Most descriptions of a compliance program are lists. There is a screening process, a classification procedure, a training schedule and a set of approvals, and each item can be confirmed as present.
A list does not show how the business moves. An order passes from sales to contracts, a contract passes to engineering, and an approved order passes to shipping, and the useful question is what stands in the way at each of those handoffs when the information needed to proceed is incomplete. The Compliance Infrastructure Map was designed to answer that question for a specific company.
1What the map shows
The map is a single page. It lays out the way regulated activity actually moves through a company, from first qualification of a customer through to shipment, and it marks each transition according to whether a decision stands there that is able to stop the business from proceeding.
The sample on the site follows an illustrative company with five steps: qualification, technical fit, quote, contract and shipping. Three of them have a control that is in place. One has a control that exists but is incomplete. One has no control at all: at the technical fit stage, detailed specifications are shared with prospects, sometimes before any agreement exists, and nothing happens beforehand to screen the party, capture the end use or determine classification. In an otherwise well-run sales process that is often the earliest and least visible point of exposure.
The page is meant to be read in under a minute. The conversation it starts is usually a short one: why is there nothing at that point?
2How it is built
The method separates three things that are normally discussed together. The flow is the transition, the point at which the business moves from one step to the next. The state is the information about the transaction that has to be known for that move to be permissible, such as what the product is controlled as, where it is going, who the customer and end user are, and who will receive technical data. The gate is the decision that uses that state and determines whether the business may continue.
For each transition the map asks two questions. The first is whether the company's process actually holds the information required at that moment. The second is whether a decision exists that uses it before the business moves on. A control that exists but fires after the commitment has been made is recorded differently from one that is missing, because the remedy is different.
3What each finding carries
Every finding on the map is labeled with how it was established. Some are observed directly in a document the company already had. Some are reported by the people describing the process, which is valuable but unverified. Some are inferred from the other two, and some could not be assessed because the information was not available.
This keeps the page from claiming more than it knows, and it lets a reader see how much weight each finding deserves.
4What goes into it
The map is built from a description of how the company works, a working conversation with someone who knows the process, and any documents the company already has, such as an order flow diagram or a written procedure. Everything it needs comes from how the work is described and documented, so it requires no access to the company's systems and no technical data, drawings or source code.
The conversation matters more than the description. People tend to describe the process they intended to build, and the most reliable way to find the one that operates is to ask them to walk through the last deal that closed, in order.
5What it is
The map is a diagnostic of structure. It shows where in the flow of work the business is able to move forward before the information or the decision it depends on is in place. Classification, licensing and legal judgments stay with the people responsible for them, and the map gives those people a clear view of where in the process their determinations need to happen.
It is built by hand, with a person who understands how the work flows. Where a control belongs is a judgment about a particular business, and that judgment comes from walking through real transactions with the people who carry them out.