Operational Planning and Control (OPC)

Policies and procedures are the foundation of any compliance framework. However, simply having documented policies is not enough—organizations must ensure that these guidelines and processes are followed 

To achieve this, it is essential to implement Operational Planning and Control with: 
 

Clear ownership: Assigning responsibility for monitoring and enforcing compliance.  
Defined frequency: Regularly reviewing and updating policies to keep them relevant.  

Specified Procedures and Criteria: Establishing clear procedures to ensure consistency.  
Documented Evidence: Defining clear evidence and maintaining records to demonstrate compliance during audits. 

These operational controls are critical for maintaining compliance frameworks such as ISO 27001, ISO 27001, ISO 9001, SOC 2, GDPR, or any other regulatory standard. Regular monitoring and enforcement ensure that controls are up to date and aligned with business objectives. 

Defining and Implementing Controls: 

The ‘Operational Planning and Control Section’ enables you to record and manage as many controls as necessary, tailoring them to fit your business needs, compliance requirements, and risk management strategies. However, we recommend starting with a set of baseline controls to establish a strong foundation for compliance. 

These baseline controls provide an immediate overview of key mandatory compliance topics and ensure that critical activities are consistently performed at the required intervals. By implementing these essential controls from the outset, your organization can manage risks, streamline audits, and maintain regulatory compliance. 

To support this process, Compleye offers OPC Overview Template, available in the Compleye Online Templates Section. You simply need to download the document and copy the controls into the ‘Operational Planning and Control Section’, following the steps outlined below.  

Operational Planning and Control Section: 

The Operational Planning and Control Section provides an overview of all controls, which are activities performed regularly to mitigate potential risks. The effectiveness of these controls should be evaluated at least once per year. Compleye Online offers two views to help manage and track controls: 

• Schedule View: Displays controls in chronological order, making it easy to track and manage overdue tasks during security meetings. 

• List View: A complete overview of all defined controls, allowing filtering by owner, type, or status for better management. 

How to Create a Control? 

Step 1: Click the Yellow Button Locate and click the yellow button to initiate the control creation process. 

It will automatically create a new screen, as presented below: 

When creating a control, the interface is divided into two sections: 

1. Left Side: OPC Details: This section allows you to define and configure the control. Here, you will enter details such as Control Name, OPC Type, Procedure/Criteria, Evidence, Frequency, and Owner. 

1.  Right Side: OPC Executions: This section is used to track and monitor the execution of the control overtime. 

Filling in OPC Details: When creating a control, all fields marked with “*” are mandatory and must be completed. Below is a guide to help you understand each field and its purpose: 

• OPC Name: Clearly name your control so your team understands its purpose. Example: “Check Asset Overview”. 

•  Owner: Assign a person responsible for the control. This person ensures the control is executed and monitored properly. 

• Start Month: Choose the month when the control should start. Make sure to start on time to avoid overdue controls. If unsure, schedule it later and adjust as needed. 

• Frequency: Set how often the control should be executed. Be realistic, you can update the frequency later if needed. 

• OPC Type: Select the compliance framework(s) relevant to the control. Controls may apply to multiple frameworks, so label them accordingly. 

•  Procedure/Criteria: Explain how the control will be performed. This could be a step-by-step checklist or a short procedure, as well as criteria that should be met to successfully complete the control. For example, have you ensured that the asset overview was consulted with the relevant department? If you have a standard procedure document, use the ‘upload document’ function and reference it in this field. 

• Definition of Evidence: Evidence is critical for compliance—if there is no evidence, it didn’t happen. Ensure that the assigned owner understands what is required for proper documentation. Examples of Evidence for Control: 

• Upload a link to another environment where the evidence can be viewed. 

• Meeting notes documenting discussions related to the control. 

• Copies of emails confirming actions taken or results of the control. 

• Other relevant documents such as reports, screenshots, or logs. 

Remarks 

• If changes are made over time (e.g., adjusting frequency, evidence, or procedure), use this section to explain the reasons for those changes. 

• If the control is no longer applicable, explain why and consider archiving it. 

• Upload relevant documents, such as standard procedures or examples of evidence, to support the control. 

Final Step: Once you’ve entered all the information, save the control to finalize the process. 

After saving the control, you will return to Schedule View. 

Here, you can check if your control has been added to the first month you assigned it to. 

For example, in the screenshot below, ID #635 shows where the control appears in the schedule 

Once you open the control, you will see that the right side of the control is now active. It will automatically generate executions of the control based on the frequency you assigned. 

This allows you to easily track and manage the control’s progress over time. 

OPC Executions 

You can open the Execution by clicking on the respective control in the OPC Executions section. This will allow you to view the details and track the progress of each execution based on the frequency and schedule you have set. 

Use this ‘Pen’ icon to open the execution

OPC Executions Fields Overview: 

Below is a description of each field in the OPC Executions section: 

OPC Interval: Pre-set: This field is automatically populated based on the combination of the set frequency and starting monthyou assigned when creating the control. 

Assigned To: Preset: This field is automatically filled with the name of the owner (the person responsible for the control). 

Status: You can choose different statuses to reflect the execution stage of the control: 

• Open: The default state when the control has not been executed yet. 

• Ready for Evaluation: If you have executed the control and are ready to discuss or evaluate it, typically during a security meeting with the ISMS Team. 

• Finalized: After executing the control, if you are satisfied with the result and wish to close it, you mark it as Finalized. This will highlight mandatory fields in red that need to be completed before finalizing. 

• Skipped: If the control execution was not performed, you can select Skipped. Document the reason for skipping in the remarks field. No evaluation is needed in this case. 

• Rescheduled: If you change the Start Month or frequency of the control, this status will reflect the new schedule. 

Executed By: This field allows you to assign a different person to execute the control, separate from the assigned owner (the person responsible for the overall control). 

Execution Proof: This field confirms that the control has been performed according to the control details on the left side. It serves as evidence that the action was completed as planned. 

Has the Effectiveness of the Control Been Verified: This field is used to confirm whether the effectiveness of the control has been assessed. To implement this step effectively, make sure to follow the effectiveness guidelines provided in the blue link. This ensures that the control is not only executed but also functions as intended to mitigate risks and achieve the desired outcomes. 
 

• Choose  Yes  if you agree with the Effectiveness Check – Control Questions. Make sure you have added evidence and choose status ‘ Finalised’ . 
• Choose  No  if you think it’s time to change the control . In this case you’ll need to add a remark (will pop-up automatically) and choose the status  Ready for Evaluation . Make sure it will be on the agenda for your next security meeting. You can add a comment in section Operations – Security Meeting.  

Documents / Links

Evidence can be uploaded via a document or add a link.  
 

TIP : If you just want to add a control and will finalize it later, make sure your  Start Month  is  far in the future . Otherwise Compleye Online will plan executions when you may not be ready.