Drift shows up quietly. A team invents a spreadsheet because the official form is too slow. A supervisor signs batches weekly instead of daily because headcount shrank. The policy still says otherwise. Examiners notice the mismatch long before management does.
Interview the people who perform the control, not only the people who wrote the document. Ask them to show the last time the control ran. If their story and the policy diverge, record both versions without blame—then decide which reality you will standardize.
Rewrite toward the workable practice when it still meets the rule. If the workable practice falls short of the obligation, change the practice first, then the document. Publishing a stricter policy that nobody follows creates fresh findings.
Set a calendar reminder to re-check high-risk procedures after each organizational change. Drift accelerates after mergers, branch openings, and leadership rotations.