Read with the right scope
An adaptable control-review method. This is not an audit opinion, certification standard or prescribed sampling method. The Central Government's Assurance Directory is a public-sector reference with its own scope.
Status: Implementation guide · official sources checked 1 November 2026
Define the question before collecting files
A folder containing a policy, a screenshot and a training slide deck is not yet a conclusion about effectiveness. Decide what you need to establish. Does the control address the risk? Was it applied to the relevant transactions or events? Did an exception receive the required response? These questions need different evidence.
HM Treasury's assurance directory helps public bodies navigate existing standards and guidance; it does not itself create new requirements. Its emphasis on selecting relevant questions is a useful reminder to begin with applicability and purpose. The practical review sequence below is GRC.me.uk's suggested method.
Write a testable control description
Describe who performs the control, what they check, when it occurs, how the result is retained and who handles exceptions. 'Invoices are reviewed' is difficult to test. 'The budget owner approves invoices against an authorised order before payment, with mismatches escalated to finance' gives the reviewer a clearer basis for inquiry.
Record whether a control aims to prevent an event, detect it, or support recovery afterwards. Identify automated and manual steps separately where their evidence or failure modes differ. Confirm who can change an automated rule and how that change is authorised.
Choose evidence and explain the limits
Set the period, population and selection method before examining results. A small sample may expose a weakness but cannot automatically establish that every transaction was handled correctly. Explain why the sample was chosen and avoid extrapolating beyond what the work supports. Interviews describe a process; records and observation can help test whether it operated.
- Design check: compare the procedure with the risk and obligation it is intended to address.
- Operation check: inspect selected records for the required check, timing, approval and exception handling.
- Evidence check: record the source, date, coverage, access restrictions and any authenticity or completeness limitations.
- Conclusion: distinguish effective, exceptions found, not tested and insufficient evidence. Do not turn an untested control green.
Turn findings into verifiable actions
Describe the gap, its consequence and the owner who can remedy it. Agree a due date and completion evidence. Keep 'implemented, awaiting verification' separate from 'verified complete'. Where an exception is accepted, record who approved it, the reason, expiry and any temporary safeguard.
For the next review, retain the test plan, sample references, factual findings, management response and retest outcome in an approved location. Use references rather than duplicating sensitive personal or client records unnecessarily. Access and retention should follow the organisation's own obligations and policies.
Put the guide to work
Start with the evidence.
- A control description naming the performer, trigger, check, output and exception route.
- The test period, population and sample rationale set before inspecting results.
- Selected record references showing timing, review and handling of exceptions.
- Factual findings, management response and a separate record of remediation and retesting.
Your first three steps
- Write the precise question the test should answer about one control.
- Select records from a defined period and explain the selection and its limits.
- Record the observations before assigning a conclusion, then specify what a successful retest would demonstrate.
Common gaps to look for
- An interview or screenshot is taken as proof of operation across a period.
- Only convenient examples are selected without explaining the limitation.
- Missing evidence is converted into a pass.
Review when: Retest after remediation or when the process, automated rule, control owner or source evidence changes materially.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the risk guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- HM Treasury — Quick Guide to the Central Government's Assurance Directory ↗Source checked 1 November 2026 · Primary source
- HM Treasury — Orange Book publication and current supporting documents ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.