Reimagining controls. Engineering trust.

A control can pass its test while the service it is meant to protect still fails. The result may be accurate. The conclusion we draw from it may be too broad.

That is the challenge behind Reimagining Controls: how do we move from confidence in individual activities to justified confidence in the way a business operates? After 30+ years solving problems across consulting, operations, assurance, transformation and founding businesses, I believe this is one of the most useful questions leaders can ask.

Start with the outcome we need to protect

Organisations can accumulate checks, reconciliations, approvals and evidence requests over many years. Each may have had a reason to exist. Together, they can become an expensive operating model whose relationship to the original risk is difficult to explain.

A better starting point is the outcome. What must happen for the customer, the business or the wider system? What could prevent it? Where does that risk enter the process, and what would effective prevention or detection look like?

Consider customer due diligence as an illustrative example. The outcome is appropriate due diligence at the right time, supported by accurate information and accountable decisions. An overdue-review report can help detect a problem. Improving that report alone does not resolve poor data, unclear ownership or a process that creates the backlog.

Distinguish the work from the control

A process step, a control, a monitoring measure and a piece of evidence serve different purposes. Treating them as interchangeable makes redesign harder.

• The process delivers the service or outcome.
• The control changes the likelihood or consequence of an identified risk, through prevention, detection or correction.
• Monitoring helps people understand performance, exceptions and change.
• Evidence supports an assessment of what happened and whether the response was appropriate.

Before automating an activity, establish which role it performs. Sometimes the strongest improvement is to remove the failure-prone step, simplify the process or retire a check that no longer addresses a meaningful risk.

Design risk, controls and assurance together

Risk architecture explains the outcomes, exposures and dependencies. Control architecture explains how those risks are addressed in the work. Assurance architecture explains what evidence is needed to assess whether the arrangement remains effective.

These disciplines need a shared view of the service: people, processes, data, technology and third parties. A series of successful component tests cannot establish end-to-end resilience if nobody has examined the assumptions and dependencies between the components.

Testing therefore remains essential. Its scope should reflect the question being asked. A test of operating effectiveness answers a different question from a realistic service scenario, a data-quality assessment or a review of whether the control still addresses the risk.

Connect signals to accountable action

An effective environment should sense relevant changes, identify exceptions, provide context, trigger workflow, support decisions and capture the resulting evidence. Detection creates value when it leads to a timely and appropriate response.

That requires decisions about ownership, escalation and closure. Who assesses the exception? What authority do they have? What happens if it is unresolved? What evidence demonstrates that remediation addressed the cause?

Automation can make that response more consistent. AI may help interpret information or prioritise attention. Both need dependable inputs, clear boundaries and human accountability proportionate to the decision. Faster processing of a poorly designed control can simply scale the original weakness.

Move from control monitoring to risk intelligence

Knowing that a check ran is useful. Knowing whether the risk is changing, whether the control is still appropriate and whether its effectiveness is deteriorating is more useful to a leader making decisions.

This means combining control results with operational performance, incidents, near misses, data quality and changes in the business. It also means challenging apparent success: are exceptions falling because the process improved, or because a feed stopped working?

The ambition is assurance that is available when decisions need it, supported by periodic independent challenge. Continuous signals do not make every assurance conclusion continuous, nor remove uncertainty. They can make the basis for confidence more current and more transparent.

Make improvement part of the operating model

The work begins with understanding the outcome and the risks that could undermine it. That understanding shapes the design. Controls then need to be embedded in the process, with the people, data and ownership needed to operate them reliably.

Once the process is running, the organisation needs to sense what is changing and assure itself that the controls still work. It must then adapt the design in response to what the evidence reveals. Those stages continue for as long as the service operates; learning has to change the work.

Measure the outcomes that matter: recurring failures, time to detect and resolve meaningful exceptions, exposure outside appetite, quality of evidence and effort spent on avoidable work. A high test pass rate is one signal within that picture.

Engineer trust through continuous assurance

Leaders can begin by asking a direct question: what would we need to know, today, to have justified confidence that this service will deliver its intended outcome?

Choose a service that matters to customers or the business. Bring its operational, risk, technology and assurance owners together to map the outcome, the material risks and the dependencies. Identify where the existing evidence supports confidence, where it is too old or incomplete, and where nobody owns the response.

Use that assessment to design continuous assurance into the service: reliable signals from operations, clear thresholds for attention, accountable decisions and evidence that corrective action addressed the cause. Combine those signals with targeted testing and independent challenge. The approach must reveal weaknesses in prevention as well as failures that have already occurred.

The practical output is an assurance design for the service: which risks and outcomes need to be assessed, what evidence is needed, how current it must be, who acts when confidence weakens, and how the response feeds back into the design. Start with the most important gap, establish whether the change works and extend the approach as the evidence supports it.

Engineering trust means making that discipline part of everyday management. Continuous assurance gives leaders a more current basis for action; it does not remove uncertainty or replace judgment. Its value is in connecting what the organisation promises with what it does, what it can demonstrate and what it changes when the evidence falls short.