Annual Control Testing Plan

Schedules tests across the year by control risk, audit calendar and resource availability.

Available soon

Format: Excel
Size: 105 KB
Length: 12 sheets
Version: 1.0
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Cycle Rules
Controls
Plan
Next Year
Calendar
Lists
Definitions
Framework References

What changed

1.02 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	On the Cycle Rules sheet, enter the day the plan year starts, the testing capacity in days a month and the effort settings. The values given are EXAMPLE figures; use your own.
2	Check the cycles and sample bands on the Cycle Rules sheet (CA-05, CA-15). You may raise a sample or shorten a cycle, never the reverse. Under "Tests before this plan", list each control's last test, its period and conclusion. An owner's self-check is not a test (CA-10): leave it out.
3	On the Controls sheet, copy each control from the Control Inventory & Ownership Register: name, frequency, runs a year, owner, key or not, risk rating and why it is Higher.
4	For each Lower control, choose this plan year or the next, about half in each. Where an audit or review relies on a control, choose it in "Relied on by".
5	On the Calendar sheet, list the year's audits, reviews and board meetings. Each that relies on test results gets a cut-off 6 weeks before it (CA-16).
6	On the Plan sheet, add one row per test: month, control, kind (Operating, Design and Retest), tester and reviewer. Place the tests an audit relies on first: each must be final, its month's end plus the reviewer's 10 working days (CA-11), by the cut-off. Then spread the rest within capacity.
7	Give each Higher control two tests six months apart. Plan a retest only once the fixed control has run enough to sample (CA-14), and enter when it began to run in "Period starts no earlier than", as for a new control.
8	Choose testers who own and perform none of the controls they test (CA-10), and reviewers who neither tested nor own the control (CA-11). The Independence column checks against the owner only; check performers yourself.
9	Plan a design check (kind Design) before a control's first operating test, at least every [[12]] months, and after it changes (CA-02).
10	Clear every Check on the Controls and Plan sheets that does not say OK, and every month over capacity on the Calendar sheet.
11	The assurance sponsor approves the plan before the year starts (CA-16). Record the approval, and every later change, at the foot of the Calendar sheet.
12	Draft next year's plan on the Next Year sheet, starting with the Lower controls left for year two.
13	To clear the EXAMPLE, delete the EXAMPLE rows and entries on every sheet. The formulas stay.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Rule CA-15: "Each control is rated Higher, Standard or Lower risk, and tested at least every 6, 12 or 24 months respectively. A control never tested is due within one cycle of the start of the first plan year, or of the day it started if that is later; one whose design was found deficient, within one cycle of the day its design is found adequate. A key control is never Lower, and a control that failed its last test is Higher until a retest passes."

Rule CA-16: "The sponsor approves the year's test plan before it starts, and any change to it is recorded. Tests that an audit, a supervisory review or a customer review will rely on are final at least [[6]] weeks before it starts."

This document helps you test whether your security controls work. It is not legal advice, and a test result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law, a certification or a contract asks for an audit or an independent review, confirm with counsel, your certification body or the other party what it must include.

Control testing is not an internal audit, a certification audit, a P19 maturity assessment or a statement of compliance, and is never presented as one. Its results can feed each of them.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its control assurance lead, the Quality and Compliance Manager, owns no control; the Internal Audit Manager reviews the lead's. The pilot, TR-2026-P, tested 2026-03 to 2026-08. The Chief Operating Officer approved this plan for 1 Oct 2026 to 30 Sep 2027 on 30 Sep 2026. The largest customer's security review on 14 Jun 2027 relies on 5 controls.

Tailoring — small organisation: keep each control's cycle, and find a tester outside the function that owns it: a colleague from finance or operations, internal audit, or a contracted tester. Two people can test each other's controls, never their own.

Tailoring — regulated entity (NIS2, DORA): keep each approved plan and its changes, and share the plan with your internal auditors so their audit can draw on the tests. It is not their audit plan (CA-18).

Tailoring — IT run by a service provider: a control the provider runs is still yours to test. Agree in the contract that your tester can take populations and evidence from its systems.

This workbook is your own record. Keep it with the control inventory, the workpapers and the deficiency tracker.

Cycle Rules

Cycle rules and settings

The settings the plan calculates from, how often each rating is tested, the sample for each population, how each test's period is worked out, and each control's last test before this plan. Yellow cells are yours; EXAMPLE values show a completed plan.

Plan year starts	1 Oct 2026	EXAMPLE: the first day of the plan year. The sponsor approves the plan before it (CA-16).
Plan year ends (calc)	30 Sep 2027	Twelve months on.
Next plan year ends (calc)	30 Sep 2028	The Next Year sheet drafts the year after.
Weeks before an audit or review that relies on tests	6	CA-16. The pack's default; you may lengthen it.
Testing capacity (days a month)	6	EXAMPLE: the days a month your testers can give to testing, all testers together.
Hours in a testing day	7.5	EXAMPLE value; set your own. Turns the capacity in days into hours.
Set-up and write-up hours per test	4	EXAMPLE value; set your own. Taking and checking the population, choosing the sample, the workpaper and the review notes.
Hours per sampled item	0.5	EXAMPLE value; set your own. Finding and inspecting the evidence for one sampled occurrence, every attribute.
Reviewer signs within (working days)	10	CA-11. A test is final when the reviewer signs: its month's end plus these working days.
Testing capacity (hours a month) (calc)	45	Days a month times hours in a day. The Calendar compares each month's estimated hours with it.

How often each rating is tested (CA-15)

Rating	Test at least every (months)	Sample column	Tests in a plan year (calc)	When a control has this rating
Higher	6	Higher	2	A key control on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests; or a control that failed its last test.
Standard	12	Standard	1	Any other key control.
Lower	24	Standard	1 every 2 years	A control that is not key. Its design is still checked every 12 months (CA-02).

A key control is never Lower, and a control that failed its last test is Higher until a retest passes (CA-15). Lower controls take the Standard sample column. A Lower control's design is still checked every [[12]] months (CA-02).

The sample for each population (CA-05)

Occurrences in the period, from	to	Standard and Lower	Higher	Typical control
1	2	All	All	An annual control, or a quarterly one tested over six months
3	12	2	3	A quarterly or monthly control
13	52	5	10	A weekly control, or events a few times a month
53	250	20	30	A daily control, or events most working days
251	or more	25	40	A control that runs many times a day

"All": test every occurrence, as when the population is no larger than the sample (CA-05). The tester takes the real population from the system of record (CA-04).

How each test's period is worked out (CA-06)

Step	Rule
1	It ends on the last day of the month before the test's month.
2	It starts the day after the last tested period ended: an earlier row on this plan, or a test below concluded Effective and Not effective.
3	It never starts more than one test cycle before it ends (CA-06). A control never tested starts there.
4	It never starts before "Period starts no earlier than": when the control started, or a fixed control began to run (CA-14).
5	The latest of steps 2, 3 and 4 is the start. A design check has no period: it walks one occurrence through (CA-02).

Final by: a test is final when its reviewer signs (CA-11), so the plan allows 10 working days after its month ends. A test an audit relies on must be final by the audit's cut-off (CA-16).

Tests before this plan

Control ID	Test	Period from	Period to	Design	Operating conclusion
CT-16	EXAMPLE: WP-2026-01	1 Mar 2026	31 Aug 2026	Adequate	Effective
CT-13	EXAMPLE: WP-2026-02	1 Mar 2026	31 Aug 2026	Adequate	Not effective
CT-22	EXAMPLE: WP-2026-03	1 Mar 2026	31 Aug 2026	Adequate	Effective
CT-04	EXAMPLE: WP-2026-04	1 Mar 2026	31 Aug 2026	Adequate	Effective
CT-24	EXAMPLE: WP-2026-05	1 Mar 2026	31 Aug 2026	Adequate	Effective
CT-20	EXAMPLE: WP-2026-06	1 Mar 2026	31 Aug 2026	Adequate	Not tested
CT-02	EXAMPLE: WP-2026-07	1 Mar 2026	31 Aug 2026	Deficient	Not tested

EXAMPLE: the pilot round TR-2026-P, from the Control Test Workpaper Templates. Only a test concluded Effective and Not effective ends a tested period. CT-20 was Not tested: the control started when the Tier 0 accounts went live (P14). CT-02's design was Deficient, so its operation waits for the fix (CA-01).

Controls

One row per control in the Control Inventory & Ownership Register: its rating, how many tests this plan year needs (CA-15), how many are planned, and when the next falls due. Yellow columns are yours. Every status is a word; the colour only repeats it.

Row	Control ID	Control	Frequency	Runs a year	Owner	Key	Risk	Why Higher	Lower: tested in	Relied on by	Cycle in months (calc)	Tests needed (calc)	Tests planned (calc)	Last period ended (calc)	Next test due (calc)	Check (calc)
EXAMPLE	CT-01	Board report from checked figures	Quarterly	4	Head of Information Security	Yes	Standard				12	1	1	30 Nov 2026	30 Nov 2027	OK
EXAMPLE	CT-02	Policy reviews on time	As it falls due	12	Head of Information Security	Yes	Higher	The board recorded NIS2 measure (h), cryptography, as outstanding until its policy is approved (P12, 30 Jul 2026)			6	2	2	30 Jun 2027	30 Dec 2027	OK
EXAMPLE	CT-03	Joiners acknowledge policies	As it happens	120	HR Director	Yes	Standard				12	1	1	30 Sep 2026	30 Sep 2027	OK
EXAMPLE	CT-04	Quarterly risk review	Quarterly	48	Head of Information Security	Yes	Standard				12	1	1	30 Jun 2027	30 Jun 2028	OK
EXAMPLE	CT-05	Exceptions approved and renewed in time	As it happens	10	Head of Information Security	Yes	Standard				12	1	1	30 Sep 2026	30 Sep 2027	OK
EXAMPLE	CT-06	Monthly exception register review	Monthly	12	Head of Information Security	No	Lower		This plan year		24	1	1	30 Nov 2026	30 Nov 2028	OK
EXAMPLE	CT-07	Tier 1 suppliers reassessed in time	As it falls due	14	Information Security Manager	Yes	Higher	R-02, payment fraud through a compromised supplier email account, is outside appetite (P05)			6	2	2	30 Apr 2027	30 Oct 2027	OK
EXAMPLE	CT-08	Metric inputs checked before reporting	Monthly	12	Head of Information Security	No	Lower		This plan year		24	1	1	31 Jan 2027	31 Jan 2029	OK
EXAMPLE	CT-09	NIS2 readiness self-assessed	Every six months	2	Head of Information Security	Yes	Standard				12	1	1	31 Jan 2027	31 Jan 2028	OK
EXAMPLE	CT-10	Board members trained	As it falls due	7	Board secretary	Yes	Standard				12	1	1	30 Apr 2027	30 Apr 2028	OK
EXAMPLE	CT-11	Information register reviewed	As it happens	30	Head of Information Security	No	Lower		This plan year		24	1	1	31 May 2027	31 May 2029	OK
EXAMPLE	CT-12	Disposal certificates collected	As it happens	12	Head of IT	No	Lower		Next plan year		24	0	1			OK
EXAMPLE	CT-13	Urgent vulnerabilities fixed in time	As it happens	70	Head of IT	Yes	Higher	Failed its last test (TR-2026-P)		Customer security review	6	2	2	31 Jul 2027	31 Jan 2028	OK
EXAMPLE	CT-14	Vendor releases reviewed	As it happens	150	Head of IT	No	Lower		Next plan year		24	0	1			OK
EXAMPLE	CT-15	Missed patch deadlines deferred	As it happens	6	Head of IT	Yes	Standard				12	1	1	31 Dec 2026	31 Dec 2027	OK
EXAMPLE	CT-16	Leavers' access removed	As it happens	80	Head of IT	Yes	Standard			Customer security review	12	1	1	28 Feb 2027	28 Feb 2028	OK
EXAMPLE	CT-17	Movers' old access removed	As it happens	40	Head of IT	Yes	Standard				12	1	1	31 Oct 2026	31 Oct 2027	OK
EXAMPLE	CT-18	Monthly account reconciliation	Monthly	12	Head of IT	Yes	Standard				12	1	1	30 Nov 2026	30 Nov 2027	OK
EXAMPLE	CT-19	User access reviews	Every six months	2	Head of Information Security	Yes	Standard			Customer security review	12	1	1	28 Feb 2027	28 Feb 2028	OK
EXAMPLE	CT-20	Privileged access reviewed	Quarterly	4	Head of IT	Yes	Standard				12	1	1	31 Dec 2026	31 Dec 2027	OK
EXAMPLE	CT-21	Break-glass accounts tested and every use reviewed	Quarterly	4	Head of Information Security	Yes	Standard				12	1	1	31 Mar 2027	31 Mar 2028	OK
EXAMPLE	CT-22	Security induction completed	As it happens	120	Information Security Manager	Yes	Standard			Customer security review	12	1	1	28 Feb 2027	28 Feb 2028	OK
EXAMPLE	CT-23	Annual security course completed	As it falls due	900	Information Security Manager	Yes	Standard				12	1	1	30 Jun 2027	30 Jun 2028	OK
EXAMPLE	CT-24	Post-incident review held	As it happens	3	Information Security Manager	Yes	Standard			Customer security review	12	1	1	28 Feb 2027	28 Feb 2028	OK
EXAMPLE	CT-25	Incident response exercised	As it falls due	6	Head of Information Security	Yes	Standard				12	1	1	31 May 2027	31 May 2028	OK
EXAMPLE	CT-26	After-action report approved	As it happens	3	Chief Operating Officer	No	Lower		Next plan year		24	0	1			OK
EXAMPLE	CT-27	Notification readiness checked	Every six months	2	Head of Information Security	Yes	Standard				12	1	1	30 Apr 2027	30 Apr 2028	OK
EXAMPLE	CT-28	Maturity assessed each year	Annual	1	Head of Information Security	Yes	Standard				12	1	1	30 Sep 2026	30 Sep 2027	OK
EXAMPLE	CT-29	Supplier High findings escalated	As it happens	4	Information Security Manager	Yes	Standard				12	1	1	31 May 2027	31 May 2028	OK
EXAMPLE	CT-30	Triggered risk reassessment	As it happens	6	Head of Information Security	Yes	Standard				12	1	1	31 May 2027	31 May 2028	OK

Plan

One row per test, by the month its fieldwork runs. Yellow columns are yours; the control's details, the testing period (CA-06), the population, the sample (CA-05), the hours and the checks calculate.

Row	Month	Control ID	Control (calc)	Owner (calc)	Risk (calc)	Kind	Tester	Reviewer	Period starts no earlier than	Last period ended (calc)	Period from (calc)	Period to (calc)	Runs a year (calc)	Estimated population (calc)	Sample (calc)	Estimated hours (calc)	Final by (calc)	Relied on by	Cut-off check (calc)	Independence (calc)	Note	Check (calc)
EXAMPLE	1 Oct 2026	CT-03	Joiners acknowledge policies	HR Director	Standard	Operating	Information Security Manager	Quality and Compliance Manager			1 Oct 2025	30 Sep 2026	120	120	20	14	13 Nov 2026			Independent		OK
EXAMPLE	1 Oct 2026	CT-05	Exceptions approved and renewed in time	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Oct 2025	30 Sep 2026	10	10	2	5	13 Nov 2026			Independent		OK
EXAMPLE	1 Oct 2026	CT-28	Maturity assessed each year	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Oct 2025	30 Sep 2026	1	1	1	4.5	13 Nov 2026			Independent		OK
EXAMPLE	1 Nov 2026	CT-07	Tier 1 suppliers reassessed in time	Information Security Manager	Higher	Operating	Quality and Compliance Manager	Internal Audit Manager			1 May 2026	31 Oct 2026	14	7	3	5.5	14 Dec 2026			Independent	Higher: first of two	OK
EXAMPLE	1 Nov 2026	CT-17	Movers' old access removed	Head of IT	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Nov 2025	31 Oct 2026	40	40	5	6.5	14 Dec 2026			Independent		OK
EXAMPLE	1 Dec 2026	CT-01	Board report from checked figures	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Dec 2025	30 Nov 2026	4	4	2	5	14 Jan 2027			Independent		OK
EXAMPLE	1 Dec 2026	CT-18	Monthly account reconciliation	Head of IT	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Dec 2025	30 Nov 2026	12	12	2	5	14 Jan 2027			Independent		OK
EXAMPLE	1 Dec 2026	CT-06	Monthly exception register review	Head of Information Security	Lower	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Dec 2024	30 Nov 2026	12	24	5	6.5	14 Jan 2027			Independent		OK
EXAMPLE	1 Jan 2027	CT-02	Policy reviews on time	Head of Information Security	Higher	Design	Quality and Compliance Manager	Internal Audit Manager					12		1	4.5	12 Feb 2027			Independent	DF-02: design re-checked once the register exists. This design check counts as one of CT-02's two Higher tests this year: its operation cannot be tested until the design is fixed (CA-01), so the operating retest in July is the other	OK
EXAMPLE	1 Jan 2027	CT-20	Privileged access reviewed	Head of IT	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager	21 Sep 2026		21 Sep 2026	31 Dec 2026	4	1	1	4.5	12 Feb 2027			Independent	First review due by 21 Dec 2026	OK
EXAMPLE	1 Jan 2027	CT-15	Missed patch deadlines deferred	Head of IT	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Jan 2026	31 Dec 2026	6	6	2	5	12 Feb 2027			Independent		OK
EXAMPLE	1 Feb 2027	CT-13	Urgent vulnerabilities fixed in time	Head of IT	Higher	Retest	Quality and Compliance Manager	Internal Audit Manager	2 Nov 2026	31 Aug 2026	2 Nov 2026	31 Jan 2027	70	17	10	9	12 Mar 2027	Customer security review	Final by the cut-off	Independent	DF-01 retest; Higher: first of two	OK
EXAMPLE	1 Feb 2027	CT-08	Metric inputs checked before reporting	Head of Information Security	Lower	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Feb 2025	31 Jan 2027	12	24	5	6.5	12 Mar 2027			Independent		OK
EXAMPLE	1 Feb 2027	CT-09	NIS2 readiness self-assessed	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Feb 2026	31 Jan 2027	2	2	2	5	12 Mar 2027			Independent		OK
EXAMPLE	1 Mar 2027	CT-16	Leavers' access removed	Head of IT	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager		31 Aug 2026	1 Sep 2026	28 Feb 2027	80	40	5	6.5	14 Apr 2027	Customer security review	Final by the cut-off	Independent	Before the customer review	OK
EXAMPLE	1 Mar 2027	CT-22	Security induction completed	Information Security Manager	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager		31 Aug 2026	1 Sep 2026	28 Feb 2027	120	60	20	14	14 Apr 2027	Customer security review	Final by the cut-off	Independent	Before the customer review	OK
EXAMPLE	1 Mar 2027	CT-19	User access reviews	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Mar 2026	28 Feb 2027	2	2	2	5	14 Apr 2027	Customer security review	Final by the cut-off	Independent	Before the customer review	OK
EXAMPLE	1 Mar 2027	CT-24	Post-incident review held	Information Security Manager	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager		31 Aug 2026	1 Sep 2026	28 Feb 2027	3	1	1	4.5	14 Apr 2027	Customer security review	Final by the cut-off	Independent	Before the customer review	OK
EXAMPLE	1 Apr 2027	CT-21	Break-glass accounts tested and every use reviewed	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Apr 2026	31 Mar 2027	4	4	2	5	14 May 2027			Independent		OK
EXAMPLE	1 Apr 2027	CT-12	Disposal certificates collected	Head of IT	Lower	Design	Quality and Compliance Manager	Internal Audit Manager					12		1	4.5	14 May 2027			Independent	Lower: design checked each year (CA-02); operation tested next year	OK
EXAMPLE	1 May 2027	CT-07	Tier 1 suppliers reassessed in time	Information Security Manager	Higher	Operating	Quality and Compliance Manager	Internal Audit Manager		31 Oct 2026	1 Nov 2026	30 Apr 2027	14	7	3	5.5	14 Jun 2027			Independent	Higher: second of two	OK
EXAMPLE	1 May 2027	CT-10	Board members trained	Board secretary	Standard	Operating	Information Security Manager	Quality and Compliance Manager			1 May 2026	30 Apr 2027	7	7	2	5	14 Jun 2027			Independent		OK
EXAMPLE	1 May 2027	CT-27	Notification readiness checked	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 May 2026	30 Apr 2027	2	2	2	5	14 Jun 2027			Independent		OK
EXAMPLE	1 Jun 2027	CT-25	Incident response exercised	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Jun 2026	31 May 2027	6	6	2	5	14 Jul 2027			Independent		OK
EXAMPLE	1 Jun 2027	CT-29	Supplier High findings escalated	Information Security Manager	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Jun 2026	31 May 2027	4	4	2	5	14 Jul 2027			Independent		OK
EXAMPLE	1 Jun 2027	CT-30	Triggered risk reassessment	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Jun 2026	31 May 2027	6	6	2	5	14 Jul 2027			Independent		OK
EXAMPLE	1 Jun 2027	CT-11	Information register reviewed	Head of Information Security	Lower	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Jun 2025	31 May 2027	30	60	20	14	14 Jul 2027			Independent		OK
EXAMPLE	1 Jul 2027	CT-02	Policy reviews on time	Head of Information Security	Higher	Retest	Quality and Compliance Manager	Internal Audit Manager	1 Feb 2027		1 Feb 2027	30 Jun 2027	12	5	3	5.5	13 Aug 2027			Independent	DF-02 operating retest; Higher	OK
EXAMPLE	1 Jul 2027	CT-04	Quarterly risk review	Head of Information Security	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager		31 Aug 2026	1 Sep 2026	30 Jun 2027	48	40	5	6.5	13 Aug 2027			Independent		OK
EXAMPLE	1 Jul 2027	CT-23	Annual security course completed	Information Security Manager	Standard	Operating	Quality and Compliance Manager	Internal Audit Manager			1 Jul 2026	30 Jun 2027	900	900	25	16.5	13 Aug 2027			Independent		OK
EXAMPLE	1 Aug 2027	CT-13	Urgent vulnerabilities fixed in time	Head of IT	Higher	Operating	Quality and Compliance Manager	Internal Audit Manager		31 Jan 2027	1 Feb 2027	31 Jul 2027	70	35	10	9	14 Sep 2027			Independent	Higher: second of two	OK
EXAMPLE	1 Aug 2027	CT-14	Vendor releases reviewed	Head of IT	Lower	Design	Quality and Compliance Manager	Internal Audit Manager					150		1	4.5	14 Sep 2027			Independent	Lower: design checked each year (CA-02); operation tested next year	OK
EXAMPLE	1 Sep 2027	CT-26	After-action report approved	Chief Operating Officer	Lower	Design	Quality and Compliance Manager	Internal Audit Manager					3		1	4.5	14 Oct 2027			Independent	Lower: design checked each year (CA-02); operation tested next year	OK

Next Year

Next year's draft, with the same columns and formulas. Its periods start where this year's tests end. It starts with the Lower controls left for year two; add the rest as the year goes on.

Row	Control ID	Control (calc)	Owner (calc)	Risk (calc)	Kind	Runs a year (calc)	Independence (calc)	Note	Check (calc)
EXAMPLE	CT-12	Disposal certificates collected	Head of IT	Lower	Operating	12	Name the tester	Lower: left for year two of its 24-month cycle. Choose the month.	Enter the month
EXAMPLE	CT-14	Vendor releases reviewed	Head of IT	Lower	Operating	150	Name the tester	Lower: left for year two of its 24-month cycle. Choose the month.	Enter the month
EXAMPLE	CT-26	After-action report approved	Chief Operating Officer	Lower	Operating	3	Name the tester	Lower: left for year two of its 24-month cycle. Choose the month.	Enter the month

Calendar

Calendar

Where the plan stands; the audits, reviews and board meetings it works to, with each cut-off (CA-16); tests and hours by month against capacity; and the plan's approval and changes. Yellow cells are yours.

EXAMPLE: the distributor's plan for 1 Oct 2026 to 30 Sep 2027.

Where the plan stands

Measure	Value	What it means
Tests planned	33	Rows on the Plan sheet, of every kind.
Controls with a test this plan year	30 of 30	From the Controls sheet.
Lower controls left for next year	3	On the Next Year sheet.
Tests an audit or review relies on, final by its cut-off	5 of 5	CA-16: final at least 6 weeks before it starts.
Tests with an independent tester and reviewer	33 of 33	CA-10 and CA-11: neither owns the control, and the reviewer did not test it.
Months over capacity	0	From the months table below.
Plan rows to resolve	0	Rows on the Plan sheet whose Check does not say OK.
Control rows to resolve	0	Rows on the Controls sheet whose Check does not say OK.
Estimated hours in the plan year	217	All tests together.
Approval	Approved before the year starts	The sponsor approves the plan before the year starts (CA-16).

Audits, reviews and board meetings the plan works to (CA-16)

Name	Date	Relies on test results	Cut-off (calc)	Tests relied on (calc)	Final by the cut-off (calc)	Plan tests final by the date (calc)	What it is
Customer security review	14 Jun 2027	Yes	3 May 2027	5	5 of 5	23	EXAMPLE: The largest customer's annual supplier security review. It relies on the controls marked on the Controls sheet.
Maturity assessment	17 Sep 2027	Yes	6 Aug 2027	0		32	EXAMPLE: The next full maturity assessment (P19): fieldwork ends by this date. It can draw on tests final by the cut-off (CA-18).
Board meeting	29 Oct 2026	No		0		0	EXAMPLE: The quarter's board meeting, which receives the pilot's results through the board report.
[[e.g. certification surveillance audit, or a supervisor's review]]				0

Cut-off: the date minus 6 weeks (the setting on the Cycle Rules sheet). "Plan tests final by the date" counts every test final by then, relied on or not: what the meeting or review can see.

Tests and hours by month, against capacity

Month	Tests	Retests	Design checks	Sampled items	Estimated hours	Capacity hours	Hours to spare	Status
1 Oct 2026	3	0	0	23	23.5	45	21.5	Within capacity
1 Nov 2026	2	0	0	8	12	45	33	Within capacity
1 Dec 2026	3	0	0	9	16.5	45	28.5	Within capacity
1 Jan 2027	3	0	1	4	14	45	31	Within capacity
1 Feb 2027	3	1	0	17	20.5	45	24.5	Within capacity
1 Mar 2027	4	0	0	28	30	45	15	Within capacity
1 Apr 2027	2	0	1	3	9.5	45	35.5	Within capacity
1 May 2027	3	0	0	7	15.5	45	29.5	Within capacity
1 Jun 2027	4	0	0	26	29	45	16	Within capacity
1 Jul 2027	3	1	0	33	28.5	45	16.5	Within capacity
1 Aug 2027	2	0	1	11	13.5	45	31.5	Within capacity
1 Sep 2027	1	0	1	1	4.5	45	40.5	Within capacity
Plan year	33	2	4	170	217	540	323

Each test's hours: set-up and write-up hours per test, plus hours per sampled item times its sample (settings on the Cycle Rules sheet). A month over capacity needs a test moved, a second tester, or more days.

Approval and changes (CA-16)

Role	Name or body				Date	Check (calc)
Proposed by (Control assurance lead)	EXAMPLE: Quality and Compliance Manager				[[YYYY-MM-DD]]
Approved by (Assurance sponsor)	EXAMPLE: Chief Operating Officer				30 Sep 2026	Approved before the year starts

Date	What changed				Why			Approved by
[[YYYY-MM-DD]]	[[e.g. CT-17 moved from November to January]]				[[e.g. the access coordinator's absence]]			[[Assurance sponsor]]

Record every change after approval: a test moved, added after a significant incident or change, or dropped. Tests an audit relies on stay before its cut-off.

Lists

Kind	YesNo	LowerWhen	Frequency	DesignConclusion	OperatingConclusion
Operating	Yes	This plan year	As it happens	Adequate	Effective
Design	No	Next plan year	As it falls due	Deficient	Not effective
Retest			Monthly		Not tested

Quarterly

Every six months

Annual

Definitions

Definitions

Term	Meaning in this workbook
Control	Something done routinely to keep a risk in check, written as who does what, how often, and the record it leaves (CA-01).
Key control	A control whose failure, on its own, would let a risk on the register happen or go unnoticed, or that the organisation names as its evidence for an obligation. Key controls are never rated Lower risk.
Control owner	The manager accountable for a control running and leaving its record. Agrees test dates, provides access to records and fixes deficiencies.
Tester	The person who tests a control. Owns and performs none of the controls they test (CA-10).
Control assurance lead	The person who runs control testing: keeps the inventory and the plan, assigns testers, reviews workpapers, and rates deficiencies. Owns and performs no control in scope.
Assurance sponsor	The member of management who approves the test plan, receives the dashboard, and decides when a High deficiency is overdue.
Risk rating	Higher, Standard and Lower, given by CA-15. What earns each is on the Cycle Rules sheet.
Test cycle	The longest time between operating tests of a control: 6 months for Higher, 12 months for Standard, 24 months for Lower (CA-15).
Design check	A check that the control, as written and as set up, would prevent or detect the risk if it ran: a walkthrough of one occurrence from start to record (CA-02).
Operating test	A check, on a sample chosen by the tester, that the control ran as designed throughout the testing period (CA-04 to CA-07).
Retest	An operating test of a fixed control, made after it has run enough times to sample, by someone other than its owner. A deficiency closes only on a retest that passes (CA-14).
Testing period	The months the operating test covers: since the control was last tested, and never longer than its test cycle (CA-06).
Estimated population	How many times the control is expected to run in the testing period: the times it runs a year, scaled to the period's days. For planning only; the tester takes the real population from the system of record.
Sample	The occurrences the tester chooses from the population, spread across the testing period. The owner never chooses them (CA-04, CA-05).
Estimated hours	Set-up and write-up hours per test, plus hours per sampled item times the sample. For planning capacity, not for charging.
Final by	The last day of the test's month plus the reviewer's 10 working days (CA-11): the latest day the reviewer signs the workpaper, when the test becomes final. Public holidays are not counted out.
Relied on by	The audit or review that will use this test's result, from the Calendar. Its tests must be final by its cut-off.
Cut-off	The date 6 weeks before an audit or review starts, by which every test it relies on is final (CA-16).
Capacity	The days a month your testers can give to testing, as hours. Each month's estimated hours are compared with it.
Next test due	The last tested period's end plus the control's test cycle: the date by which its next operating test's period must end (CA-15).
Plan year	The twelve months the sponsor approves the plan for. The next plan year is drafted on the Next Year sheet.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
CA-nn	The rules of the Control Testing Methodology, CA-01 to CA-20. CT-nn are its controls, quoted in the Control Inventory & Ownership Register.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its plan for 1 Oct 2026 to 30 Sep 2027. Clear the EXAMPLE before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.35 — Independent review of information security	The plan as a whole: control tests at planned intervals by a tester independent of the control, whose results can feed the independent review. The plan is not that review (CA-18)
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Plan sheet: the evaluations the year's improvements are identified from, scheduled by risk
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	The plan as a whole: when each control's effectiveness is assessed, how often by its risk rating (CA-15), and by whom (CA-10)
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Applies to the providers its Article 1 names. For them, the Annex points below; for others, a useful guide only
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 2.2.3 — “The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.”	Plan sheet: tests at planned intervals by rating, and sooner after a significant incident or change
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.3 — review and, where appropriate, update the policy and procedures at planned intervals and after significant incidents or significant changes to operations or risks	Calendar sheet: the plan approved each year, and every change recorded (CA-16)
DORA — Regulation (EU) 2022/2554	Article 5(2)(f) — the management body shall “approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them”	Calendar sheet, for financial entities: the plan's approval can sit beside the ICT internal audit plans; it is not one of them (CA-18)
DORA — Regulation (EU) 2022/2554	Article 6(6) — “The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan.” The auditors possess sufficient knowledge, skills and expertise in ICT risk and appropriate independence, and the frequency and focus of ICT audits are commensurate to the entity’s ICT risk	Calendar sheet, for financial entities: tests an internal audit relies on final before it (CA-16). Testing can feed that audit; it is not that audit (CA-18)
DORA — Delegated Regulation (EU) 2024/1774	Article 28(5) — the simplified ICT risk management framework “is subject to an internal audit by auditors, in line with the financial entities’ audit plan”; the auditors have sufficient knowledge, skills and expertise in ICT risk “and shall be independent”, and the frequency and focus of ICT audits are commensurate to the entity’s ICT risk	Calendar sheet, for financial entities under the simplified framework: as for Article 6(6). Testing is not the internal audit (CA-18)

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR)

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.