Procedures, runs, steps and evidence
A procedure starts on an event, hands steps to roles, checks them, and keeps the proof.
A procedure is the template (for example, employee offboarding). A run is one time it happens (offboarding Ryan), with its own checklist and record.
How a run starts
- A Start button
- Another system, through an API key or webhook
- The assistant
- A schedule, such as “quarterly, first Monday 09:00”
Who does each step
Steps go to roles. A step can go to anyone in the role, to one, in turn, or to whoever has least. Each step can have a Due within time; late steps go to the role’s leads or the manager, then to administrators.
Evidence
A step can ask for a photo, a file or screenshot, an answer, a confirmation, a timestamp, a location or a sign-off. Every file is fingerprinted (SHA-256), so anyone can later confirm it wasn’t changed.
An offboarding run: done steps, a step waiting for the manager with its handover list, and a Check step that’s overdue.
When something goes wrong
Flag a problem marks the run as having a problem to settle. An administrator settles it with Fixed: do this step again or Accept as an exception; both are recorded.
- 1Procedures that can be started
- 2Start a run by hand (runs can also start on a schedule, from another system, or from the assistant)
- 3Steps: who does what, which steps are checks, what evidence they need
Screens show Fernhollow Health, a made-up company we use for demos.
Related
More in Concepts
- Policies, drafts and versions
- Requirements and frameworks
- Risk tests
- Controls and the control matrix
- Procedures, runs, steps and evidence
- Training: listening, acknowledging, study games
- Vendors and systems
- Customer security questionnaires
- Discovery: your website and how you work
- “How we really do it” reports