Governance and Control
What Governance and Control covers
Governance is how an organisation keeps its automation estate safe, auditable, and aligned to business risk. Candidates must understand role-based access control (roles and permissions for designers, controllers, and administrators), the audit trail of changes, and the separation of duties between build and release approval. Also understand operational controls: queue monitoring, exception review, scheduled health checks, and incident escalation.
Key concepts to name: change control with documented approvals, version history and rollback, credential management and rotation, data protection for any personal data handled by processes, and the retention of logs for audit. Governance also covers the design standards an organisation enforces - naming conventions, mandatory error handling, and review gates before a process reaches production.
Traps in questions
Common traps: giving designers production release rights (violates separation of duties), allowing credentials to be stored in process data, skipping audit review because "the robot works", and treating exception queues as a technical detail rather than a business control. Questions may also test whether a change can be made without a new release: configuration via environment variables is acceptable; logic changes are not.
Rule of thumb
Every change should be traceable to an approved request, made by an authorised role, tested, and released through a controlled path. If you cannot answer "who changed this, when, and who approved it", the control is missing. Exception queues should be owned by a named business function with a defined review cadence, not left unmonitored.