be automatically updated to Implemented when the control is moved to Monitoring stage.