Control room
Every control that is supposed to be running, and whether it is.
Approval rules, segregation of duties, limits, matching tolerances and freeze state. A control that has been switched off is invisible until something goes through it.
This page makes the control set visible as a set, which is the only way to notice a gap.
Where everything sits
How to work this page
The most dangerous state is a control disabled during an incident and never restored.
Whether the same person can create and approve. In a small team it may be unavoidable, and knowing that is better than assuming otherwise.
Every bypass, who made it and why. A pattern of overrides means the control is wrong.
Attempt something that should be stopped. A control nobody has tested is a belief.
On a phone
Every figure from the desktop appears here, stacked rather than reduced. Tables scroll inside themselves so the page never moves sideways, and figures keep their separators and their alignment at every width.
Questions people actually ask
Compensating controls: after-the-fact review, notification of every payment above a threshold to somebody who did not make it, and a genuine reconciliation. State the compensation rather than pretending the gap is not there.
An administrator, with a record. Changes are reported because a quietly weakened control is worse than no control.