Control layout

What this part of the catalogue does

Clause 4.3 describes the layout used for every control: a short title, an attribute table, the control itself (what it is), its purpose (why it is needed), guidance (how to implement it, with underlined subheadings where the guidance is long) and other information (explanation or pointers to related documents).

What it means when you fill the register

The clause describes how each control is presented: an identifier and name, a table of attribute values, a purpose statement, implementation guidance, and other information where useful. The layout is a contract with the reader: the values sit at the top of every control, so the catalogue can be read as a matrix without hunting for the tags. For a register this is the argument for putting the five values in the first columns, beside the code and the name, rather than at the end of a long justification. Our control pages follow the same order. An auditor who is used to the catalogue will look for the values in the same place on every page, and a register that hides them will be read as incomplete even when it is not. The layout point has a second use: it makes a diff readable. If every control page presents the same fields in the same order, a comparison between two versions shows what actually changed, rather than a moved paragraph. That is the same reason our control pages put the values in a fixed table and the evidence in a fixed list, and why the kit exports the same fields in the same column order.

The layout is a promise about where the values sit. In the catalogue, every control presents its table before its purpose and guidance, so a reader can scan the matrix without reading the prose. A register that puts the values at the end of a long row has broken that promise, even if the data is right. The practical fix is a column order: code, name, theme, five attributes, evidence, owner, due date. Everything else can follow.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method