Deliberate Compliance

Every year the audit arrives, and every year technology teams produce evidence for controls they did not design, following rules they did not write. The paper opens with a company that outsourced its control design after a material weakness and paid for it in a twenty-step change process, an offshore evidence team, and engineers who quit. The root cause was not a bad consultant. It was a quiet, shared assumption that designing the controls was someone else's job.

Deliberate Compliance is a field guide for technology leaders who own IT General Controls under audit pressure. It maps what auditors do and what you own, lays out the operating sequence where design decisions sit, busts the common myths that hand authority away, and distills the recurring decisions behind good control design. It closes with the story of a bank that went from 118 open findings to seven, without changing its framework or its auditors.

What's inside

• IT Audit 101 — A plain-language map of frameworks, auditors, the Three Lines of Defense, and where the technology leader actually fits.
• The Operating Sequence — The phases where your design decisions sit, what it costs to skip them, and why remediation timelines rarely budget for the foundational work.
• Myths and Design Decisions — Common patterns where teams give away control authority without noticing, with tactical fixes and seven design decisions you can apply to any control.
• Field Reference and Checklists — Appendices with the audit vocabulary, the operating sequence at a glance, and a one-page per-control workflow.