Written and reviewed by Angel Montilla · Updated
Control evidence
A policy is a starting point. What evidence shows the control operated?
A written policy explains what should happen. To understand whether a control operated, a reviewer needs to connect that policy to activity during a defined period.
Consider a procedure requiring access to be removed when an employee leaves. The procedure may describe the right roles and timing. It does not, by itself, show what happened for the people who actually left.
Start with a specific question
Instead of asking whether the firm “has access controls,” define the question: was access removed for the selected departures in accordance with the firm’s procedure?
That question establishes the control objective and points to relevant evidence. Depending on the environment, this might include departure records, system access lists, tickets and timestamps. The reviewer should also identify the period covered and how the selected items were chosen.
Separate the possible conclusions
The evidence may support timely removal. It may show a delay. It may also be incomplete, leaving the reviewer unable to establish when removal occurred.
Those are different findings. Missing evidence should not be described automatically as proof that access remained active. Equally, an owner’s assurance that the work was completed should not be presented as a verified result without an appropriate basis.
Document what was examined, what it showed and what remains unknown. This makes the conclusion easier to challenge, validate and act on.
Define what closure will require
An action such as “improve access management” is difficult to close objectively. A more useful action identifies the owner, the affected process and the evidence needed to demonstrate completion.
For a missing removal record, the first step might be to confirm the account’s current status and reconstruct the completion date where possible. A separate improvement may be needed to retain consistent records for future departures.
These actions address different needs: the specific exception and the repeatability of the process.
Keep the conclusion within the scope
A test of selected departures does not establish that every access-related control is effective. Record the systems, period and sample so that readers understand the limits of the result.
The purpose is to give management a defensible view of the work performed and a clear basis for the next decision.
Discuss a control assessment
EXTRIMPA can help define the review questions, examine selected evidence and document findings and follow-up actions.