Staying compliant after the assessment

Certification is a state, not an event

A certificate has a validity period and requires affirmation in between. More importantly, the thing it certifies is that controls were operating, and controls stop operating quietly.

The supplier who treats the assessment as the finish line is the one whose re-assessment finds a dozen things that were true two years ago.

Four ways it rots

People leave. The person who ran the monthly review moves on and the review stops, with no event marking it.

Systems change. An upgrade resets a configuration, a new tool arrives outside the process, a supplier is replaced.

The boundary drifts. A new machine, a new file share, a project that needed somewhere quick to put something.

Records stop being kept. The control still operates and nobody is recording that it does, which for an assessment is the same as it not operating.

What keeping it actually requires

A recurring block, in one person's calendar, spent collecting the month's evidence into the place it lives and checking that the reviews which were supposed to happen did.

An hour for a small supplier, half a day for a larger one. It is the cheapest insurance in this whole subject and it is the first thing to disappear when the person is busy, which is why it belongs in objectives rather than in intentions.

One question added to an existing process

Whatever you already do before a change goes ahead, add: does this touch the boundary, and if so who has checked. It costs a line on a form and it catches the drift described above at the point it happens rather than eighteen months later.

New machines, new suppliers with access, new file shares and staff changes are the four that matter most.

Four things to look for annually

The evidence folder was last added to in the spring. Nobody can say where the current system security plan is. The person named as owner has changed jobs and nobody was named instead. And the answer to "how does this control work" has become "I think we have a tool for that".

Any one of them found a year before re-assessment is a scheduling problem. All four found a month before is not.

Start twelve months out

Not because it takes twelve months, but because assessor availability is the constraint, and because a gap found early is remediated in ordinary time rather than in a rush.

Run an internal check against the standard at the halfway point of the validity period. It costs a fortnight and it converts the re-assessment from an event into a formality.

The useful analogy

Every shortcut taken to hit the first assessment is a debt: the manual control nobody automated, the procedure written for the assessor rather than for the work, the exception granted for one machine.

Each is fine individually and they accumulate interest, which is paid at re-assessment. Keeping a list of them, with a note of what proper looks like, turns an unpleasant surprise into a backlog.

A small task with a real consequence

Where affirmation is required between assessments, it is a short administrative act attesting that the controls remain in place. Affirming without having checked converts an administrative task into a statement whose accuracy matters.

Do the internal check first, then affirm. In that order it is routine.

What to hand over when the owner changes

Where the evidence lives. The plan and its version history. The decisions register with reasons. Open items and their history. The assessor's last findings. And the contacts: assessor, vendors, sponsor.

Assembled during the role rather than during the notice period, this is a morning. Assembled afterwards it is a quarter, which the entry on slippage counts among the five causes.

Put the recurring dates in a shared calendar

Affirmation, internal check, evidence review, assessor booking window, certificate expiry. In a shared calendar with a named owner and a reminder at a useful interval.

Every one of these has been missed by a competent person who intended to do it.

Elsewhere in running the programme

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.