Give every manual control a runbook, a named backup, a schedule that does not live in someone's head, and one place where evidence is saved. Test the handover by having the backup run it once. A control that only one person can run is a single point of failure.
Why manual controls break
Manual controls are the ones that depend on memory: a quarterly review, a restore test, a vendor check. They fail quietly. Nobody notices a missed run until the auditor asks for the record. When the owner leaves or changes roles, the knowledge goes with them unless it is written down.
What to write down
| Item | Content |
|---|---|
| Purpose | What risk it covers, in one sentence |
| Owner and backup | Two named people, with their roles |
| Schedule | Date rule, such as first working day of each quarter, and where reminders come from |
| Steps | Numbered, with links to the systems used |
| Evidence | What to save, file naming and storage location |
| Decision rules | What counts as pass, fail or exception |
| Escalation | Who to tell if something fails |
| Last run and next run | Date and link to the last evidence |
Keep it to one page. If steps need judgment, write the guidance for the common cases and say who to ask for the rest.
Make the schedule independent of a person
Do not rely on a personal calendar. Use a shared scheduled ticket, a recurring issue or a team calendar entry assigned to a role. When the owner changes, update the role assignment, and the schedule follows.
Steps for a handover
- Walk the backup through the runbook while the owner is still available.
- Have the backup run the control once, with the owner watching.
- Update the runbook with anything that was unclear.
- Record the handover with a date and both names.
- Change the owner in the control list and in the reminder system.
- For departures, add this check to your offboarding checklist: list the controls this person owns or backs up.
Detect orphaned controls
Once a quarter, compare the control list with the active staff list. Any owner or backup who is not active is a finding to fix now. Also check for controls whose last evidence is older than their frequency allows.
Turn manual into semi-automatic
Many manual steps can be partly scripted: the data pull, the saved export, the ticket creation. Keep the human judgment, and automate collection. That reduces what the next person must learn.
What to avoid
- Instructions that say "ask Sam". Sam will leave.
- Evidence kept in personal drives.
- Runbooks last updated years ago.
- A backup who has never run the control.
Quick check
How many people should know each manual control?
At least two, an owner and a backup, and the backup should have run it once.
Where should the runbook live?
In a shared, access-controlled location with version history, next to the control list.
Safeguard compliance and evidence automation can reduce manual collection steps. A free scan is available.
Last reviewed: 19 October 2026.
