Why compliance requires process documentation
Compliance frameworks like ISO 9001, SOX, and GDPR require organizations to document their processes. Auditors need to verify that processes exist, are followed, and include appropriate controls. BPMN is the most accepted notation because it is standardized, precise, and internationally recognized.
Common compliance frameworks
ISO 9001 (Quality Management)
Requires documented processes for quality-affecting activities. Process maps must show inputs, outputs, sequence, responsibilities, and controls. BPMN covers all of these natively.
SOX (Financial Controls)
Requires documented controls over financial reporting. Process maps must show approval steps, segregation of duties (different lanes), and exception handling. Auditors specifically look for control points.
GDPR (Data Protection)
Requires documented processes for data handling. Process maps must show where personal data enters, how it flows, who accesses it, and how it is deleted. Data objects and data stores in BPMN model this.
HIPAA (Healthcare)
Requires documented safeguards for protected health information. Similar to GDPR - map data flows, access controls, and breach response procedures.
What auditors look for in process maps
- -Clear responsibilities - lanes showing who does what. Auditors verify segregation of duties.
- -Control points - approval gateways, review tasks, validation steps. These are the safeguards.
- -Exception handling - what happens when something goes wrong? Error paths, escalation, compensation.
- -Version and date - when was this documented? When was it last reviewed? Is it current?
- -Evidence that the process is followed - the map alone is not enough. Auditors check that reality matches documentation.
Tips for compliance documentation
- -Map reality, not the policy - if the actual process deviates from the policy, fix the process or update the policy. Do not create fictional documentation.
- -Include data flows for GDPR/HIPAA - use BPMN data objects to show where personal data moves through the process.
- -Schedule regular reviews - quarterly for critical processes. Compliance documentation that has not been reviewed in 6 months is a risk.
Related guides
Documentation Best Practices
How to maintain compliant docs.
As-Is vs To-Be
Map current state for audit evidence.
Data Objects
Model data flows for GDPR.
Common Mistakes
Avoid errors auditors catch.
Keep learning
Practice
Best Practices
Modeling rules for clean diagrams.
Practice
Travel Agency
Complex documented processes.
Frequently asked questions
Is BPMN required for ISO 9001?▼
No specific notation is required, but BPMN is the most widely accepted. Its precision and international standardization make it the preferred choice for auditors and certification bodies.
How detailed should compliance process maps be?▼
Detailed enough that an auditor can verify controls, responsibilities, and exception handling. Use sub-processes to manage complexity - keep top-level diagrams readable while providing detail on demand.
How often should compliance process maps be reviewed?▼
At minimum quarterly for critical processes. After any significant process change. And before every audit cycle. Many organizations tie process reviews to their internal audit calendar.
Top comments (0)