CAO-100 Governance — Domain ECF

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-111 Information Governance Framework and Strategy › CAO-1111 Recognise and govern information as a strategic organisational asset › CAO-11111 Information recognised and governed as a strategic asset across the organisation.

CAO-111111 · Examine the information governance framework and asset inventories to confirm information is governed as a strategic asset.

Method: examine · Expected evidence: IG framework; information asset inventory

Operational controls: CAO-1111111 Information Governance Framework — template

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-111 Information Governance Framework and Strategy › CAO-1112 Integrate information governance into organisational governance with leadership commitment › CAO-11121 Information governance integrated into the organisation’s governance frameworks with visible leadership commitment.

CAO-111211 · Examine governing-body records to confirm information governance integration and leadership engagement.

Method: examine · Expected evidence: governance minutes; IG charter

Operational controls: CAO-1112111 Information Governance Charter — template

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-112 Information Lifecycle, Access and Culture › CAO-1121 Govern information across its lifecycle, available and accessible to stakeholders › CAO-11211 Information governed across its whole lifecycle with availability and accessibility to stakeholders.

CAO-112111 · Examine lifecycle schedules and access records to confirm information availability and accessibility.

Method: examine · Expected evidence: lifecycle schedules; access records

Operational controls: CAO-1121111 Information Asset Register

CAO-100 Governance › CAO-110 Information Governance Policy › CAO-112 Information Lifecycle, Access and Culture › CAO-1122 Operate risk-based information governance supported by collaborative culture › CAO-11221 Risk-based information governance operated with a collaborative, sustainable information culture.

CAO-112211 · Examine risk assessments and culture programmes supporting information governance.

Method: examine · Expected evidence: risk register extracts; awareness records

Operational controls: CAO-1122111 Information Governance Risk and Culture Record

CAO-100 Governance › CAO-120 Board Charter › CAO-121 Board Composition and Independence › CAO-1211 Ensure an appropriately composed and independent board › CAO-12111 Board composed with appropriate balance, diversity and independence.

CAO-121111 · Examine board composition to confirm appropriate balance, diversity and independence.

Method: Examine · Expected evidence: Board composition records

Operational controls: CAO-1211111 Board Composition Register

CAO-100 Governance › CAO-120 Board Charter › CAO-122 Succession and Evaluation › CAO-1221 Plan board and executive succession › CAO-12211 Board and executive succession planned to ensure continuity of leadership.

CAO-122111 · Examine succession plans to confirm board and executive continuity is planned.

Method: Examine · Expected evidence: Succession plan

Operational controls: CAO-1221111 Succession Plan — template

CAO-100 Governance › CAO-120 Board Charter › CAO-122 Succession and Evaluation › CAO-1222 Evaluate the performance of the board and its members › CAO-12221 Board and member performance evaluated periodically.

CAO-122211 · Examine board evaluation records to confirm performance is evaluated.

Method: Examine · Expected evidence: Board evaluation records

Operational controls: CAO-1222111 Board Evaluation Register

CAO-100 Governance › CAO-130 Data Governance Policy › CAO-131 Data Governance Framework and Stewardship › CAO-1311 Establish data governance aligned to the information governance umbrella › CAO-13111 Data governance established and aligned to the information governance umbrella.

CAO-131111 · Examine the data governance framework to confirm alignment and operation.

Method: examine · Expected evidence: data governance framework; operating records

Operational controls: CAO-1311111 Data Governance Charter — template

CAO-100 Governance › CAO-130 Data Governance Policy › CAO-131 Data Governance Framework and Stewardship › CAO-1312 Define data stewardship roles, accountabilities and decision rights › CAO-13121 Data stewardship roles, accountabilities and decision rights defined and operated.

CAO-131211 · Examine stewardship assignments and decision records to confirm accountabilities are operated.

Method: examine · Expected evidence: stewardship assignments; decision logs

Operational controls: CAO-1312111 Data Stewardship Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-141 Board Leadership and Accountability › CAO-1411 Establish effective and ethical board leadership › CAO-14111 Effective and ethical board leadership established.

CAO-141111 · Examine the board charter and conduct to confirm effective and ethical leadership.

Method: Examine · Expected evidence: Board charter

Operational controls: CAO-1411111 Board Charter — template

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-141 Board Leadership and Accountability › CAO-1412 Ensure board accountability and oversight › CAO-14121 Board accountability and oversight of the organisation ensured.

CAO-141211 · Examine board oversight records to confirm accountability and oversight.

Method: Examine · Expected evidence: Board oversight records

Operational controls: CAO-1412111 Board Oversight Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-142 Governance Roles and Responsibilities › CAO-1421 Define governance roles and the division of responsibilities › CAO-14211 Governance roles and the division of responsibilities defined.

CAO-142111 · Examine governance role definitions to confirm responsibilities are divided.

Method: Examine · Expected evidence: Governance roles and delegation of authority

Operational controls: CAO-1421111 Delegation of Authority Framework

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-142 Governance Roles and Responsibilities › CAO-1422 Assign accountability and appoint data-protection responsibility › CAO-14221 Accountability assigned and data-protection responsibility appointed.

CAO-142211 · Examine accountability assignments to confirm data-protection responsibility is appointed.

Method: Examine · Expected evidence: DPO appointment and accountability records

Operational controls: CAO-1422111 Accountability and DPO Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-142 Governance Roles and Responsibilities › CAO-1423 Delegate authority to executive management and ensure its effectiveness › CAO-14231 Authority delegated to executive management with effectiveness ensured.

CAO-142311 · Examine the delegation framework and executive performance records to confirm effective delegation.

Method: examine · Expected evidence: delegation framework; performance reviews

Operational controls: CAO-1423111 Executive Delegation and Performance Record

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-143 Board Committees › CAO-1431 Establish and empower board committees with defined terms of reference › CAO-14311 Board committees established with defined terms of reference, composition and reporting.

CAO-143111 · Examine committee terms of reference, composition, meeting and reporting records.

Method: examine · Expected evidence: committee ToR; minutes; reports

Operational controls: CAO-1431111 Committee Terms of Reference — template

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-144 Stakeholder and Shareholder Engagement › CAO-1441 Engage stakeholders and shareholders in the organisation’s best interests › CAO-14411 Stakeholders and shareholders engaged in the best interests of the organisation.

CAO-144111 · Examine stakeholder and shareholder engagement records to confirm engagement quality.

Method: examine · Expected evidence: engagement plans; meeting records

Operational controls: CAO-1441111 Stakeholder Engagement Register

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-144 Stakeholder and Shareholder Engagement › CAO-1442 Govern the group governance framework › CAO-14421 Group governance framework defined and operated across the group.

CAO-144211 · Examine the group governance framework and its application across group entities.

Method: examine · Expected evidence: group governance framework; adoption records

Operational controls: CAO-1442111 Group Governance Framework — template

CAO-100 Governance › CAO-140 Corporate Governance Policy › CAO-145 Transparency and Disclosure › CAO-1451 Ensure transparency and stakeholder disclosure › CAO-14511 Transparency and stakeholder disclosure ensured through accurate, timely reporting.

CAO-145111 · Examine disclosures and stakeholder reporting to confirm transparency.

Method: Examine · Expected evidence: Disclosure and reporting records

Operational controls: CAO-1451112 Governance Disclosure Statement — template · CAO-1451111 Stakeholder Disclosure Register

CAO-100 Governance › CAO-150 Technology Governance Policy › CAO-151 IT Strategy and Value › CAO-1511 Govern information technology and digital strategy › CAO-15111 Information technology and digital strategy governed and aligned to organisational objectives.

CAO-151111 · Examine IT strategy governance to confirm alignment to objectives.

Method: Examine · Expected evidence: IT strategy and governance records

Operational controls: CAO-1511111 IT Strategy and Governance Plan

CAO-100 Governance › CAO-150 Technology Governance Policy › CAO-152 IT Oversight and Conformance › CAO-1521 Oversee IT performance, risk and conformance › CAO-15211 IT performance, risk and conformance overseen by the governing body.

CAO-152111 · Examine IT oversight reporting to confirm performance, risk and conformance are overseen.

Method: Examine · Expected evidence: IT oversight reports

Operational controls: CAO-1521111 IT Governance Reporting Register

CAO-100 Governance › CAO-160 Quality Management Policy › CAO-161 Quality Management System › CAO-1611 Establish and operate a quality management system › CAO-16111 Quality management system established and operated.

CAO-161111 · Examine the quality management system to confirm it is established and operated.

Method: Examine · Expected evidence: QMS documentation

Operational controls: CAO-1611111 Quality Management System — template

CAO-100 Governance › CAO-160 Quality Management Policy › CAO-161 Quality Management System › CAO-1612 Drive continual improvement of quality › CAO-16121 Continual improvement of quality driven through measurement and corrective action.

CAO-161211 · Examine improvement and corrective-action records to confirm continual improvement.

Method: Examine · Expected evidence: Improvement and corrective-action records

Operational controls: CAO-1612111 Continual Improvement Register

CAO-100 Governance › CAO-170 Remuneration Policy › CAO-171 Remuneration Governance › CAO-1711 Govern remuneration and incentives fairly and transparently › CAO-17111 Remuneration and incentives governed fairly, transparently and responsibly.

CAO-171111 · Examine remuneration policy and disclosures to confirm fair and transparent governance.

Method: Examine · Expected evidence: Remuneration policy and disclosures

Operational controls: CAO-1711111 Remuneration Policy — template

CAO-100 Governance › CAO-190 Security Governance Policy › CAO-192 Information Security Governance › CAO-1921 Establish and govern an information security management system › CAO-19211 Information security management system established and governed.

CAO-192111 · Examine the information security management system to confirm it is established, governed and maintained.

Method: Examine · Expected evidence: ISMS documentation

Operational controls: CAO-1921111 Information Security Management System — template

CAO-100 Governance › CAO-190 Security Governance Policy › CAO-192 Information Security Governance › CAO-1922 Maintain the information security programme › CAO-19221 Information security programme maintained, resourced and continually improved.

CAO-192211 · Examine the security programme to confirm it is resourced and continually improved.

Method: Examine · Expected evidence: Security programme and improvement records

Operational controls: CAO-1922111 Security Programme Plan