Map the question before you map the control
Control catalogues expand when teams invent rows for every possible risk. Reviewers do not ask for infinite rows. They ask whether you can answer a set of questions with owners and evidence.
Before building another matrix, list the questions that matter for the next review cycle. For each question, name the workflow that produces the answer, the system that stores it, and the person who can speak to exceptions. Empty cells are useful — they show real gaps. Decorative cells that cite a policy without a living path are not.
Our regulatory control mapping work follows that order: questions first, then controls, then evidence. If you are staring at a sprawling spreadsheet, get in touch and we will help you cut it back to what a review can actually test.