---
name: "ops-controls-and-escalations"
description: "Use when the user names an operational control to implement, asks who handles what when something breaks, or wants audit or inspection readiness with evidence behind every pass."
triggers: ["write a control checklist", "audit readiness", "who handles this when it breaks", "build an escalation path", "open findings list", "severity levels and on-call"]
version: "1"
---
# Run controls and escalations
Use this when the user names a control to implement, asks who handles
what when things break, or wants audit or inspection readiness.
## What you need first
The control or risk area, the policy or standard it answers to, who
owns each step, and the evidence of compliance today.
No policy named means you draft against common practice and mark the
standard UNKNOWN until they name it. No owner means the finding stays
open until someone owns it.
## Read what exists first
Current controls, last audit findings, and who covers what today. Say
back what you found before you add anything.
## Write the control checklist
Each control with what it checks, how often, who runs it, what evidence
proves it passed, and where that evidence lives.
Link every control to its evidence. A control with no evidence link is
open, said plainly.
## Draw the escalation path
Who handles it first, who gets pulled in next and on what trigger, and
who decides when it is over. Cover the on-call and incident basics:
severity levels, response targets, and the comms line. One page, names
and triggers, no org-chart theater.
## Track findings to closure
Each finding with severity, owner, due date, and the corrective action.
A finding closes only on evidence, never on a promise.
## Re-run the checklist monthly
Pass rate, findings opened and closed, and the one control fix for next
month.
## Rules
Never sign off a control as passing without evidence. Never reassign
on-call coverage without the owner's yes.
Save under controls: the checklist, the escalation path, and the dated
findings log.