For directors & audit committees

The pack says
the controls are fine.
What would tell you
if they weren’t?

A board discharges a personal obligation using a document it has no way to interrogate. Not because anyone is hiding anything — because there has never been a question available that the pack could not absorb. Here are seven.

§ 01

Seven questions, and what a real answer sounds like.

Coverage

When was this control last tested, and by whom? A real answer names a date and a person in the room. An assembled one arrives next week, after somebody has been asked to find out.

Falsifiability

Could that check have come out differently? If nobody can describe the case in which it would have failed, the check has not been shown to work. A test that can only pass is not a test.

Separation

Who closed this finding, and were they the person who fixed it? Separation of duties is usually asserted by the organisation chart. The question is whether the system that recorded the closure enforced it.

Provenance

If the regulator asked today, would we produce this from the system, or assemble it? Assembled evidence is not dishonest. It is late, expensive, and cannot be re-derived if anyone disputes it a year from now.

The silence

What is on this page because we examined it — and what is here because nobody reported a problem? An absence of findings and an absence of looking arrive on the page looking identical.

Recurrence

Has this failed before, and what is different this time? A finding closed twice on the same evidence has not been closed twice. It has been closed once and re-labelled.

Dependence

If our supplier stopped trading tomorrow, would last year's evidence still verify? Retention obligations run to five, seven, sometimes ten years. Very few vendors answer this one plainly.

§ 02

Why these are rarely asked.

An absence of findings and an absence of looking arrive at the board in the same colour.

Not evasion. Most compliance platforms have only two states to report — satisfied and not satisfied — so a check that could not be completed has nowhere to go but into the first one. The pack is accurate about what it was given. It is silent about what it could not establish, because it has no way to say so.

That silence is the thing a board is entitled to interrogate. None of the questions above require technical knowledge to ask. They require only that somebody in the room asks them once. For what it takes to answer the fifth one from a system rather than from memory, see what can be said about a control nobody has examined.

Conventional platforms report two states; WeaveSynth reports three, and the third one holds the gate. — FIG. J — Reporting states, conventional platforms against this one.

§ 03

Our interest in this, stated plainly.

We build software in this area, so we have an obvious interest in these questions being asked. That is a reason to read this page sceptically — and the reason we have kept it to questions rather than answers. Every question above is one a board should ask of whatever it already owns, and most institutions will find that some of them are answered well today. If you want to see how we answer them, the signed record on the home page can be verified in your own browser in about five seconds. Nothing on this page is a claim about your institution.

§ 04 · Begin

Ask us the same seven.

Conversations with directors and audit committees are run by the founders, and are not a sales call unless you want one.

Thirty minutes · no SDR layer · no qualification gauntlet

Book a diligence call [email protected]