An organization should evaluate whether the program is flexible and adapts to new requirements and changes in the business environment, context, structure, etc. For example, if the organization acquires another business, can new organizational entities, jobs, key assets, business processes, risks, responses, and controls be quickly integrated into the program?

The program should respond to noncompliance as quickly as possible to minimize negative impacts. Management should strive to process program transactions rapidly to reduce transaction lag time and cycle time.