Blog · Process drift · Problem 53 of 93
The team found a better way to work. Make the documents catch up.
· 3 min read · By Case Jones
You lead security or engineering at a company that moves fast. Teams change their deploy process or their access requests in a meeting you were not in, and the documented process stays as it was.
What it costs to leave it
An auditor tests what the document says, so a team doing good work a different way can still produce a finding. The reverse also happens, when a new way quietly drops a control nobody meant to remove. And management never gets to ask whether the new way is actually better, because nobody told them it changed.
How to keep documents true when the work keeps changing
Process drift is normal in a growing company. The fix is a regular, low-effort way for the people doing the work to say what changed, and for the owner to decide.
- 1
Ask the people doing the work
Pick one procedure and ask two people who run it to walk through what they actually do. Compare it line by line with the document. The differences are your drift list, and it is usually longer than you expect.
- 2
Make it safe to report a difference
People hide workarounds when they expect to be told off. Thank them for raising it, and let them flag changes without their name if they prefer. A known gap is far easier to deal with than one you find during an audit.
- 3
Judge each change against the control
For each difference, ask what the original step was protecting against. If the new way still covers that risk, it may simply be better. If it drops a review, an approval or a separation of duties, it needs a closer look before anyone adopts it.
- 4
Decide, and do it quickly
The document's owner has three choices. Adopt the new way and update the document, push back and explain why the old way stays, or run a trial for a set time. Set a short deadline for the decision, so a report does not sit forever.
- 5
Review on a schedule, and tell management
Review each procedure every quarter and each policy every year, even when nobody has raised anything. Send management a short monthly summary of what changed, what was pushed back and why. That gives them the chance to question a new way before it spreads.
Example
A sample change report and decision
Report: we no longer get a second engineer to approve hotfixes after 6 pm, because nobody is online. Control at risk: changes are reviewed by someone other than the author. Decision: trial for 30 days. Hotfixes after hours are reviewed the next morning and the review is recorded. Owner reviews the trial results at the end.
Or let the people doing the work tell you
At every step and every document in 93 Compliance, people can say we do this differently, we don't do this any more, or a step is missing, with their name or without it. The AI helps them write it clearly and asks about any control the change would weaken.
The document's owner then adopts it, with the AI drafting the change as a tracked suggestion, pushes back, or starts a trial. If nobody decides within 7 days, it escalates. The AI compares the old and new way against the controls, scheduled reviews come with an AI brief, and management gets a monthly digest. When a policy changes, its procedures are checked and flagged as change in progress, and every version is kept.
- A "we do this differently" report on every step and document
- Adopt, push back or trial, decided within 7 days
- Old and new ways compared against the controls
- Scheduled reviews with an AI brief
- A monthly digest for management
Start free
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Is it an audit finding if we follow a better process than the one documented?
It can be. Auditors test whether you do what your documents say, so a difference may be written up even if the new way is sound. Updating the document before the audit period, with an approval, avoids that.
How often should procedures be reviewed?
Quarterly for procedures and yearly for policies is a common rhythm. Review sooner when the team, tools or risks change.
Who decides whether a new way of working is allowed?
The owner of the document, with management able to step in. The owner should look at what the original control protected against before agreeing.
How do I stop people hiding workarounds?
Make reporting easy, let people report without their name if they want, and answer every report with a decision. Never use one to blame someone. People report more once they see changes get adopted.