Controls are policies, procedures, practices, or mechanisms implemented to manage or mitigate risks and ensure adherence to standards, laws, regulations, and internal policies. They act as safeguards to reduce potential threats to an organization, ensuring compliance with relevant standards and reducing the likelihood of adverse events.
Controls Lifecycle
The Controls Lifecycle in COMPASS transforms regulatory requirements into continuously monitored compliance activities. Controls are derived from authoritative standards, enriched with organizational context through the Environment Manager, validated by GRC experts, and translated into actionable compliance tasks. Once implemented, COMPASS continuously evaluates every control to provide an accurate, real-time view of the organization's compliance posture.
Key stages include:
-
Derive controls from applicable standards and regulatory frameworks.
-
Maintain traceability by linking every control to its original source.
-
Contextualize controls using the organization's business and technology environment captured in the Environment Manager.
-
Validate AI-generated controls through expert GRC review and determine their applicability.
-
Generate and publish organization-specific compliance tasks for applicable controls.
Implement, execute, and continuously monitor controls to maintain an up-to-date compliance status.
