CGOV.17:5.2 - Distinguish distributed guidance from shared practice

In this constructed case, a professional association distributes a revised procedure for reporting control exceptions. Eight companies download it. The association has permission to examine two companies’ uses; confidentiality prevents observation in the others.

In the first company, an exception reaches the audit committee through an existing authorized channel and changes the requested follow-up. In the second, the supplied rules require this type of exception to reach the audit committee. Staff complete the form but send it only to the executive whose activity is questioned. An independent reporting channel is already authorized but staff cannot access it.

The immediate repair in the second company is access to the authorized channel, followed by its use. Adopting another code or repeating the form-filling lesson does not supply that access.

The association can describe distribution to eight companies and the observed uses in two. It cannot infer the other six companies’ practice or an improvement in their performance. A company seeking local adoption still applies its own governing conditions.