How It Works
Every recommendation has to earn its way into the roadmap.
We start with the control, the evidence, and the operating risk. Software enters the conversation only when it is the best fix.
Why the order matters
A system project should start with the operating requirement, not the product category.
Software-First Project
- Starts with a tool category or platform shortlist.
- Discovery is organized around product capabilities.
- Success is often defined as go-live.
- Ownership can change after implementation.
Illuminate Control-First Project
- Starts with a control failure, workflow gap, or measurable operating problem.
- Assessment is organized around evidence, risk, and the operating requirement.
- Success is the gap closed, the control adopted, and the operating process stable.
- The same operator remains through assessment, implementation, and support.
Assessment Workpaper
§ AP-04.3
Point IDAP-04.3
Control ObjectiveVendor bank-detail changes are independently verified before payment release.
TestReview sampled bank-detail changes and the retained verification evidence.
EvidenceVerification evidence is not retained consistently.
FindingThe control cannot be demonstrated consistently.
RiskPayment diversion / fraud exposure.
RemediationCreate a standardized verification workflow and retain approver evidence before release.
SeverityCritical
StatusOpen
The Sequence
Assess. Diagnose. Decide. Implement. Run.
1
Assess
Observe and evidence how the controls and workflows operate today.
2
Diagnose
Score the findings, surface material gaps, and determine what is driving the problem.
3
Decide
Choose the remediation path: process, configuration, integration, or software.
4
Implement
Configure, test, train, and roll out the validated fix.
5
Run
Administer, monitor, and improve the control as the operating environment changes.
What You Get
Deliverables
Scored control ledgerA point-by-point record of what was tested and how it scored.
Finding registerEvidence, risk, owner, remediation, and status for each material gap.
Remediation roadmapWhat to fix first, what can wait, and what does not require software.
Decision briefThe documented case and requirements when a software decision is justified.
Implementation planConfiguration, testing, training, handoff/ongoing ownership, and operating documentation.
Verification planHow the remediated control will be tested after rollout and who owns follow-up.
Continuity: the same operator stays accountable across the lifecycle.