Control Process

caution

This page has been moved to the eSSIF-Lab Framework on Github.

Short Description

A Control Process is a process, owned and run by a party, to ensure that a specific subset of its control objectives are realized. Control objectives are objectives that a party sets to be in control of something. A party that wants to control the quality of its processes, or the information security, may create a set of objectives the realization of which signify its being 'in control' on such topics.

As with all objectives, control objectives are associated with results, which are to be produced, and used. It is typical for control objectives that their owner actually uses (consumes) the results, implying that the owner will do their governance. The owner may do their management as well, or outsource it. See the governance and management pattern for an elaboration on this.

Control Process

The control process we describe here is 'effect-driven', which means that it does not require any knowledge about the way in which the control objectives are realized. This means that parties are not forced to use particular methods, procedures, etc. It specicially also allows the process to be used in a governance setting.

While some may see this process simply as a means to turn the PDCA-cycle (which in a way, it is), its value lies in the explicit specification of the concrete results that have to be achieved in the various steps. Such explicit specifications provide the concrete basis for both the managers of an objective and its governors to do their jobs.

The executive summary of this process is that:

  1. (initial) control objectives are set in terms of the results/effects that have to be achieved;
  2. results/effects are measured through so-called 'effect indicators'. (An indicator is a number or value that can be decided on (or measured) objectively by following a measuring instruction. An effect indicator measures an effect or result that is the aim of an organization. Example: 'the percentage of deliveries of the last 30 days, that have been received by the customer within 24 hours after his order was accepted.');
  3. results/effects are judged not only on whether or not the effect indicators have met the applicable norms, but also on any circumstances (increasing insights, unexpected events, etc.) that have influenced such results. (A norm is a level that the organization aims an indicator to comply with or must reach. Example: [indicator] > 99%.);
  4. results are reflected upon, learning from what happened and/or celebrating the results;
  5. decisions are made about altering the control objectives, indicators, judgements, etc. – if necessary. The agent (of the party that owns this process) that is tasked with taking the decisions in this process is referred to as 'the governor'. This means that the production of any result other than decisions may be delegated to other actors. After step 5 is completed, the same conditions apply as after step 1 is completed, so execution continues at step 2 rather than step 1.

1. Setting of initial control objectives.

The purpose of this activity is to provide clarity for all stakeholders with respect to the focus of the control process.

It is not the purpose of this activity to come to agreement with stakeholders about what is expected of them. That would be another activity.

The results of this activity are that all of the the following criteria are met:

  1. for every area that is being governed, all control objectives are described in terms of the results/effects that are aimed for, and the organization(s) that are expected to produce the results;
  2. for every objective, one or more effect indicators are specified;
  3. for every objective, norms that are based on such effect indicators are specified (implicitly or explicitly), as well as a point in time (that may be repetitive) that the norm must have been met;
  4. the (first occurrence of the) point in time has been established by which step 5 must have been completed.
  5. there is a decision by the governor stating that these control objectives are in fact to be met and the associated results/effects are to be achieved.

2. Measuring Results/Effects.

The purpose of this activity is to ensure that all effect indicators are being assigned values (e.g. measured).

It is not the purpose of this activity to already pass judgements based on such values.

Having 'clean' measurements that are unprejudiced is of great value when judging achievements, and therefore measuring and judging results/effects should be distinct. In order to guarantee this distinction, it may be necessary to have third parties execute this activity.

The results of this activity are that all of the the following criteria are met:

  1. all effect indicators as specified in step 1 have been assigned a value.

3. Judging Results/Effects.

The purpose of this activity is to obtain clarity about whether or not the control objectives have been achieved (in a manner that is sufficiently satisfactory to the governor).

Such judgement should be based on two sources of information. The first is comparing the values of the (measured) effect indicators to the norms set in step 1.3. The second source is any progressing insights, unexpected events or other circumstances that might explain any deviations (both positive and negative) from the norms. It is explicitly part of this activity to identify such circumstances.

Taking both sources of information into account, judgement must be passed on each control objective; this judgement says whether or not the expected result/effect has been (sufficiently) achieved. A judgement should be justified if its indicator values deviate significantly from the norm (which can go both ways).

The results of this activity are that all of the the following criteria are met:

  1. for every control objective, it is clear whether or not its norm(s) have been satisfied;
  2. for every control objective, there is a judgement stating whether or not it is (sufficiently) achieved;
  3. if, for some control objective, the judgement differs from what would be expected given the evaluation of the norms, there is a justification for this judgement.

4. Reflection/Learning.

The purpose of this activity is to provide clarity about the next steps that should be taken.

Quite some time may elapse between setting control objectives, the associated effect indicators/norms, and judging the results/effects. Meanwhile, all sorts of things can change (e.g. laws, the market, political situation, competitors, technology, the organization's obligations, etc.). Such changes may cause control objectives, effect indicators or norms to become outdated. The experience of having judged the results/effects in the previous step is invaluable, because the person that has done this will have 'felt' any contradiction or discrepancy between the effect indicator values and norms, and his own sense of whether the results/effects have been achieved. This information and feeling allows the governor (and others) to ponder, e.g. about: – fine-tuning or modifying control objectives, indicators, norms; – modifying objectives that the organization has committed itself to realize (obligations); – possibilities for influencing circumstances/stakeholders; – celebrating (unexpectedly) well achieved objectives.

The results of this activity are that all of the the following criteria are met:

  1. for every control objective it has been established what should be modified/improved and/or celebrated;
  2. for every control objective there is a proposition of how this may be achieved;
  3. there is either a proposition for new control objectives, each of which satisfies the criteria of step1, or a statement saying there are no such control objectives.
  4. for every new or modified control objective, the criteria for the initial control objectives are met.

5. Decision making.

The purpose of this activity is to explicitly decide which of the proposals in step 4 will be adopted, and which not.

Doing so shows that you have actually learned. Also, putting all decisions in a single step allows the governor to delegate the work in steps 3 and 4 to others.

The results of this activity are that all of the the following criteria are met:

  1. for each control objective for which it was decided (in step 1) that it should be achieved, there is a decision stating whether or not it has been shown to be the case.
  2. for each proposal from step 4, there is a (preliminary) decision with respect to whether or not it will be adopted.

Controlling the control process itself

Like any other process, the control process may need to be governed. Here is how to apply the specified control process on itself. In order to distinguish the control process that is being governed, from the process that governs that control process, we will refer to the latter as the meta-control process.

Step 1 (setting the initial control objectives), is as follows:

  1. the meta-control process has 5 control objectives that it sets to the governor of the control process. These control objectives are specified by the first sentence of the description of each of the 5 activities of the control process in the previous sections;
  2. for every of these control objectives, its effect indicator is described by the results specified after the line β€œThe results of this activity are that all of the the following criteria are met:” of each of the 5 activities;
  3. a control objective is met if all criteria as mentioned in its effect indicator are met;
  4. step 5 of the process has been completed at a specified point in time.

All other steps of the control process can be followed using the aforementioned objectives, effect indicators and criteria.