Start with scope
Suggested assurance workflow. Set the scope, criteria and degree of independence appropriate to the organisation and the specific risk.
Define the question before choosing the sample
Name the objective, the risk and the control that should address it. State whether you are reviewing design, implementation or operation over a period.
Write the expected action, responsible role, frequency or trigger, output and test criteria. A document alone cannot answer every one of these questions.
Working output: A scoped test plan and explicit criteria.
Select evidence that can answer it
Identify the population and time period. Choose a proportionate sample and explain how it was selected and what it may miss.
Request actual operating evidence with dates and permitted access. Record unavailable or inconsistent evidence as a limitation rather than a pass.
Working output: A sample record with reliable evidence references.
Record findings with their limits
Compare what happened with the criteria. Distinguish a design weakness, a failure in use and an evidence gap.
Describe the consequence and cause where supported. Do not generalise beyond the period, population or information examined.
Working output: A reasoned finding and an explicit assurance limit.
Assign the action and plan the retest
Make the corrective outcome specific, with an owner, resources and a realistic planning date.
Record claimed completion separately from the retest. Review the new evidence before closing, and escalate unresolved material issues through the relevant authority.
Working output: An owned action and a recorded verification outcome.
Guidance and underlying sources
- Test controls and keep an evidence trail — includes the primary sources and applicability limits.
- From a control list to board assurance — includes the primary sources and applicability limits.
- Build a risk register that supports decisions — includes the primary sources and applicability limits.