A control without an owner and a test date is an intention

Between knowing what needs to happen and having it demonstrably arranged, many organisations harbour a quiet gap. The treatment plan has been adopted, the intentions are good, and a year later half of it turns out to have stalled. The Resolve phase bridges that gap with a simple rule: every solution gets an owner, a form and a date.

A control without an owner and a test date is an intention

A control only becomes a control when someone is responsible for it and there is a moment at which its operation is tested. So record per control what it does, who owns it and when the next effectiveness test takes place. The test frequency can be pragmatic; what matters is that "we have backups" turns into "the last restore test was on this date and this was the result".

Policies need a lifecycle

A policy that is written once and never looked at again quietly loses both its authority and its value as evidence. Give every document a lifecycle: an owner drafts it, a second person approves it under the four-eyes principle, and a review cycle determines when it is reassessed. If the review date passes, the document no longer counts as current, and that should be visible.

What does not yet exist becomes a project

For gaps without a working solution, the project is the right form. A project has an owner, an end date and a link to the risks or requirements it will cover. That keeps visible which coverage is already active and which is on its way, and on completion the project becomes an active control with a single click, including all its links.

Accepting is allowed, but do it formally

Not every risk has to be eliminated; some you consciously accept. Then do it formally, with an exception: a recorded deviation with a rationale, an approver and an end date. The end date is the essential difference from silent tolerance, because well before it expires the requester and approver receive a reminder to extend, replace or let it lapse in a controlled way.

The monitoring then does the work

Once controls, policies, projects and exceptions have their dates, the automatic monitoring takes over: review cycles, effectiveness tests and expiry alerts automatically create tasks and emails for the right person. Maintenance then stops being a matter of discipline and becomes a matter of rhythm.