Controls and control testing

The problem it solves

A control list without owners and testing is an inventory, not a programme. When an assessor asks how a control operates, the answer is usually reconstructed from memory by whoever happens to be available.

How it works

1. 1

   Describe the operating expectation

   Each control records what it does, how frequently it operates and what a satisfactory result looks like. That description is the reference point for every later test.

2. 2

   Assign accountable ownership

   Ownership sits with a person, not a team inbox. Owners see what they are responsible for and when the next review falls due.

   • Named owner with review cadence per control
   • Implementation status maintained against the described expectation
   • History retained when a control description or owner changes
3. 3

   Test and record the result

   Test results are recorded against the control with the tester, the date and the evidence examined. Failures create remediation items instead of disappearing into a report.

Capabilities

What people remain responsible for

• Approving control descriptions and operating expectations
• Performing and signing off control tests
• Deciding whether a deficiency is remediated or accepted