Start with a control you can explain.

Test: Select significant commitments from a defined period; compare the approval date and decision-maker with the authority record, then trace any conditions to follow-up evidence. Record selection limits.

Suggested operating trigger: a commitment reaches an agreed approval threshold or falls outside an existing delegation.

Possible failure: The commitment predates approval, the approver lacks recorded authority or an approval condition has no follow-up.

Test: Choose decisions involving a declared interest; compare declarations, attendance and minutes with the applicable process. Identify omissions without inferring that absence of a declaration proves absence of a conflict.

Suggested operating trigger: a significant decision, a newly disclosed interest or a change affecting a previously recorded interest.

Possible failure: A disclosed interest is absent from the decision record or the treatment of participation cannot be explained.

Test: Choose a policy changed during the review period; trace one substantive change from the identified problem through approval, communication and subsequent use. Keep document and implementation findings separate.

Suggested review trigger: a service or system change, repeated workaround, incident finding or the organisation's chosen review point.

Possible failure: Staff use a superseded version or the revised instruction still cannot be followed in the actual process.

Test: Select recorded threshold breaches and exceptions; compare the response with the escalation rule and inspect whether conditions and expiry were reviewed. Record breaches found outside the exception log.

Suggested operating trigger: an agreed limit is approached or exceeded, or an exception is nearing expiry.

Possible failure: An exception expires without review or the limit is retrospectively increased without a recorded decision.

Test: Choose a material risk from a board pack; trace its reported status to underlying evidence and compare unresolved findings with the decisions and actions recorded. Note untested coverage.

Suggested review trigger: the agreed oversight meeting, a material control failure or a significant change in exposure.

Possible failure: A favourable status has no traceable evidence or a material unresolved finding is omitted from the decision pack.

Test: Select actions marked complete, including consequential findings; inspect whether the evidence demonstrates the agreed outcome and whether retesting occurred before closure. Identify claimed fixes awaiting verification.

Suggested operating trigger: an owner requests closure or a previously completed action fails in use.

Possible failure: A closed action contains only an assurance statement, or the cited retest happened before the change was implemented.

Test: Select a critical supplier added or renewed during the period; trace a material assurance claim to its source and inspect whether approval conditions were resolved or explicitly accepted.

Suggested operating trigger: selection, renewal, a material subcontractor change or repeated service failure.

Possible failure: The assurance covers a different service or an unresolved dependency is missing from the approval decision.

Test: Choose access changes and a sample of current accounts, including changed roles; compare authorisation with the access actually present and trace discrepancies to resolution. State coverage limitations.

Suggested operating trigger: a role, supplier or system-access change and the organisation's chosen access-review cycle.

Possible failure: An account's access cannot be connected to a current authorised responsibility or a recorded removal remains unapplied.

Test: Select a claimed successful recovery test; compare the result with its stated objective and inspect the evidence of usable recovery. Identify elements supported only by discussion or assumption.

Suggested review trigger: a significant service or backup change, an unsuccessful test or the chosen recovery-testing programme.

Possible failure: A successful backup job is presented as restoration evidence, or recovered information has not been checked for usability.

Test: Select a material completed change; compare its approved scope with the implemented change and inspect how failed tests, exceptions and approval conditions were handled.

Suggested operating trigger: a material product, AI-use, hosting, supplier or access change before rollout.

Possible failure: The implemented change differs from the approved scope or an unresolved test finding has no accountable decision.

Test: Select risks with reduced residual ratings and risks affected by incidents; trace the change in assessment to current operating evidence and identify any planned controls counted prematurely.

Suggested review trigger: a changed dependency, missed control, incident, near miss or agreed risk-review point.

Possible failure: The residual score is reduced because a control is planned, or a material change leaves the old assessment untouched.

Test: Review an exercise record and follow one observed failure through its action and repeat test. Distinguish demonstrated response capability from an intention to update the plan.

Suggested review trigger: changed response roles or suppliers, an incident lesson or the agreed exercise programme.

Possible failure: Responders cannot locate a fallback decision-maker, or a failed step recurs without evidence of follow-up.

Test: Select consequential register entries; trace each from the recorded source and scope decision to a recent process outcome. Record unclear interpretation and missing evidence separately.

Suggested operating trigger: a new activity or commitment, a source change or the chosen applicability review.

Possible failure: The entry contains only a broad legal title or policy link, with no identifiable outcome or delivery owner.

Test: Select a change marked implemented; follow one affected process through the revised procedure and compare the operating evidence with the planned outcome. Check that source dates and internal targets remain distinct.

Suggested operating trigger: a relevant official-source update or new information affecting the applicability assessment; actual deadlines need separate checking.

Possible failure: The action closes when drafting ends, although the affected system or staff instruction has not changed.

Test: Choose a materially changed activity; compare the actual flow with the recorded description and trace one important safeguard to implementation and testing. Keep the review within its stated scope.

Suggested review trigger: a material change in purpose, scale, information, technology or supplier before the changed activity proceeds.

Possible failure: The assessment describes the old information flow or lists a safeguard for which no implementation evidence can be found.

Test: Select a new or materially changed service; compare its actual activities with the recorded scope rationale and inspect whether unresolved questions reached the appropriate decision-maker.

Suggested operating trigger: a materially different service, relevant technology change or source update affecting the recorded assessment.

Possible failure: The assessment relies only on the business label or imports another sector's guidance without checking relevance.

Test: Choose a trained role and its intended process outcome; compare scenario results with sampled work and inspect follow-up where the same error persists. State the limits of the sample.

Suggested review trigger: induction, a material role or process change, recurring errors or the training cycle selected for the applicable requirements and risks.

Possible failure: Completion is high but staff cannot identify the escalation route or the same work-quality problem remains unaddressed.

Test: Review a completed incident or clearly marked exercise; trace evolving facts to reassessed notification decisions and inspect whether different reporting routes and their timing were kept distinct.

Suggested operating trigger: incident detection or material new facts; urgent applicable duties are checked separately rather than deferred to a scheduled review.

Possible failure: The log uses one unexplained deadline for every reporting route or new facts do not prompt a recorded reassessment.