Designing Your Controls – A Framework for Success

Read time: 4 minutes

You’ve identified your risks. You understand the difference between mitigation and controls. Now comes the challenge that trips up most new compliance programs: How do you organize hundreds of controls so people can actually find and use them?

According to the 2023 White & Case/KPMG Global Compliance Risk Benchmarking Survey, 79% of organizations conduct documented risk assessments. Yet many struggle to translate those assessments into actionable, accessible control frameworks.

A well-designed controls framework is your program’s operational backbone. Done right, it enables compliance teams to quickly identify relevant controls, understand implementation requirements, and measure effectiveness. Done wrong, it becomes a dusty document nobody references.

Why Architecture Matters

Think about the last time you tried to find something in a poorly organized system. Frustrating, right? Now imagine that frustration when you’re trying to respond to an audit finding or regulatory inquiry.

The impact of poor organization:

• Compliance teams waste time searching for relevant controls
• Risk owners implement inconsistent solutions
• Auditors question your program’s maturity
• Controls get duplicated or forgotten

Value Driver Spotlight: By customizing your framework to align with your risk assessments, you ensure data integrity and consistency across your program. This is the foundation for demonstrating audit readiness.

Organizing by Risk Category

Your primary structure should align with major risk categories that correspond to your organization’s risk assessment framework. For healthcare organizations, this typically includes:

Regulatory Compliance Controls

• False Claims Act and billing compliance
• Stark Law and physician relationships
• Anti-Kickback Statute and vendor relationships
• HIPAA privacy and security
• State licensing and credentialing

Operational Risk Controls

• Medical staff credentialing
• Quality assurance and patient safety
• Vendor and business partner management
• Technology and data security
• Training and education

Financial Risk Controls

• Revenue cycle compliance monitoring
• Expense and procurement oversight
• Financial relationship disclosures
• Contract compliance
• Insurance and liability coverage

This categorical approach enables compliance professionals to navigate directly to relevant sections when addressing specific risks—without having to sift through irrelevant material.

Pro tip for small teams: Start with 3-5 major categories. You can always add granularity later. The goal is usability, not perfection.

The Anatomy of an Effective Control Entry

Each control in your framework needs consistent information. Here’s your template:

1. Control Objective (The “Why”)

Clearly state what risk the control addresses. Example: “Prevent employment of sanctioned individuals that could result in False Claims Act liability.”

This immediately orients users to whether the control applies to their situation.

2. Detailed Description (The “What”)

Explain how the control operates, including:

• Specific procedures
• Technologies involved
• Integration points with other systems

Make it detailed enough that someone unfamiliar with the control could implement it based solely on this entry.

3. Implementation Requirements (The “How”)

Outline what’s needed:

• Software platforms
• Staffing requirements
• Budget considerations
• Dependencies on other controls

Value driver Spotlight: Clear implementation requirements help you allocate resources appropriately and plan realistic timelines. This supports audit readiness by demonstrating thoughtful program management.

4. Monitoring Procedures (The “Measure”)

Describe how to verify effectiveness:

• Frequency of monitoring
• Metrics that demonstrate effectiveness
• Processes for addressing failures

Example: “Monthly sanctions screening with 100% coverage target. Track hit rate, time-to-resolution, and any missed screens. Escalate any positive hits to compliance within 24 hours.”

5. Responsibility Assignments (The “Who”)

Clarify who’s accountable for:

• Implementation
• Maintenance
• Monitoring

Clear ownership prevents controls from becoming organizational orphans.

6. Documentation Requirements (The “Proof”)

Specify records needed to demonstrate implementation and effectiveness. This is crucial for healthcare and other organizations in high-risk industries that may need to demonstrate the effectiveness of their compliance programs to regulators more frequently.

Making Your Framework Accessible

According to Gartner research, technology spending in compliance functions is expected to double by 2027, with compliance monitoring solutions experiencing substantial growth as organizations seek to manage increasing regulatory burdens.

But technology is only as good as your architecture. Here’s how to ensure your framework gets used:

Multiple Access Points: Compliance professionals access your GRC platform, operational leaders access the intranet, and medical staff access their portal. Meet users where they are.

Integration with Workflows: Link framework controls directly to policies, training programs, and risk assessments. When developing new policies, reference specific controls that align with your organization’s objectives. When conducting assessments, connect identified risks to relevant framework entries.

Customized Views: Risk owners should see only controls relevant to their role. Don’t overwhelm a department manager with your entire framework—show them the 15-20 controls that are most applicable to their needs.

Value driver: Simplified workflows and customizable views increase participation in risk programs. When risk owners see only relevant information, they engage more readily rather than tuning out noise.

Common Architecture Mistakes

🚩 Mistake 1: Over-complicating the structure
You don’t need 47 sub-categories in year one. Start simple. Add complexity only when it serves clarity.

🚩 Mistake 2: Inconsistent detail levels
Some controls have pages of detail, others have two sentences. Use your template consistently or users won’t trust the framework.

🚩 Mistake 3: Burying controls in narrative prose
Make controls scannable. Use headers, bullets, and white space. Compliance professionals are busy—respect their time.

🚩 Mistake 4: Static organization
Your framework should evolve. Build in regular review cycles and make updates easy. A stale framework is useless.

Getting Started This Week

Action 1: Map Your Risk Categories
List your organization’s 3-7 major risk categories. These become your framework’s top-level structure. Align them with your risk assessment framework for consistency.

Action 2: Create Your Template
Build a standard control entry template with all six elements. Test it on 3-5 existing controls to ensure it captures necessary information without being burdensome.

Action 3: Choose Your Platform
Decide where your framework will live. Options range from SharePoint to specialized GRC software. Consider: Who needs access? How will they search? How will you update it?

Activate Your Compliance Team

The ECI’s 2023 Global Business Ethics Survey found that only 56% of employees perceive a strong ethical culture. One reason? Compliance teams often lack the necessary tools to provide clear and accessible guidance.

A well-architected framework activates your team by:

• Reducing time spent chasing information
• Enabling consistent responses to similar risks
• Providing customizable assessments for cross-functional teams
• Eliminating duplicative work when multiple departments face similar risks

What’s Next

You’ve got your architecture. Now comes the systematic work of building out your framework. In our next blog, we’ll walk through a three-phase approach for identifying, documenting, and prioritizing controls that ensures you build comprehensively without getting overwhelmed.

Risk Assessment

Ethico’s Risk Assessment tool provides an intuitive platform for identifying, evaluating, and prioritizing compliance risks with customizable templates aligned to healthcare regulatory requirements. Our drag-and-drop assessment builder enables compliance teams to easily create and distribute risk assessments, while generating visual heat maps and risk matrices that transform complex data into actionable insights for leadership. Request a demo today to see how our Risk Assessment solution helps you build the foundation for an effective controls framework.

About This Series: Building Risk and Controls Foundations for New Enterprise Risk Programs. Coming next: “Building Your Controls Framework: A Three-Phase Approach.”