Module 4

Mapping obligations to controls: coverage, gaps and single points of failure

An obligation that nobody has linked to a control is a hope. Linking is the step that turns a list of duties into a plan of action, and it is where the map begins to answer the questions that matter: which duties have nothing behind them, which depend on one fragile process and which controls are doing more work than anyone has noticed. The links form a many-to-many structure. A serious duty may deserve several controls. A single control, such as a training programme or an access-review process, may help with many duties. Neither pattern is wrong, but each carries a risk that the map should show. This module teaches how to classify controls, write a control statement that someone could test, tell the difference between a control that has been planned, designed or tested, and read the map for gaps, paper cover, single points of failure, orphan controls and overloaded ones. It also explains why a coverage percentage can deceive. The Control Mapper lets you link invented obligations to invented controls and read the result.

General education on regulatory mapping and compliance analytics, using invented regulations, regulators, companies and figures. It states common practice in simplified form and does not describe any one country's law, which differs and changes; rules on scope, interpretation, reporting, record keeping, monitoring of staff and penalties in particular vary. It is not legal or compliance advice, and it does not replace advice from a qualified lawyer on a real regulatory question.