diff --git a/parser/src/control.rs b/parser/src/control.rs
index 31e2c9f..7147757 100644
--- a/parser/src/control.rs
+++ b/parser/src/control.rs
@@ -56,7 +56,7 @@ impl Controller {
         Ok(rmp_serde::from_slice(input)?)
     }
     // return the OG message for further processing
-    pub fn handle(&mut self, input: &[u8]) -> anyhow::Result<(Vec<u8>, ControlMessage)> {
+    pub fn handle(&mut self, input: &[u8]) -> anyhow::Result<(ControlMessage, ControlResponse)> {
         let msg_nonce = self.parse_msg_no_nonce(input)?;
         let msg = msg_nonce.0;
         // nonce must be higher each time
@@ -110,8 +110,7 @@ impl Controller {
                 ControlResponse::OtaConfirm(params)
             }
         };
-        let response = self.build_response(res)?;
-        Ok((response, msg))
+        Ok((msg, res))
     }
 }
 
diff --git a/sphinx-key/src/core/events.rs b/sphinx-key/src/core/events.rs
index ddc8d3a..4b16e64 100644
--- a/sphinx-key/src/core/events.rs
+++ b/sphinx-key/src/core/events.rs
@@ -111,7 +111,9 @@ pub fn make_event_loop(
             Event::Control(ref msg_bytes) => {
                 log::info!("GOT A CONTROL MSG");
                 let cres = ctrlr.handle(msg_bytes);
-                if let Some(res_data) = handle_control_response(&root_handler, cres, network) {
+                if let Some(res) = handle_control_response(&root_handler, cres, network) {
+                    let res_data =
+                        rmp_serde::to_vec(&res).expect("could not publish control response");
                     mqtt.publish(topics::CONTROL_RETURN, QOS, false, &res_data)
                         .expect("could not publish control response");
                 }
@@ -124,43 +126,47 @@ pub fn make_event_loop(
 
 fn handle_control_response(
     root_handler: &RootHandler,
-    cres: anyhow::Result<(Vec<u8>, ControlMessage)>,
+    cres: anyhow::Result<(ControlMessage, ControlResponse)>,
     network: Network,
-) -> Option<Vec<u8>> {
+) -> Option<ControlResponse> {
     match cres {
-        Ok((mut response, parsed_msg)) => {
+        Ok((control_msg, mut control_res)) => {
             // the following msg types require other actions besides Flash persistence
-            match parsed_msg {
+            match control_msg {
                 ControlMessage::UpdatePolicy(new_policy) => {
                     if let Err(e) =
                         sphinx_key_signer::set_policy(&root_handler, network, new_policy)
                     {
                         log::error!("set policy failed {:?}", e);
+                        control_res = ControlResponse::Error(format!("set policy failed {:?}", e))
                     }
                 }
                 ControlMessage::UpdateAllowlist(al) => {
                     if let Err(e) = sphinx_key_signer::set_allowlist(&root_handler, &al) {
                         log::error!("set allowlist failed {:?}", e);
+                        control_res =
+                            ControlResponse::Error(format!("set allowlist failed {:?}", e))
                     }
                 }
                 // overwrite the real Allowlist response, loaded from Node
                 ControlMessage::QueryAllowlist => {
-                    if let Ok(al) = sphinx_key_signer::get_allowlist(&root_handler) {
-                        response = rmp_serde::to_vec(&ControlResponse::AllowlistCurrent(al))
-                            .expect("couldnt build ControlResponse::AllowlistCurrent");
-                    } else {
-                        log::error!("read allowlist failed");
+                    match sphinx_key_signer::get_allowlist(&root_handler) {
+                        Ok(al) => control_res = ControlResponse::AllowlistCurrent(al),
+                        Err(e) => {
+                            log::error!("read allowlist failed {:?}", e);
+                            control_res =
+                                ControlResponse::Error(format!("read allowlist failed {:?}", e))
+                        }
                     }
                 }
                 _ => (),
             };
-            Some(response)
+            Some(control_res)
         }
         Err(e) => {
-            let response = rmp_serde::to_vec(&ControlResponse::Error(e.to_string()))
-                .expect("couldnt build ControlResponse::Error");
+            let control_res = ControlResponse::Error(e.to_string());
             log::warn!("error parsing ctrl msg {:?}", e);
-            Some(response)
+            Some(control_res)
         }
     }
 }
diff --git a/tester/Cargo.toml b/tester/Cargo.toml
index 0db665b..9776d48 100644
--- a/tester/Cargo.toml
+++ b/tester/Cargo.toml
@@ -25,6 +25,7 @@ serde_json = "1.0"
 urlencoding = "2.1.0"
 dotenv = "0.15.0"
 rocket = "0.5.0-rc.2"
+rmp-serde = "1.1.0"
 
 [[bin]]
 name = "config"
@@ -36,4 +37,4 @@ path = "src/server.rs"
 
 [[bin]]
 name = "ctrl"
-path = "src/ctrl.rs"
\ No newline at end of file
+path = "src/ctrl.rs"
diff --git a/tester/src/main.rs b/tester/src/main.rs
index 918efc9..37f75b7 100644
--- a/tester/src/main.rs
+++ b/tester/src/main.rs
@@ -101,13 +101,14 @@ async fn main() -> Result<(), Box<dyn Error>> {
                                 }
                                 topics::CONTROL => {
                                     match ctrlr.handle(&msg_bytes) {
-                                        Ok((response, _new_policy)) => {
+                                        Ok((_msg, res)) => {
+                                            let res_data = rmp_serde::to_vec(&res).expect("could not publish control response");
                                             client
                                                 .publish(
                                                     topics::CONTROL_RETURN,
                                                     QoS::AtMostOnce,
                                                     false,
-                                                    response,
+                                                    res_data,
                                                 )
                                                 .await
                                                 .expect("could not mqtt publish");
@@ -158,13 +159,14 @@ async fn main() -> Result<(), Box<dyn Error>> {
                                 }
                                 topics::CONTROL => {
                                     match ctrlr.handle(&msg_bytes) {
-                                        Ok((response, _new_policy)) => {
+                                        Ok((_msg, res)) => {
+                                            let res_data = rmp_serde::to_vec(&res).expect("could not publish control response");
                                             client
                                                 .publish(
                                                     topics::CONTROL_RETURN,
                                                     QoS::AtMostOnce,
                                                     false,
-                                                    response,
+                                                    res_data,
                                                 )
                                                 .await
                                                 .expect("could not mqtt publish");