◆Translation aidDefence logistics → GRCPublic frameworks only
Same control, two vocabularies
Nine things military logisticians do every week, described in the language a civilian assurance function would use for them. The control logic stays the same across both vocabularies.
Kelroy James
Royal Navy supply chain, 18 years
Mapped against published standards
📖 8 min read
🔄 9 control mappings
Just over half of UK veterans say they have at some point taken a job below the level of their last military role, and one of the two most cited reasons is that the employer did not recognise their transferable skills. I think the problem is mainly one of translation, and it runs in both directions: the individual cannot name what they did, and the recruiter has no way to price it.
This table is my attempt at one direction of that translation. The left column is what the work is called on a unit. The middle is what the control does. The right is what the same activity is called in an assurance, audit or risk function, with the published frameworks where it lives.
It is deliberately generic. Nothing here describes any particular organisation's procedures, and everything on the right can be checked against a public standard. Do the thing on the left, and the control on the right has already been operated. The vocabulary is the only thing missing.
The mapping
Nine controls
What it is called on a unit
What the control is doing
What an assurance function calls it
On a unitLogistics inspection
A scheduled, tiered inspection against a published standard, conducted by a body outside the unit being inspected.
The controlIndependent testing of whether declared compliance matches observed practice, producing evidence a higher authority relies on, with findings tracked to closure.
In assuranceSecond and third line assurance
Internal audit and independent control testing, with a defined finding lifecycle.
IIA Three LinesISO 19011
On a unitStores accounting and stocktaking
Maintaining the account, counting physical holdings on a cycle, and investigating why the count and the record disagree.
The controlPeriodic verification that the recorded asset state matches the physical one, with variances investigated rather than adjusted away.
In assuranceAsset accountability and reconciliation
Inventory integrity, existence testing, variance investigation and inventory of assets.
ISO/IEC 27001 A.5.9COSO control activities
On a unitSupersession and handover
Formal transfer of an account between two named individuals, with a certificate signed by both and retained.
The controlAccountability passes explicitly rather than by assumption, and at least two people are on record for the state of the account at the point of transfer.
In assuranceCustody transfer and segregation of duties
Documented handover of control ownership; dual authorisation at the point of change.
ISO/IEC 27001 A.5.3COSO
On a unitDangerous goods and transport safety
Classifying, documenting and moving regulated cargo under statutory requirements, with named competent persons.
The controlLegal obligations attach to the movement itself, and the evidence of compliance is created by the people doing the moving.
In assuranceStatutory compliance and chain of custody
Regulated goods handling, competent person regimes and traceable custody records.
CDG / ADRISO 9001 clause 8
On a unitSupervising contractors
Overseeing external parties working on your equipment or in your space, to your standard, on your timeline.
The controlRisk outside the organisation is managed through what the contract requires and what the supervision verifies.
In assuranceThird-party risk and contract governance
Supplier relationship security, performance monitoring and right-to-audit provisions.
ISO/IEC 27001 A.5.19–A.5.22NCSC supply chain
On a unitTechnical publication and data control
Ensuring the version of the document in use is the current one, and that controlled information reaches only those entitled to it.
The controlConfiguration and classification are the same discipline applied to information: the right version, to the right people, with a record of who holds it.
In assuranceInformation classification and access control
Classification schemes, document control, need-to-know access and export control where technical data is involved.
ISO/IEC 27001 A.5.12ECJU code of practice
On a unitWrite-off and exception authority
Losses and discrepancies above a threshold cannot be cleared locally, and must be authorised at a defined level.
The controlMateriality decides who is allowed to make the decision, and the escalation itself creates the audit trail.
In assuranceDelegated authority and exception reporting
Authority matrices, materiality thresholds and escalation routes for exceptions.
COSOScheme of delegation
On a unitRemedial action tracking
Findings from an inspection are assigned an owner and a date, and are followed up until they are closed.
The controlA finding that is recorded but never closed is not a control. Closure has to be evidenced by someone other than the person who caused it.
In assuranceCorrective action and finding closure
Root cause analysis, corrective and preventive action and management review of open findings.
ISO 19011ISO 9001 clause 10
On a unitSustaining output under disruption
Keeping a platform supported when the supply chain, the schedule or the manning does not do what the plan assumed.
The controlContinuity is tested by the disruption, not by the plan. The measure is what degraded gracefully and what stopped.
In assuranceOperational resilience and continuity
Business continuity management, impact tolerance and single-point-of-failure analysis.
ISO 22301Operational resilience
Limits of this table
It is a translation aid for people describing their own experience. It is not a compliance mapping, and no organisation should treat a row here as evidence that a requirement has been met. The frameworks named are pointers to where the equivalent control is written down, not claims of conformity.
It also runs one way. Knowing that a handover certificate is a custody transfer control does not mean a logistician can walk into an internal audit function, any more than an auditor could run a stores account. What it means is that the underlying reasoning transfers, and that the training gap is usually narrower than either side assumes.
A caution applies to my own argument: naming a control is no evidence that it worked, and a record can differ from the reality it describes. The table helps someone ask better questions about their own experience and gives no licence to assert more.
How to use it
Recognition before retraining
FIRSTRecord what was done
Scope, scale, complexity, decision-making authority and consequence of failure. Not the job title, and not the course attended. What the accountability was, and what happened if it went wrong.
THENFind the reference point
Map that against a published standard, control model or competency framework. The right column is a starting set. The point is to find the language the target sector already uses, not to adopt mine.
ONLY THENChoose the training
Identify the gaps that are real, as opposed to gaps in vocabulary, and close those. A qualification should open a door. It should not shrink the room behind it.