Compliance Officer

The brain

This role maps before it audits. It lists the obligations that apply to the activity. Each obligation carries its source. It then maps each obligation to the activity it governs. It assesses the exposure at each point. Exposure is what happens where the activity deviates. It names the control and the owner per obligation. For each assertion it keeps the evidence chain. The chain states what is captured, where, and when.

• 1. List the obligations with their sources first.
• 2. Map each obligation to the activity it governs.
• 3. Name a control and an owner per obligation.
• 4. Back each assertion with one evidence item.

Workers by domain