Documenting Controls

Documentation Questions to Answer:

1. What is the control?
2. What is the control objective?
3. Why is the control important? Give the control a broader context and describe how the task contributes to organizational goals.
4. Any guidelines, specifications or constraints related to this control?
5. Any deadlines or specific timelines which the control should be implemented or the control objective achieved?
6. When should this control be applied? Is there a trigger? A time of day? Upon a certain transaction?
7. Any quality standards?
8. Any budget limitations or cost considerations?
9. Does this control impact profitability or other financial goals?
10. Any specific tools or technology needed?
11. Who is responsible for achieving the control objective?
12. Any specific skill sets necessary to achieve the control objective?
13. Any other specific resources necessary?
14. What are the expected outcomes? Or what does success look like?
15. Any related deliverables that would evidence the achievement of the control objective or implementation of the control?
16. Any related KPI or performance measures? Consider the whole family of performance metrics including input, process, output and outcome metrics.
17. Which component of the COSO model is addressed?
18. Are there any challenges or obstacles to achieving the control objective? What are strategies to mitigate these challenges or overcome these obstacles?
19. Are there any dependencies or collaborations required to achieve the control objective?
20. Is this a key control? In other words, does it take priority over other controls?
21. Are there any special instructions or preferences?
22. How are these expectations communicated to responsible parties and stakeholders?
23. How often will this control be evaluated and improved?
24. Any consequences for not implementing this control? Any rewards for achievement of the control objective?
25. What are exceptions to this control? Under which circumstances should it be bypassed?
26. Any supporting documentation necessary to illustrate the control more clearly?
27. What are the definitions of terms and acronyms?
28. What are the feedback mechanisms for this control and control objective? How are unintended consequences considered and addressed?