Free tool · Regulatory Compliance
How to Map Regulatory Obligations to Controls: A Control Mapper
Mapping obligations to controls links each duty to the process, system or rule that makes it happen. A control is a preventive, detective, corrective or directive measure with an owner and a record that shows it ran. The status of a control matters: planned controls do not count as cover, designed controls give only cover on paper until someone independent has tested them, and tested controls give real cover. Reading the map shows gaps (an obligation with no control), paper cover, single points of failure (one tested control), good cover (more than one) and orphan controls that serve no obligation. A control that carries many obligations is a concentration risk, and several controls that run on the same system may fail together. A coverage percentage can mislead unless you say what is counted. A link says what a control is meant to do; only testing shows whether it does.
Tool · Control Mapper
| Obligation | Severity | Safety officer role in the governance policy | Notice-handling workflow with a response timer | Age flag blocks the ad-targeting audience builder | Incident response plan with a regulator-reporting step | Quarterly governance reporting calendar | Staff privacy training |
|---|---|---|---|---|---|---|---|
4 of 6 obligations (67%) have at least one tested control; 1 have none and 1 have paper cover only.
Keep records of notices and decisions (medium)
Gap: no control
No control is linked. This is a gap.
Remove illegal content without undue delay after a notice (high)
Paper cover only
Only designed or planned controls are linked, so cover exists on paper and has not been shown to work.
Report a serious incident to the Authority within 72 hours (high)
One tested control
One tested control. If it fails there is no second line; consider whether the severity justifies a back-up.
Appoint a safety officer within 60 days of registration (medium)
One tested control
One tested control. If it fails there is no second line; consider whether the severity justifies a back-up.
Report to the board on safety at least once a year (low)
One tested control
One tested control. If it fails there is no second line; consider whether the severity justifies a back-up.
Do not use children’s data for targeted advertising (high)
Covered more than once
More than one tested control: the duty is covered by more than one line.
- 1 high-severity obligation has no tested control. Start there.
- 1 high-severity obligation depends on a single tested control.
- A link means that the control is meant to meet the duty. Whether it does is a question for testing, not for the map.
List the obligations you have taken from a regulation, rate each by severity, list the controls your organisation operates and say whether each has been tested, only designed or is still planned. Tick which control is meant to meet which obligation. The map shows gaps (no control), paper cover (only untested controls), single points of failure, controls that serve no obligation and controls that carry too many. A link says what a control is meant to do; testing tells you whether it does. Invented data. Runs in your browser; nothing is stored or sent.
How to use it
- List the obligations and rate each by severity.
- List the controls and say whether each is planned, designed or tested.
- Tick which control is meant to meet which obligation.
- Read the order of the obligations, the cover class for each and the notes on orphans and overloaded controls.
Common questions
What is paper cover?
A situation where an obligation is linked only to controls that are planned or designed, and none has been tested. It exists on paper and has not been shown to work.
Why is a single control a risk?
If it fails, nothing else meets the duty. For a serious obligation, consider a second line of defence that does not depend on the same system.
Does a link prove that a duty is met?
No. It shows that the control is intended to meet the duty. Testing, with evidence, shows whether it does.
Learn the law behind the tool
This tool is part of our Regulatory Compliance course, with lectures, concept maps, flashcards, interactive exercises and a capstone case. Regulatory Mapping and Compliance Analytics: Mapping Obligations to Controls.
More free law tools
General information, simplified, mainly on American law, not legal advice. States and countries differ, and real cases turn on facts that a tool cannot capture.