Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who should test our controls when the team is too small to be independent?

5 decision pointsThe pack behind this answer: Security Control Assurance

Add to board memo

The short answer

Recommendation
Keep the rule that no one tests a control they own, perform, manage or wrote, and look outside the team: a colleague who already checks records, a swap between people or teams, internal audit, then a contracted tester or a peer. Record any owner's own check as a self-check, with the control still untested.
Reasoning
This is the internal audit rule applied to a control test (rule CA-10). In a small organisation the person who knows the controls best usually runs them, so the security lead often tests none of them. A colleague from quality, finance, HR or compliance needs the control's statement, attributes and evidence standards, not security expertise. Someone else must also review every workpaper, or the conclusion is not final (rule CA-11).
Considerations
  • An owner's check is worth doing and can warn you to bring a test forward. It never replaces a planned test because no one else was free.
  • The pack sets no terms of its own for an outside tester. Agree in writing that they have not designed, run or advised on the controls they test, and agree confidentiality.
  • Review within 10 working days of the last test step is the pack's default.
  • If an audit, a regulator or a customer will rely on the testing, confirm with them the independence they expect.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartEvery control needs a tester who neither owns nor performs itStepList who owns, performs, manages and wrote each controlStepName an assurance lead who owns and performs no control in scopeDecisionIs there a colleague in another function who runs none of them?DecisionCan people or teams test each other's controls, never their own?DecisionDo you have internal audit with time to test?DecisionCan you contract a tester, or use a peer from another organisation?StepAssign the tester and record which option you usedDecisionIs there a reviewer who did not do the test?OutcomeTest it, and have the reviewer sign within 10 working daysOutcomeNot final: find a reviewer before you report a resultStepRecord any owner's check as a self-check: the control stays untestedOutcomeTake a proposal for an independent tester to the assurance sponsor

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 13 steps.

  1. Start

    Every control needs a tester who neither owns nor performs it

    This is P08's rule that internal auditors must not audit their own work, applied to a control test, as the maturity pack applies it to an assessment. In a small organisation the person who knows the controls best usually runs them. The Head of Information Security owns most of the security controls, and so tests none of them.

    In the pack

  2. Step

    List who owns, performs, manages and wrote each control

    A control is your own if you own it, carry it out, manage the people who carry it out day to day, or wrote the procedure it follows. Anyone in any of those positions for a control may not test it. The performer shows the tester the records and takes no other part in the test.

    In the pack

  3. Step

    Name an assurance lead who owns and performs no control in scope

    The lead keeps the inventory and the plan, assigns testers and reviews the workpapers they did not write, so every workpaper has someone independent to review it. A quality and compliance manager, a risk manager or internal audit often fits.

    In the pack

  4. Decision

    Is there a colleague in another function who runs none of them?

    A colleague who already checks records, such as a quality, finance, HR or compliance manager, is often the best choice. They need the control's statement, its attributes and the evidence standards, not security expertise. Someone who asks to be shown the record and waits for it often finds more than a specialist who already knows the answer.

    In the pack

  5. Decision

    Can people or teams test each other's controls, never their own?

    Where controls are split between people or teams, such as the security team and the IT team, each can test the other's. Check the swap against your list: no one tests a control they own, perform, manage or wrote.

    In the pack

  6. Decision

    Do you have internal audit with time to test?

    The pack names internal audit as a tester, and as the reviewer of the assurance lead's own tests. If you have no internal audit function, or it cannot take the work this cycle, answer No.

    In the pack

  7. Decision

    Can you contract a tester, or use a peer from another organisation?

    P20 sets no terms of its own for an outside tester; the audit and maturity packs' terms fit. Agree in writing that they have not designed, run or advised on the controls they test, keep a record of their competence, and agree confidentiality and what happens to the evidence at the end. A consultant who helped build a control should not test what they built.

    In the pack

  8. Step

    Assign the tester and record which option you used

    Record on the workpaper that the tester and the reviewer have both checked their independence. Brief a tester from outside security on the control's statement, attributes and evidence standards. The performer shows the records and takes no other part; the owner never chooses the sample. The same rule applies to a retest after a deficiency is fixed.

    In the pack

  9. Decision

    Is there a reviewer who did not do the test?

    Someone other than the tester reviews every workpaper. The assurance lead reviews the tests they did not write; where the lead tests, someone else reviews, such as internal audit. If no one is lined up, take the cautious branch.

    In the pack

  10. Outcome

    Test it, and have the reviewer sign within 10 working days

    The pack's default is review within 10 working days of the last test step. The conclusion is final only when the reviewer signs, and any deficiency is confirmed that day.

    In the pack

    See also

  11. Outcome

    Not final: find a reviewer before you report a result

    A workpaper still unsigned 10 working days after the last test step is overdue, and the dashboard counts the control as untested. The tester raises it with the assurance lead. Who reviews instead is your decision; the pack names internal audit as the reviewer of the lead's own tests.

    In the pack

  12. Step

    Record any owner's check as a self-check: the control stays untested

    An owner who checks their own control is doing their job, and it is worth doing. It is not a test. Record it with who made it, keep the control untested in the inventory and on the dashboard, and use what it found: an exception the owner found is a warning to bring the test forward.

    In the pack

  13. Outcome

    Take a proposal for an independent tester to the assurance sponsor

    Never let a self-check replace a planned test because there was no one else to do it. The assurance lead escalates to the sponsor with a proposal: a colleague from another function, internal audit or a contracted tester.

    In the pack

    See also

Practical checklist

  1. List who owns, performs, manages and wrote each control.
  2. Name an assurance lead who owns and performs no control in scope.
  3. Try a colleague from another function, then a swap, then internal audit, then a contracted tester or peer.
  4. Brief a tester from outside security, and keep the performer to showing the records.
  5. Line up a reviewer who did not do the test before reporting any result.
  6. Record an owner's own check as a self-check, and keep the control untested.
  7. Take a proposal for an independent tester to the assurance sponsor where none is available.

Evidence to have ready

  • The workpaper recording the tester, the option used and both tester's and reviewer's independence checks.
  • The written terms with any outside tester.
  • The reviewer's signature and date on every workpaper.
  • Self-checks recorded as such, with the control shown untested on the dashboard.

Assumptions

  • Each control has a written statement and a list of attributes, so a tester who is not a security specialist can check it against the records.
  • A member of management sponsors control testing and can ask colleagues outside security to give time to it.
  • This is testing for your own assurance. If an audit, a regulator or a customer will rely on it, confirm with them the independence they expect.

Not covered here