Writing down how things work.
WHY IT MATTERS
Controls that exist only in practice disappear when people change.
WHAT TO DOCUMENT
The process, step by step Who performs each step What is checked Who approves what What records are produced What happens with exceptions
WHY WHO PERFORMS EACH STEP
It is what makes separation of duties visible and verifiable.
WHAT TO KEEP SHORT
The documentation.
WHY
Long process documents are not read or maintained.
WHAT TO PRODUCE
A description someone could follow.
WHAT TO ESTABLISH
That documented processes match what actually happens.
HOW TO VERIFY
Follow a transaction through, from start to finish.
WHY THAT TEST
It reveals every step that is skipped or done differently.
WHAT THAT USUALLY FINDS
Approvals given after the event Checks not performed Steps performed by the wrong person Workarounds nobody documented
WHAT TO DO
Either fix the practice or correct the documentation.
WHY BOTH ARE VALID
Sometimes the documented process is impractical.
WHAT TO UPDATE
Documentation whenever the process changes.
WHY AS PART OF THE CHANGE
It is otherwise never done.
WHAT TO ESTABLISH
An owner for each documented process.
WHAT TO REVIEW
Documentation periodically, and after any incident.
WHAT TO RECORD
When it was last reviewed.
WHY
It tells the reader how much to trust it.
