“How we really do it” reports
When the written way and the real way drift apart, anyone can say so, and the document’s owner decides.
Written procedures drift from real work. 93 Compliance lets the people doing the work report it, instead of waiting for an audit to find it:
- On a checklist step: We do this differently, We don’t do this step any more, or A step is missing after this.
- On a policy: This isn’t how we work.
- Anywhere: Tell us about a change.
Send without my name shows the owner only your role. Others can add Same here.
Screens show Fernhollow Health, a made-up company we use for demos.
The document’s owner opens the report, sees the written way beside the real one, and can run Compare the two ways, an AI check against the document’s controls. Then they decide: Adopt (the new wording becomes a tracked change), Push back (with a reason everyone in the role sees), Trial until a date, or mark it a Duplicate.
Procedures come up for review every 3 months and policies every 12. Each review gathers the reports since the last one into a brief, and is closed by the owner.
Related
More in Concepts
- Policies, drafts and versions
- Requirements and frameworks
- Risk tests
- Controls and the control matrix
- Procedures, runs, steps and evidence
- Training: listening, acknowledging, study games
- Vendors and systems
- Customer security questionnaires
- Discovery: your website and how you work
- “How we really do it” reports