Part II · Chapter 4 · What a control is · lesson 5

Stop it, spot it, or clean up after it

12 min

Builds on Four things you can do, and only one of them is work

A branch that refuses to merge without a second approval. An alert that fires when somebody merges anyway. A rollback that puts production back the way it was.

Three controls, one risk, three completely different relationships with time. The first one lives before the event and makes it not happen. The second lives during or just after and makes it known. The third lives afterwards and makes it survivable.

The jargon for those is preventive, detective and corrective, and the words are less useful than the forces. What matters is when each one acts, what it costs when it is right, and what it costs when it is wrong.

Predict

Which of the three is most likely to be switched off, bypassed or weakened under deadline pressure?

The one that stops thingsThe one that spots thingsThe one that cleans up afterwardsThey are equally exposed, since all three depend on the same attention

Three forces, named by when they act.

Stop it. Acts before. Succeeds invisibly — a prevented event leaves no trace, so the control produces no evidence of the thing it prevented, only evidence that it was in force. Costs friction, continuously, to everybody.

Spot it. Acts during or after. Produces the richest evidence of the three, because its output is a stream of dated events with responses attached. Costs attention, which is the scarcest input in any organisation and the only one that cannot be bought in bulk.

Clean up. Acts afterwards. Cheap while unused and the most likely of the three never to have been exercised. Its evidence is a test, because the real event has not happened yet.

A risk covered by only one of the three is covered thinly, and which one is missing tells you what the bad day will look like.

What each one's evidence looks like

This is where the three forces stop being vocabulary and start mattering, because the three produce evidence of completely different shapes.

A control that stops things has almost no operation evidence by construction. Nothing happened; that is the point. What exists is the setting, its change history across the period, and the population of work that went through while it held. If somebody wants to know whether the control was in force in March, the setting's change log is the only artefact that answers, and most teams have never exported one.

A control that spots things has the opposite problem: far too much evidence, nearly all of it meaningless. Eleven thousand channel messages, a dashboard, a monthly volume figure. The informative subset is small and specific — what fired, who acknowledged it, how long that took, and the ones nobody acknowledged at all.

A control that cleans up has evidence only of rehearsals. A dated exercise, who took part, how long each step took, and which assumption turned out to be false. The assumption that turned out to be false is the single most useful line in the folder, and the one most often omitted because it reads as a failure.

Not the same thing

Stops it

A control that makes the unwanted thing unable to proceed.

Measured in: Whether it was in force for the whole period, and what the population of governed work looked like while it was.
For example: A pipeline gate that fails the build, which the author of the change cannot override.
Chase it alone and: It is the thing in the way, so under deadline it is the thing that gets moved — usually for a good local reason, recorded as a settings change nobody writes up.

Spots it

A control that makes the unwanted thing known to somebody who can act.

Measured in: Time from the event to a human acknowledging it, and the proportion of events nobody acknowledged.
For example: An alert on a privileged login outside the elevation path, paging somebody who is expected to be awake.
Chase it alone and: Volume grows past the available attention and people quietly stop looking, which changes nothing in the configuration and so leaves the design evidence intact.

Which is which? Put each one on a side.

Two approvals required before a merge, with no administrator override
A quarterly comparison of who holds administrative rights against who should
A payment that cannot be released until a bank-detail change is verified by phone
A monthly export of merged changes where the approver and the author were the same person
Storage encryption on a database, managed by the platform
A restore test that reads last month's archive back into a working system

The cost that is never in the register

Prevention is the only one of the three whose cost is paid by people who are not in this conversation.

An alert costs attention from whoever is on the rota. A restore test costs a day from an engineer. A gate that requires a second approval costs every person who ships anything, every time, forever — and that cost lands on people who had no part in the decision and will not know which control to blame.

That is the real reason prevention erodes. Not that somebody disagreed with it, but that its cost is diffuse and its benefit is invisible, which is the exact shape of a thing that gets quietly removed. If you want a preventive control to survive a year, the useful question is not whether people agree with it. It is whether anybody would notice the day it stopped being enforced, which puts you back in the previous lesson.

Check

A risk is covered by one control: a quarterly review that finds the problem after the fact. What does that coverage actually buy?

A bounded detection delay of up to a quarter, and nothing before the eventFull coverage, since the problem will be found and fixedNothing, because a control that acts after the event is not a controlCoverage that depends entirely on whether the review happens on time

Why everybody plans for the clean-upOptional

The corrective control is the one with the budget, the named plan and the annual exercise, and the reason is not that it is the most valuable.

It is the only one of the three that is a project. Prevention is a setting; detection is a rota and somebody's attention. A recovery plan is a document, a workshop, an exercise and a report, which makes it schedulable, assignable and visibly complete. Organisations are good at things that can be finished.

The forces that are never finished are the two that run every day, and they are the two that erode. Any framework for keeping controls alive over a second year has to deal with that asymmetry directly, which is what track 7 is about.

Worth remembering

Stop it, spot it and clean up are three relationships with time, and each has a different cost and a different evidence shape.
A preventive control succeeds invisibly, so its evidence is the setting's change history plus the population of work that passed while it held.
A detective control produces too much evidence; the informative part is what fired, who acknowledged it, how long it took, and what nobody acknowledged.
A corrective control's only evidence before the real event is a rehearsal, and the assumption that turned out false is the most useful line in it.
Prevention erodes because it is the thing in the way, and its cost is paid diffusely by people who were not in the decision.
The clean-up gets planned for because it is the only one of the three that is a project and can be finished.