We hear it from customers again and again.

Usually from someone senior. Sometimes, a little shyly.

These are not sloppy companies. Some of them run thousands of controls across dozens of domains and jurisdictions. They have whole teams whose job is control design. And still, put the heads of HR, Security, Finance, Legal, and Audit in one room, ask them to list the controls the company has to have, and you get five lists that don’t match.

Why it happens

The reason is simple. Every department starts from a different document and a different data set.

HR starts from the employee handbook and the HR system. Security starts from its standards and the directory. Finance starts from SOX narratives and the ERP. Legal starts from contract clauses. Audit starts from last year’s findings.

Same objective. Different starting point. Different vocabulary. Different owner. So the same control gets written five times, in five dialects, by people who never read each other’s version.

One control, six ways

Take a new hire who needs access to a customer-facing system. Here is what that one event looks like from six desks.

HR’s policy says the background check must clear before the start date. It lives in the handbook. The evidence sits in the HR system.

Security’s standard says accounts are set up on least privilege, approved by the manager. It lives in the access management standard. The evidence sits in the directory and the ticketing system.

Finance’s SOX control says no single user can both create a vendor and approve a payment. It lives in the risk and control matrix. The evidence sits in ERP role reports.

Legal’s customer contract says people with access to client data must be screened and trained before access is granted. It lives in a security addendum that nobody outside Legal has read.

Privacy’s policy says access to personal data is limited to need. It lives in the privacy program.

Audit’s finding from last year says 40 leavers still had active accounts. It lives in a remediation tracker.

Six documents. Six names for the same thing: screening, provisioning, segregation of duties, personnel security, need to know, access recertification. Six places to look for evidence.

Underneath it all is one idea. The right people get the right access, and nobody else does.

What it costs

Three things go wrong.

The six definitions quietly disagree. HR says screen before the start date. The contract says screen before access. A contractor with day-one access falls through the gap, and nobody owns the gap because nobody owns the comparison.

The company proves the same thing six times. A customer asks for evidence. An auditor asks. A regulator asks. Each gets a different answer from a different department, and each department pulls its own evidence from its own system.

And when something new lands, a consent order or a big customer’s security schedule, it becomes a seventh version. Nobody checks it against the first six, because there is no “first six” to check against. There are six separate files.

How you fix it

You can’t fix this by picking a winning department. Legal won’t adopt HR’s wording and Security won’t adopt Finance’s. You can’t fix it by moving every document into one tool either. The documents are fine where they are.

You fix it with two things.

First, one common set of controls that every department agrees to. Not HR’s version or Security’s version. A neutral set, written once, that every document maps to. The handbook maps to it. The contract maps to it. The SOX matrix maps to it. Each in its own words, all landing on the same controls. So when you implement a control once and prove it works, you’ve satisfied every document that demanded it. Comply once, satisfy many.

Second, the ability to compare any document against any other and see where they overlap and where they leave gaps. The customer contract against the security standard. Last year’s audit finding against all of them.

The documents stay in their silos. The control set becomes the shared language, and the comparison is how you settle the argument.

What changes

The argument gets short. Departments stop arguing about objectives and start arguing about wording, which is a solvable argument.

Put the six documents side by side and the picture is simple. Where they agree, it’s one control, proven once. Where they disagree, it’s a gap with a name on it. Where one document demands something the others don’t, that remainder is the only new work.

A new contract lands and you compare it to the control set, not to the other contracts. Most of what it demands you already do. You only work on the rest.

And you can answer the question nobody could answer before. What, in total, do we have to prove?

The filing problem

So when someone tells us “we can’t even agree on our own controls,” we don’t hear a governance failure. We hear five departments, each filing the same obligation under a different name, with no shared place to lay them side by side.

You don’t have a control disagreement. You have a filing problem.