Separate control design from operating effectiveness
Assess whether a control could address its objective separately from whether it operated consistently during the reviewed period.
Review design
- Compare the stated activity to the control objective.
- Record inadequate, partial, adequate or unknown design.
Review operation
- Use observed execution rather than policy existence.
- Inconsistent operation stays distinct from not operating.
Avoid overstatement
- Adequate design does not establish operation.
- A passing test supports only its stated period and sample.
Retain the assurance record
The Control Assurance & Audit Evidence Studio keeps scope, criteria, controls, tests, findings, remediation, attestations and decisions connected. It supports human review but does not certify an organization, issue an audit opinion or change an external system.