Compliance and assurance
Can we show, with evidence, that our controls operate?
"We have a policy" is an assertion; what an auditor, a regulator, or a court asks for is evidence that the control the policy requires actually operated, on the days it mattered. The exposure is the distance between the two.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
- From policy intent to independent assurance: the journey of a privileged-access controljourney
- How leadership can know, with evidence, whether critical services could continue and recover after a disruptionoutcome map
- How leadership can know, with evidence, whether the controls it relies on are operatingoutcome map
- How leadership can know, with evidence, whether the organization's legal and regulatory obligations are identified and metoutcome map
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- Business Continuity and Disaster Recovery Policypolicy, Resilience
- Compliance, Audit, and CAPA Management Policypolicy, Compliance
- Exception and Risk Acceptance Management Policypolicy, Governance
- Identity and Access Management Policypolicy, Security
- Legal and Regulatory Compliance Policypolicy, Compliance
- Business Continuity and Resilience Frameworkframework, Resilience
- Continuous Assurance and Improvement Frameworkframework, Governance
- Document Architecture and Interrelationship Frameworkframework, Governance
- Business Continuity and Disaster Recovery Standardstandard, Resilience
- Internal Audit Standardstandard, Compliance
- Logging and Monitoring Standardstandard, Security
- Privileged Access Management Standardstandard, Security
- Access Control Procedureprocedure, Security
- Audit Planning Procedureprocedure, Compliance
- Business Impact Analysis Procedureprocedure, Resilience
- Continuity and Recovery Testing Procedureprocedure, Resilience
- Control Testing Procedureprocedure, Compliance
- Corrective and Preventive Action (CAPA) Procedureprocedure, Compliance
- Identity Management Procedureprocedure, Security
- Minimum Viable Governance Structure Guidelineguideline, Governance
- Business Continuity and Crisis Management Planplan, Resilience
- IT Disaster Recovery Planplan, Resilience
- GRC Library Compliance Alignment Matrixmatrix, Compliance
- Assurance Map Registerregister, Risk
- Compliance Obligations Register Templateregister, Compliance
- Digital Trust and Assurance Metrics Registerregister, Governance
- Global Regulatory Applicability Registerregister, Compliance
- Key Risk Indicator Catalogueregister, Risk
- Resilience Metrics and Testing Log Registerregister, Resilience
- Audit Evidence Package Templatetemplate, Compliance
- Board Risk Report Templatetemplate, Risk
- Lessons Learned Templatetemplate, Resilience
- Regulator Interaction Templatestemplate, Compliance
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- AEO/AEO-S
- BASC
- BASC International Norm Implementation Guide V6-2022 (Version 06, effective 2022-03-02)
- Basel Committee Corporate Governance Principles
- Basel Committee Operational Risk Principles
- Canada CCCS Baseline Cyber Security Controls for Small and Medium Organizations V1.2
- Canada TBS Directive on Security Management (federal public sector)
- CIS
- CISA Zero Trust Maturity Model v2.0 (April 2023)
- Cloud Security Alliance (CSA)
- COBIT
- COSO ERM 2017
- CSA CCM
- DORA
- EU AI Act
- FRC UK Corporate Governance Code
- GDPR
- IIA Three Lines Model 2020
- ISACA DTEF (2024)
- ISO 19011:2026
- ISO 22301:2019
- ISO 28000:2022
- ISO 31000
- ISO 37000:2021
- ISO 37301:2021
- ISO 9001:2015
- ISO/IEC 24760 (Parts 1 to 3, 2025)
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27014
- ISO/IEC 27017:2026
- ISO/IEC 27031:2025 (Information and communication technology readiness for business continuity)
- ISO/IEC 27035-2:2023
- ISO/IEC 27036-2:2022
- ISO/IEC 29146:2024
- ISO/IEC 42001
- NIS 2
- NIST
- NIST AI RMF
- NIST CSF
- NIST IR 8011 Vol. 1
- NIST IR 8286C Rev. 1
- NIST IR 8286D-upd1 (Using Business Impact Analysis to Inform Risk Prioritization and Response)
- NIST IR 8374 Rev. 1 (Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile, June 2026)
- NIST SP 800-137A
- NIST SP 800-184 (Guide for Cybersecurity Event Recovery)
- NIST SP 800-207
- NIST SP 800-34r1
- NIST SP 800-37 Rev. 2
- NIST SP 800-53
- NIST SP 800-53A Rev. 5
- NIST SP 800-61 Rev. 3
- NIST SP 800-63A-4
- OECD AI Principles
- OECD G20 Principles of Corporate Governance
- PIPEDA
- Treasury Board Directive on Automated Decision-Making / Voluntary Code of Conduct on Generative AI (AIDA lapsed)
- WCO SAFE
Go deeper