Controlling functions should be part of the workflow, not off in isolation. How do we do that?
Get out of the way. Controls should minimise their impact on the flow of value. One way to do this is to be there in the flow, so approvals can be given on the spot, using the systems and documents of the flow. those doing value work don’t have to trudge off with whole new paperwork to get an approval from some high office. this can be done by delegating to trusted local agents within the work.
Shift Left. Bake the controls into the workflow where they are needed, where they happen.
Take reporting off those doing he value work. If the controllers come to the work, they can observe, capture data, and report.
See also open governance