Controls

A control is a document of type Control. It is written, reviewed, published, cited and checked exactly like any other document.

A control is a document whose type is Control. Alchex has three kinds of records: documents, register records and risks. A control is not a fourth kind.

Creating a control

Go to Governance → New, choose Control and give it a name. It opens as a draft in the same editor as a policy or a procedure, with a CTL-… code that is numbered per team (CTL-SEC-004). It starts blank, like every other document type.

You can also change an existing document's Type to Control (or back) from its properties.

What a control does

A control behaves exactly like any document:

  • Writing and review. It follows the same draft → review → publish flow, with the same approvals and version history. See Submit and approve.
  • Scope. You pick the clauses it answers for in the same way as for any document. The compliance page counts it toward those clauses as a document, and a clause's verdict comes from its documents' checks. See Compliance.
  • Evidence. Proof is cited in the text: a document, a register, a file or a connected source, by typing @ or pasting its link. See References.
  • Checking. A control runs on its clock, from the Controls page where it was added on the document it checks. Each run's result is kept on the run and shown on the control's page. See Workflows.
  • Archive and delete. Both follow the same rules and permissions as every other document. See Activity and archive.
  • The assistant. In Ask Alchex, you can focus the conversation on a control from the Governance tab, like any document. See AI review and assistance.

Filter the Governance list's Type column to Control to see a team's controls together.

Earlier control history

Before October 2026 a control could carry its own audit agent, an attached evidence list and audit reports. That history was not deleted. Each team that had any now has a register named Control audit history, with three tables:

  • Audit reports: one record per earlier run, with its result, evaluation and who ran it.
  • Audit findings: one record per requirement a run judged.
  • Evidence: one record per item that was attached to a control.

Links to an old control page (/app/controls/…) open the governance page instead.

Related