Boring Controls Save You

Nobody ever celebrated internal controls. Nobody framed the segregation checklist or threw a party for the reconciliation log. Controls were the boring background hum of grants work — noticed only when they were missing, usually during a very bad week.

Then one day the boring controls caught something: a duplicate payment, an unauthorized change, a report that didn't reconcile. And suddenly everyone understood. Boring is the point. Controls are supposed to be uneventful. Uneventful means they're working.

ISO/IEC 42001 — the international standard for AI management systems, published in December 2023 — is this idea, formalized for AI. It's not exciting reading. It's a management system: define your objectives, assess your risks, put controls in place, check that they work, improve. The same rhythm grants ran on for decades.

Don't let the dryness fool you. The organizations that survive AI incidents won't be the ones with the cleverest models. They'll be the ones with boring controls that caught the problem on a Tuesday afternoon, uneventfully.

Celebrate the boring. It saves you.

I explain frameworks; I don't give legal counsel.