Control Evidence Standards Checklist
Defines what acceptable evidence looks like for each common control type.
Available soon
- Format
- Excel
- Size
- 78 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Use this workbook beside the Control Test Workpaper Template for each test. The workpaper records the test; this workbook sets the standard every record in it must meet. The Control Test Execution Procedure says when in the test each step comes. |
| 2 | Before a test, find the control on the By Control sheet: the record it leaves, what to ask the owner for, where to take the population and the second source that checks it. Controls you add to the Control Inventory & Ownership Register go in the yellow rows at the foot, each with an evidence type from ET-01 to ET-08. |
| 3 | Read the evidence type's "Acceptable" and "Not acceptable" columns on the Evidence Standards sheet before you look at any record. |
| 4 | Take the population yourself and check it is complete before you sample (CA-04). The Populations sheet shows how, step by step, with the pilot's seven populations as an EXAMPLE. |
| 5 | Ask the owner only for the records of the occurrences you sampled. Run reports and take screenshots yourself where you can: the Obtaining and Keeping sheet says what each must show (EQ-04, EQ-05). |
| 6 | On the Evidence Check sheet, add a row for each record the test relies on: the population list, and the record for each sampled occurrence. Enter the workpaper reference and the control ID; the evidence type fills in. |
| 7 | Answer each criterion, EQ-01 to EQ-06, Yes or No. For EQ-04, answer "Not a list" when the record is a single item, such as one ticket, rather than a report or list. |
| 8 | Read the Result. Acceptable: every criterion is met. Not acceptable: at least one is not; the next column names the first. Not finished: a criterion has no answer yet. |
| 9 | For a record that is Not acceptable, ask for a better one or take it from the system yourself. If no acceptable record exists, the occurrence cannot be shown to pass: record it as an exception on the workpaper (CA-07). Where other evidence shows the control ran but its own record falls short of this standard, the assurance lead may rate the deficiency Low (CA-12). |
| 10 | What the owner tells you goes in the note. It explains the records; it never answers EQ-01 on its own (CA-03). |
| 11 | File every record with the workpaper, where the owner cannot change it, before the reviewer signs. Keep it for [[3]] years, or longer where law or a contract asks (CA-20). The Obtaining and Keeping sheet works out the date. |
| 12 | The reviewer checks the Evidence Check rows with the workpaper before signing it (CA-11). |
| 13 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column on the Evidence Check sheet, the EXAMPLE populations on the Populations sheet, and the EXAMPLE date on the Obtaining and Keeping sheet. The criteria, the types and the controls stay: they are the standard. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
CA-03: Asking someone is never enough. Every test inspects records, observes the control being done, or re-performs it; an interview only explains what the tester saw.
CA-04: The tester takes the population from the system of record, checks it is complete against a second source, and chooses the sample, spread across the testing period. The control owner never chooses the sample or supplies a list the tester cannot check.
CA-20: Workpapers and the evidence they rely on are kept for [[3]] years, or longer where law or a contract asks, where the tester and reviewer can reach them and the control owner cannot change them.
How a tester gathers evidence. Inspection: Reading a record the control left, such as a ticket, a log entry or a signed review. Observation: Watching the control being done, such as a restore or a review meeting. Shows it can run; says nothing about other occasions. Re-performance: Doing the control again from the same inputs and comparing the result, such as re-running a reconciliation. Inquiry: Asking the owner or performer how it is done. Explains the evidence; never supports a conclusion on its own (CA-03).
This document helps you test whether your security controls work. It is not legal advice, and a test result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law, a certification or a contract asks for an audit or an independent review, confirm with counsel, your certification body or the other party what it must include.
Control testing is not an internal audit, a certification audit, a P19 maturity assessment or a statement of compliance, and is never presented as one. Its results can feed each of them. Evidence that meets this standard can be shown to an auditor or a supervisor; meeting the standard does not make a test an audit.
Acceptable evidence and a passed attribute are different questions. A record can be fully acceptable and show that the control failed: in the EXAMPLE, L-2026-031's account history is acceptable evidence of an exception. Under CA-08 that is still this control's exception, even though another control caught it. P19's MA-05 differs on purpose: P19 rates a whole practice with its own checks; P20 tests one control.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its pilot round, TR-2026-P, ran from 21 Sep 2026 to 25 Sep 2026 and tested 1 Mar 2026 to 31 Aug 2026. Its Quality and Compliance Manager led it and its Internal Audit Manager reviewed the workpapers on 28 Sep 2026. The Evidence Check sheet shows the records the reviewer accepted.
Tailoring — small organisation: the standard does not change with size. Fewer occurrences mean smaller populations, not weaker records. One person may test, but never a control they own or perform (CA-10).
Tailoring — IT run by a service provider: the provider's records count only if you can obtain them as this standard asks. Ask through the contract owner for reports you can run or watch run, and note on the row whose record it is.
Tailoring — group of companies: where the parent keeps the system of record, take the population for your organisation only, and check it against a second source of your own, such as your payroll.
This workbook is your own record. Keep it with the workpapers it supports.
Evidence Check
One row for each record a test relies on. Yellow columns are yours; the evidence type, criteria met, result and first criterion not met calculate. Acceptable only when all 6 criteria are met.
| Row | Workpaper | Control ID | Occurrence, or the population list | Evidence type | Record, and where it came from | EQ-01 Relevant | EQ-02 Dated | EQ-03 Attributable | EQ-04 Complete | EQ-05 Obtained by the tester | EQ-06 Kept | Criteria met | Result | First criterion not met | Note: what the record shows, and any limitation |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | WP-2026-01 | CT-16 | The population list: 38 occurrences | ET-03 Action within a deadline | HR system leavers report, 1 Mar to 31 Aug 2026 | Yes | Yes | Yes | Yes | Yes | Yes | 6 of 6 | Acceptable | Count agreed: 38 leavers agreed to the payroll system's leavers for the same months. | |
| EXAMPLE | WP-2026-01 | CT-16 | Sampled leaver L-2026-031 | ET-03 Action within a deadline | HR record: last working day 15 May 2026. Account history: ERP account disabled 3 Jun 2026. | Yes | Yes | Yes | Not a list | Yes | Yes | 6 of 6 | Acceptable | Acceptable evidence of an exception (CA-08): ERP account left enabled; found and disabled by the May reconciliation (CT-18) on 3 Jun 2026. Whether the evidence is acceptable and whether the attribute passed are separate questions. | |
| EXAMPLE | WP-2026-02 | CT-13 | The population list: 34 occurrences | ET-03 Action within a deadline | Remediation tracker export of Priority 1 and 2 findings due 1 Mar to 31 Aug 2026 | Yes | Yes | Yes | Yes | Yes | Yes | 6 of 6 | Acceptable | Count agreed: 34 findings agreed to the scanner's list of Priority 1 and 2 detections for the same months. | |
| EXAMPLE | WP-2026-02 | CT-13 | Sampled finding VUL-2026-0301 | ET-03 Action within a deadline | Scanner: Ordering platform database server, P2, first detected 2 Jun 2026. Remediation tracker: fixed 29 Jun 2026. Rescan 30 Jun 2026. | Yes | Yes | Yes | Not a list | Yes | Yes | 6 of 6 | Acceptable | Acceptable evidence of an exception: fixed after its deadline of 16 Jun 2026, with no deferral requested. | |
| EXAMPLE | WP-2026-03 | CT-22 | The population list: 61 occurrences | ET-05 Training or acknowledgement | HR system joiners report, 1 Mar to 31 Aug 2026, with the learning system's completion dates | Yes | Yes | Yes | Yes | Yes | Yes | 6 of 6 | Acceptable | Count agreed: 61 joiners agreed to the accounts the provisioning log created in the same months. | |
| EXAMPLE | WP-2026-04 | CT-04 | The population list: 24 occurrences | ET-02 Review or sign-off | Risk register review history: 12 risks, March and June quarters | Yes | Yes | Yes | Yes | Yes | Yes | 6 of 6 | Acceptable | Count agreed: 12 risks agreed to the register approved by the board on 30 Jul 2026. | |
| EXAMPLE | WP-2026-05 | CT-24 | The population list: 1 occurrence | ET-03 Action within a deadline | Incident log: Severity 1 and 2 incidents closed 1 Mar to 31 Aug 2026 | Yes | Yes | Yes | Yes | Yes | Yes | 6 of 6 | Acceptable | Count agreed: The log's only Severity 1 or 2 closure in the period agreed to the incident manager's case list. |
Evidence Standards
The evidence standard
Every record a test relies on meets all 6 criteria. The second table says what acceptable evidence looks like for each kind of control. Both come from the Control Testing Methodology (CA-03, CA-04, CA-20).
6 criteria every record meets (EQ-01 to EQ-06)
| ID | Criterion | The test | How to check it | Rules | ||
|---|---|---|---|---|---|---|
| EQ-01 | Relevant | It shows the attribute being tested, for the occurrence sampled, not a policy saying it should happen. | Read the record against the attribute. A policy, procedure or template shows what should happen; it is not evidence that it did. Check the evidence type's "Not acceptable" column first. | CA-01, CA-03 | ||
| EQ-02 | Dated | It carries the date, and where a deadline is tested the time, of the occurrence, inside the testing period. | Check the date falls inside the testing period. Where a deadline is tested, take each date from its own system, and the time where the deadline is in hours or the same day. | CA-06 | ||
| EQ-03 | Attributable | It shows who performed or approved the control, so the tester can check that person was allowed to. | Find the name or account of the performer or approver, and check that person was allowed to act: the approver the band or tier names, and never the requester. | CA-01 | ||
| EQ-04 | Complete | A report or list used as evidence shows its source, when it was run and the filter used, and the tester checks its count against a second source (CA-04). | A report or list names its system, when it ran and the filter used. Agree its count to the second source before you sample. Answer "Not a list" when the record is a single item, such as one ticket. | CA-04 | ||
| EQ-05 | Obtained by the tester | The tester extracts or watches the extraction of the record, or receives it straight from the system. A screenshot shows the system, the date and the account it was taken from. | Run the report yourself, watch it run, or receive it straight from the system. A file the owner prepared counts only if you can check it against the system. | CA-03, CA-04 | ||
| EQ-06 | Kept | It is filed with the workpaper and kept for [[3]] years where the owner cannot change it (CA-20). | File it with the workpaper, in the store the owner cannot change, before the reviewer signs. | CA-11, CA-20 | ||
What acceptable evidence looks like, by kind of control
| ID | Kind of control | Examples | Acceptable | Not acceptable | Controls using it | Controls |
|---|---|---|---|---|---|---|
| ET-01 | Approval before action | Access requests, exception requests, changes | The request and the approval, each dated and attributed, with the approval earlier than the action and given by someone allowed to approve it. | An approval dated after the action; an email saying "approved" with no link to the request; approval by the requester. | 2 | CT-05, CT-15 |
| ET-02 | Review or sign-off | Risk reviews, access reviews, policy reviews, register reviews | The review record showing what was reviewed, the decision for each item, who decided and when, and the follow-up actions it raised. | A calendar invitation; minutes that say only that the item was "noted"; a review with no decision recorded. | 11 | CT-01, CT-02, CT-04, CT-06, CT-07, CT-09, CT-19, CT-20, CT-28, CT-29, CT-30 |
| ET-03 | Action within a deadline | Leaver removals, fixes within deadline, reviews after an incident | The trigger's date from its own system (the HR leaving date, the scanner's first detection, the incident closure) and the action's date from the system where it happened, so the time between can be counted. | The person's own note of when they acted; a ticket closure date in place of the system's change date. | 7 | CT-12, CT-13, CT-14, CT-16, CT-17, CT-24, CT-26 |
| ET-04 | Reconciliation | Monthly account reconciliation, metric data checks | Both lists compared, the differences found, and what was done about each, dated within the time the control sets. | A statement that the lists agree with no lists attached; a reconciliation run but its differences left unexplained. | 2 | CT-08, CT-18 |
| ET-05 | Training or acknowledgement | Security induction, annual course, policy acknowledgement, board training | The learning or HR system's record of completion for the named person, dated, with the start date or appointment date it is measured from. | Attendance sheets with no date; a completion rate with no names behind it. | 4 | CT-03, CT-10, CT-22, CT-23 |
| ET-06 | Test or exercise | Break-glass tests, exercises, readiness checks | The record of the test as it ran: date, who took part, what was tested, the result, and the actions raised. | A plan to test; a test report with no result recorded. | 3 | CT-21, CT-25, CT-27 |
| ET-07 | Register kept current | Information register, end-of-life register, supplier register | The register with each entry's last review date and owner, and its change history for the testing period. | A register exported today with no history, which cannot show it was current during the period. | 1 | CT-11 |
| ET-08 | System setting | Automated controls (CA-09) | The setting exported or observed, with the system's name and the date, and the change record for the setting over the testing period. | A vendor's statement of the default setting; a screenshot with no system or date. | 0 |
"Controls" lists the pack's 30 controls; "Controls using it" counts the By Control sheet, including controls you add.
Counts
| Count | Result | What it counts | ||||
|---|---|---|---|---|---|---|
| Quality criteria | 6 | The criteria every record must meet. | ||||
| Evidence types | 8 | The kinds of control with their own description of acceptable evidence. | ||||
| Controls in the standard | 30 | Controls on the By Control sheet, including any you add. | ||||
| Controls whose evidence type resolves | 30 of 30 | Every control needs an evidence type from the table above. Fix any that does not resolve. | ||||
| Records checked | 7 | Rows on the Evidence Check sheet with an answer or a control. | ||||
| Records acceptable | 7 of 7 | All six criteria met. | ||||
| Records not acceptable | 0 | At least one criterion not met. Each needs a better record, or an exception on the workpaper. | ||||
| Records not finished | 0 | A criterion has no answer yet. | ||||
Sign-off: this standard adopted
| Role | Name | Date | Signature or reference | |||
|---|---|---|---|---|---|---|
| Prepared by (Control assurance lead) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | |||
| Agreed by (Head of Information Security) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | |||
| Approved by (Assurance sponsor) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | |||
By Control
The record each control leaves and how to test it. The pack's 30 controls, then yellow rows for your own. The evidence type resolves against the Evidence Standards sheet.
| Control ID | Control | Source rule | How often it runs | Record it leaves | Evidence type ID | Evidence type | What the tester asks for | Population: where to take it | Second source for the completeness check | Attributes to check on each occurrence |
|---|---|---|---|---|---|---|---|---|---|---|
| CT-01 | Board report from checked figures | P03 BR-08 | Quarterly | The signed-off data collection workbook and the board deck built from it | ET-02 | Review or sign-off | For each sampled quarter: the board deck as sent, the data collection workbook it was built from, and the workbook's sign-off with name and date. | The board papers archive: every quarterly security report sent in the period. | The board's agenda list or minutes for the same quarters. | 1. Every figure in the deck appears in the workbook 2. The workbook was signed off before the deck's date 3. The sign-off is by someone other than the person who compiled the figures |
| CT-02 | Policy reviews on time | P04 PF-06 | As it falls due | The policy register's review dates and each review's record | ET-02 | Review or sign-off | For each sampled review: the register entry with its due date, the review record, and the approval at the level the document's tier requires. | The policy register: every policy and standard whose review fell due in the period. | The list of documents published on the intranet or document system, checked for documents missing from the register. | 1. The review is recorded on or before the due date the register shows 2. The review was approved at the level the document's tier requires 3. The register shows the next review date |
| CT-03 | Joiners acknowledge policies | P04 PF-09 | As it happens | The acknowledgement record for each joiner | ET-05 | Training or acknowledgement | For each sampled joiner: the start date from the HR record, and the acknowledgement naming the policies, their versions and the date. | The HR system's joiners report for the period. | The accounts the provisioning log created in the same months, or payroll's new starters. | 1. Acknowledged within 10 working days of the start date in the HR record 2. The acknowledgement names the policies and their versions |
| CT-04 | Quarterly risk review | P05 RM-09 | Quarterly | Each risk's review date and decision in the register | ET-02 | Review or sign-off | For each sampled risk and quarter: the register's review entry with its date, the decision and the reviewer's name. | The risk register's review history: each risk for each quarter in the period. | The register as last approved by the board or risk committee, for the number of risks. | 1. The risk was reviewed in the quarter 2. The review records a decision: rating confirmed or changed, treatment on track or not 3. The reviewer is the risk owner the register names |
| CT-05 | Exceptions approved and renewed in time | P02 EX-05, EX-06, EX-10 | As it happens | The exception register and each exception's request, approval and renewal | ET-01 | Approval before action | For each sampled exception: the request, the approval with the approver's name and date, the band, and the expiry, renewal or escalation record. | The exception register: every exception approved, renewed or expired in the period. | The workflow or ticketing system's exception requests for the same months. | 1. Approved by the approver the band requires, before the exception took effect 2. Expiry no later than the band allows 3. On expiry: remediated, renewed or escalated within the grace period |
| CT-06 | Monthly exception register review | P02 EX-11 | Monthly | The monthly review record of the exception register | ET-02 | Review or sign-off | For each sampled month: the review record, the exceptions due to expire within 30 days and the reminders sent, and the escalation of any expired exception. | The months in the period: one review falls due each month. | None needed: the months are a fixed list. Check that every month has a record. | 1. A review is recorded for the month 2. Exceptions due to expire within 30 days were chased 3. Expired exceptions were escalated |
| CT-07 | Tier 1 suppliers reassessed in time | P06 TP-09 | As it falls due | Each supplier's assessment and decision | ET-02 | Review or sign-off | For each sampled supplier: the previous and the current assessment, the decision and who made it, and the findings with their owners and deadlines. | The supplier register: every Tier 1 supplier whose reassessment fell due in the period, and any that had a material change, incident or breach. | The finance system's list of active suppliers, checked for Tier 1 suppliers missing from the register. | 1. Reassessed within 12 months of the last assessment 2. The assessment records a decision and who made it 3. Findings have owners and deadlines |
| CT-08 | Metric inputs checked before reporting | P11 MR-05, MR-06 | Monthly | The data quality log for each reporting cycle | ET-04 | Reconciliation | For each sampled reporting cycle: the data quality log with the three checks for each input, the validator's name, and what was done with any input that failed. | The reporting cycles in the period: one each month. | The distribution record of reports issued, so that no cycle is missing its log. | 1. Each input in the cycle has the three checks recorded 2. The validator is not the supplier 3. A failed input was corrected, caveated or withheld |
| CT-09 | NIS2 readiness self-assessed | P12 NR-08 | Every six months | The readiness self-assessment with each item's level and evidence | ET-02 | Review or sign-off | For each sampled self-assessment: the completed assessment with each item's level and evidence, its date, and the gap tracker entries it raised. | The self-assessments completed in the period, and every trigger that required one: a significant incident or a change in scope. | The incident log and the scope change record, for triggers that should have led to an assessment. | 1. Completed within 6 months of the last one 2. Every item has a level and its evidence 3. Gaps found are in the gap tracker with owners |
| CT-10 | Board members trained | P12 NR-05 | As it falls due | The board training record | ET-05 | Training or acknowledgement | For each sampled member: the training record with its date, attendance and content, and the appointment date for a new member. | The members of the management body during the period, with their appointment dates. | The company register or the board minutes recording appointments. | 1. Trained within 12 months of the last training, or 3 months of appointment 2. Attendance and content recorded |
| CT-11 | Information register reviewed | P15 CL-03, CL-12 | As it happens | The information register's review dates and change reviews | ET-07 | Register kept current | For each sampled entry: the review date and reviewer from the register's history and, for a change, the date of the change and the review that followed. | The information register's history for the period: entries due for review, and entries whose purpose, users, law, supplier or risk changed. | Change records, new supplier records and new system records that should have led to a register change. | 1. Entry reviewed within 12 months 2. A change was reviewed within 15 working days |
| CT-12 | Disposal certificates collected | P15 CL-11 | As it happens | The disposal record and the provider's certificate | ET-03 | Action within a deadline | For each sampled collection: the disposal record listing the items, the provider's certificate, and the dates of collection and of receipt. | The disposal record: every collection of Confidential items in the period. | The provider's own collection notes or invoices for the same months. | 1. Every Confidential item collected is on the certificate 2. Certificate received within 10 working days of collection |
| CT-13 | Urgent vulnerabilities fixed in time | P01 VM-08 | As it happens | The remediation tracker and the scanner's detection and closure dates | ET-03 | Action within a deadline | For each sampled finding: the scanner's first detection date, the priority, the date of the fix from the system changed, the rescan, and any deferral. | The remediation tracker: every Priority 1 and 2 finding whose deadline fell in the period. | The scanner's own list of Priority 1 and 2 detections for the same months. | 1. Fixed by the deadline its priority sets, counted from first detection 2. The fix was confirmed by a rescan 3. A miss was deferred as an exception before the deadline (P17 PM-14) |
| CT-14 | Vendor releases reviewed | P17 PM-03 | As it happens | The release review log | ET-03 | Action within a deadline | For each sampled release: the vendor's release date, the review log entry with its date, the rating and the route chosen. | The release review log for the period. | The vendors' published advisories for in-scope systems, to find releases missing from the log. | 1. Reviewed within 1 working day of release 2. Rated with the P01 model 3. Routed to a cycle |
| CT-15 | Missed patch deadlines deferred | P17 PM-14 | As it happens | The deferral request and its approval | ET-01 | Approval before action | For each sampled miss: the P01 deadline, the deferral request with its date, the approval and the approver, and the expiry. | Every patch installed after its deadline, or still not installed, in the period, from the patch or remediation tracker. | The exception register for deferrals, and the scanner for misses the tracker does not show. | 1. Requested before the deadline 2. Approved by the band's approver 3. Expiry no later than the band allows |
| CT-16 | Leavers' access removed | P13 JML-09 | As it happens | The provisioning log and each system's account history | ET-03 | Action within a deadline | For each sampled leaver: the last working day from the HR record, and each system's account history showing when access was disabled, local accounts included. | The HR system's leavers report for the period. | Payroll's leavers for the same months. | 1. Every account disabled by the end of the last working day in the HR record 2. Removal recorded in the provisioning log |
| CT-17 | Movers' old access removed | P13 JML-08 | As it happens | The provisioning log | ET-03 | Action within a deadline | For each sampled mover: the move date from the HR record, the provisioning log entry removing the old access, any handover the old manager recorded, and any request to keep access. | The HR system's report of role changes in the period. | Payroll or organisation chart changes for the same months. | 1. Old access removed on the move date, or within the handover window 2. Any access kept was requested as non-standard |
| CT-18 | Monthly account reconciliation | P13 JML-15 | Monthly | The reconciliation report and the actions on each difference | ET-04 | Reconciliation | For each sampled month: the reconciliation report, the systems it covered, each difference found and the action on it, with dates. | The months in the period: one reconciliation falls due each month. | The list of in-scope systems, to check that every system was included each month. | 1. Run within 3 working days of month end 2. Every in-scope system included 3. Orphaned accounts disabled within 1 working day |
| CT-19 | User access reviews | P07 AR-02, AR-07 | Every six months | The campaign's evidence file | ET-02 | Review or sign-off | For each sampled campaign and system: the extract reviewed, each decision with the reviewer and date, the removal records, and the fresh extract that confirms them. | The review campaigns due in the period, by system and scope. | The system inventory, to find in-scope systems no campaign covered. | 1. The review covered the system in its interval 2. Every decision recorded by the reviewer the scope names 3. Removals made within the window and confirmed against a fresh extract |
| CT-20 | Privileged access reviewed | P14 PA-16 | Quarterly | The privileged access review record | ET-02 | Review or sign-off | For each sampled review: the list of privileged accounts reviewed, each decision, the reviewers, and the confirmation of each removal. | The privileged access reviews due in the period. | A fresh extract of privileged accounts from each system, to check the review covered them all. | 1. Reviewed within 3 months of the last review 2. Every privileged account has a decision 3. Removals made and confirmed |
| CT-21 | Break-glass accounts tested and every use reviewed | P14 PA-12 | Quarterly | The break-glass test and use records | ET-06 | Test or exercise | For each sampled quarter: the test record. For each sampled sign-in: the alert, the declaration and the review. | The quarterly tests due in the period, and the break-glass accounts' sign-in log. | The alerting system's record of break-glass sign-in alerts. | 1. Tested within 3 months of the last test 2. Every sign-in in the period was declared and reviewed |
| CT-22 | Security induction completed | P16 AW-05 | As it happens | The learning system's completion record | ET-05 | Training or acknowledgement | For each sampled joiner: the start date from the HR record and the learning system's completion date for the induction. | The HR system's joiners report for the period. | The accounts the provisioning log created in the same months. | 1. Completed within 10 working days of the start date in the HR record |
| CT-23 | Annual security course completed | P16 AW-04 | As it falls due | The learning system's completion record | ET-05 | Training or acknowledgement | For each sampled person: the learning system's dates for their last two completions, or their start date and first completion. | Everyone with an account during the period, from the directory. | The HR headcount report and the contractor list, to find people with accounts that neither shows. | 1. Completed within 12 months of the last completion |
| CT-24 | Post-incident review held | P09 IM-11 | As it happens | The post-incident review and its actions | ET-03 | Action within a deadline | For each sampled incident: the closure date, the review record and its date, each action with its owner and due date, and the risks sent for reassessment. | The incident log: every incident closed in the period that P09 IM-11 requires a review for. | The incident manager's case list, or the ticketing system's major incident records. | 1. Review held within 10 working days of closure 2. Every action has an owner and a due date 3. The risks it touched were sent for reassessment |
| CT-25 | Incident response exercised | P10 EX-02 | As it falls due | The exercise programme and each exercise's report | ET-06 | Test or exercise | For each audience: the exercise programme entry and the exercise report with its date, participants, objectives and result. | The audience table, and the exercises held in the period. | The after-action reports approved in the period (CT-26). | 1. Each audience exercised within its interval 2. A live incident was not counted as an exercise |
| CT-26 | After-action report approved | P10 EX-09 | As it happens | The approved after-action report | ET-03 | Action within a deadline | For each sampled exercise: the exercise date, the approved after-action report with the sponsor's approval date, and the rating of each objective. | The exercise programme: every exercise held in the period. | The after-action report folder, checked for exercises missing from the programme. | 1. Approved within 10 working days 2. Every objective rated |
| CT-27 | Notification readiness checked | P18 RN-17 | Every six months | The readiness checklist and the channel access tests | ET-06 | Test or exercise | The readiness checklist with its completion date, and each signatory's channel access test with its date. | The readiness checks completed in the period, and the list of signatories and channels. | Change records for authorities, channels, signatories and the profile, each of which should have led to a check. | 1. Checklist completed within 6 months 2. Each signatory's channel access tested within 12 months |
| CT-28 | Maturity assessed each year | P19 MA-17 | Annual | The assessment report | ET-02 | Review or sign-off | The assessment report with its fieldwork dates, the previous report, and the assignment of assessors to practices. | The maturity assessments in the period: usually one. | The sponsor's approvals of assessment plans. | 1. Fieldwork ended within 12 months of the last 2. The lead rated no practice they own or run |
| CT-29 | Supplier High findings escalated | P06 TP-08 | As it happens | The supplier finding log | ET-02 | Review or sign-off | For each sampled finding: its owner, deadline and severity and, for a High finding past its deadline, the escalation to the business owner with its date. | The supplier finding log for the period. | The supplier assessments completed in the period, to find findings missing from the log. | 1. Owner and deadline recorded 2. A High finding past its deadline was escalated |
| CT-30 | Triggered risk reassessment | P05 RM-10 | As it happens | The reassessment record | ET-02 | Review or sign-off | For each sampled trigger: its date and source, and the reassessment record with its date and the trigger noted. | The triggers in the period: incidents, major changes and control failures, each from its own log. | The risk register's reassessment history, checked for triggers recorded there but missing from the list. | 1. Reassessed within 10 working days of the trigger 2. The reassessment recorded the trigger |
Populations
Checking that a population is complete
A sample proves nothing about occurrences missing from the list it was drawn from. Check the list before you sample (CA-04). Then the sample size follows from the population and the control's risk rating (CA-05).
How to check a list is complete
| Step | What | What to do | Rules | ||||
|---|---|---|---|---|---|---|---|
| 1 | Find the system of record | Ask which system records every occurrence of the control: the HR system for leavers, the scanner for findings, the register for reviews. That system, not a list kept by hand, is the source. | CA-04 | ||||
| 2 | Take the list yourself | Run the report yourself, or watch it run. Record the system, the report's name, when it ran, the filter and the number of items. | EQ-04, EQ-05 | ||||
| 3 | Check the filter | The dates must match the testing period, and the filter must take in every system, site and type of event the control covers. | CA-06 | ||||
| 4 | Agree the count to a second source | Compare the count with a source that records the same events independently, such as payroll for HR leavers or the scanner for the remediation tracker. The By Control sheet names one for each control. | CA-04 | ||||
| 5 | Explain every difference | An item on the second source but not the list goes into the population. An item that does not belong is removed, with the reason on the workpaper. | CA-04 | ||||
| 6 | For a monthly or quarterly control, use the calendar | The population is every month or quarter in the testing period. A period with no record is an exception, not a smaller population. | CA-06, CA-07 | ||||
| 7 | Then choose the sample | Only now take the sample, spread across the testing period. The owner never chooses it. The sample size comes from the population and the control's risk rating. | CA-04, CA-05 | ||||
| 8 | If no list can be checked | Do not use a list you cannot check. Look for another source first. If none exists, tell the assurance lead, who decides whether the control has a design deficiency because it leaves no record that can be tested. | CA-01, CA-04 | ||||
EXAMPLE: the pilot's 7 populations (TR-2026-P, testing 1 Mar 2026 to 31 Aug 2026)
Population and risk are the pilot's. The sample calculates from them by CA-05's bands; change either to see the sample a population of your own needs.
| Workpaper | Control | Risk at test | Population | Sample | Taken from | Completeness check | Conclusion |
|---|---|---|---|---|---|---|---|
| WP-2026-01 | CT-16 Leavers' access removed | Standard | 38 | 5 | HR system leavers report, 1 Mar to 31 Aug 2026 | 38 leavers agreed to the payroll system's leavers for the same months | Effective |
| WP-2026-02 | CT-13 Urgent vulnerabilities fixed in time | Standard | 34 | 5 | Remediation tracker export of Priority 1 and 2 findings due 1 Mar to 31 Aug 2026 | 34 findings agreed to the scanner's list of Priority 1 and 2 detections for the same months | Not effective |
| WP-2026-03 | CT-22 Security induction completed | Standard | 61 | 20 | HR system joiners report, 1 Mar to 31 Aug 2026, with the learning system's completion dates | 61 joiners agreed to the accounts the provisioning log created in the same months | Effective |
| WP-2026-04 | CT-04 Quarterly risk review | Standard | 24 | 5 | Risk register review history: 12 risks, March and June quarters | 12 risks agreed to the register approved by the board on 30 Jul 2026 | Effective |
| WP-2026-05 | CT-24 Post-incident review held | Standard | 1 | 1 | Incident log: Severity 1 and 2 incidents closed 1 Mar to 31 Aug 2026 | The log's only Severity 1 or 2 closure in the period agreed to the incident manager's case list | Effective |
| WP-2026-06 | CT-20 Privileged access reviewed | Standard | 0 | 0 | Privileged access review records | None: the control started on 21 Sep 2026, when the Tier 0 accounts went live (P14) | Not tested |
| WP-2026-07 | CT-02 Policy reviews on time | Higher | Not taken | Policy documents and their approval records | No register records when each policy is due for review | Design deficient: operation not tested |
Every count was agreed to a second source before the sample was chosen. 5 of the 7 controls were tested for operation; the other two show the two cases with no sample: a control that has not yet run in the period (Not tested, CA-06) and a design found deficient (CA-01).
Sample sizes by population and risk rating: 1 to 2: All (Standard and Lower), All (Higher); 3 to 12: 2 (Standard and Lower), 3 (Higher); 13 to 52: 5 (Standard and Lower), 10 (Higher); 53 to 250: 20 (Standard and Lower), 30 (Higher); 251 or more: 25 (Standard and Lower), 40 (Higher). "All" means every occurrence (CA-05).
Obtaining and Keeping
Obtaining and keeping evidence
Reports and screenshots in practice (EQ-04, EQ-05), and how long evidence is kept and who may change it (EQ-06, CA-20).
System reports and lists
| Check | What it means | Criteria | |
|---|---|---|---|
| It names its source | The system's name, the report's name and the filter or parameters used. | EQ-04 | |
| It shows when it ran and who ran it | A run date and time from the system, and the account that ran it. | EQ-04, EQ-05 | |
| The tester obtained it | Run by the tester, run while the tester watched, or sent by the system straight to the tester. | EQ-05 | |
| It is in the form the system produced | The exported file, not a copy retyped or edited in a spreadsheet. If you sort or filter it to sample, keep the original too. | EQ-05, EQ-06 | |
| Its count agrees with a second source | The difference, if any, is explained on the workpaper before the sample is chosen. | EQ-04 | |
| It covers the whole period and scope | No rows removed or hidden after the export, and the dates run from the start to the end of the testing period. | EQ-02, EQ-04 | |
Screenshots
| Check | What it means | Criteria | |
|---|---|---|---|
| It shows the system, the date and the account | The system's name or address, the date and time from the system or the device's clock, and the account signed in. | EQ-02, EQ-05 | |
| It shows the whole window | Not a crop that removes the system's name, the date or the record's identity. | EQ-01, EQ-05 | |
| The tester took it, or watched it taken | A screenshot the owner sends later cannot show when, where or by whom it was taken. | EQ-05 | |
| It is backed by history for a setting | A screenshot shows one moment. For a system setting, add the change record for the testing period (ET-08). | EQ-02, CA-09 | |
| It can be traced | Its file name or label links it to the sampled occurrence and the attribute it supports. | EQ-01, EQ-06 | |
| It holds no more personal data than the test needs | Where something must be hidden, say what and why in the note, and keep the system's name, the date and the record's identity visible. | EQ-06 | |
How long to keep it
| Setting | Value | What it does | |
|---|---|---|---|
| Keeping period (years) | 3 | CA-20: workpapers and their evidence are kept this long, or longer where law or a contract asks. | |
| Workpaper final (EXAMPLE: the pilot's review date) | 28 Sep 2026 | The date the reviewer signed the workpaper. Type it; never a formula that changes it. | |
| Keep until | 28 Sep 2029 | Calculated: the keeping period after the workpaper became final. Delete it after this date only if no law, contract, audit or dispute needs it. | |
Who may do what with the evidence store
| Role | Read | Add | Change or delete |
|---|---|---|---|
| Tester | Yes | Yes, until the reviewer signs | Only their own items, before the review |
| Workpaper reviewer | Yes | Review notes only | No |
| Control assurance lead | Yes | Yes | No. At the end of the keeping period, deletes and records the deletion |
| Control owner | On request, for their own controls | No: gives records to the tester | No (CA-20) |
| [[Store administrator, e.g. IT service desk]] | Only to administer the store | No | No. Manages permissions; every change to them is logged |
Keep the store where the tester and reviewer can reach it and the control owner cannot change it (CA-20): a restricted folder, a document system with version history, or an audit tool. Read-only access for owners is fine; editing is not.
Evidence often names people: leavers, joiners, reviewers. Take only what the attributes need, keep it no longer than the keeping period, and restrict access as you would the source system.
When the keeping period ends, the assurance lead deletes the evidence and records what was deleted and when. A workpaper that an open deficiency, an audit or a dispute still relies on is kept until that ends.
Lists
| YesNo | ListAnswer | Criterion | Risk | BandFrom | BandStandard | BandHigher |
|---|---|---|---|---|---|---|
| Yes | Yes | EQ-01 | Higher | 1 | All | All |
| No | No | EQ-02 | Standard | 3 | 2 | 3 |
| Not a list | EQ-03 | Lower | 13 | 5 | 10 | |
| EQ-04 | 53 | 20 | 30 | |||
| EQ-05 | 251 | 25 | 40 |
EQ-06
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Evidence | A record that shows a control operated on one occasion, or a list of every occasion. What a tester inspects, observes or re-performs; never what they are told (CA-03). |
| Acceptable | A record that meets all 6 criteria, EQ-01 to EQ-06. A record that misses any one is Not acceptable. |
| Not finished | At least one criterion has no answer yet. |
| Not a list | The answer to EQ-04 for a record that is a single item, such as one ticket. EQ-04 tests reports and lists; a single item has nothing to complete, so it counts as met. |
| Evidence type | One of ET-01 to ET-08: a kind of control with its own description of acceptable evidence. |
| System of record | The system that records each occurrence of a control as it happens, such as the HR system for leavers or the scanner for findings. The population is taken from it. |
| Second source | A record of the same events kept independently of the system of record, used to check that a population is complete (CA-04). |
| Control | Something done routinely to keep a risk in check, written as who does what, how often, and the record it leaves (CA-01). |
| Control owner | The manager accountable for a control running and leaving its record. Agrees test dates, provides access to records and fixes deficiencies. |
| Performer | The person who carries out the control each time it runs. May not test it (CA-10). |
| Tester | The person who tests a control. Owns and performs none of the controls they test (CA-10). |
| Population | Every occurrence of the control in the testing period, taken by the tester from the system of record, with a check that the list is complete (CA-04). |
| Sample | The occurrences the tester chooses from the population, spread across the testing period. The owner never chooses them (CA-04, CA-05). |
| Attribute | One thing the tester checks on every sampled occurrence, such as "removed by the end of the last working day" or "approved before the change". Each control's attributes are listed with it. |
| Exception | A sampled occurrence that fails any attribute (CA-07, CA-08). |
| Deficiency | A design that would not keep the risk in check, or an operating test concluded Not effective. Rated High, Medium or Low (CA-12). |
| Testing period | The months the operating test covers: since the control was last tested, and never longer than its test cycle (CA-06). |
| Workpaper | The record of one test: population and its source, sample, attributes, results, exceptions, conclusion, tester and reviewer (CA-11). |
| Inspection | Reading a record the control left, such as a ticket, a log entry or a signed review. |
| Observation | Watching the control being done, such as a restore or a review meeting. Shows it can run; says nothing about other occasions. |
| Re-performance | Doing the control again from the same inputs and comparing the result, such as re-running a reconciliation. |
| Inquiry | Asking the owner or performer how it is done. Explains the evidence; never supports a conclusion on its own (CA-03). |
| Control assurance lead | The person who runs control testing: keeps the inventory and the plan, assigns testers, reviews workpapers, and rates deficiencies. Owns and performs no control in scope. |
| Workpaper reviewer | Checks that each workpaper supports its conclusion before it is final. Never reviews their own test. |
| CA-nn | The rules of the Control Testing Methodology, CA-01 to CA-20. CT-nn are the controls, EQ-nn the quality criteria and ET-nn the evidence types. A rule quoted with a pack, such as P13 JML-09, is that pack's. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, and its pilot round of tests, TR-2026-P. Clear the EXAMPLE rows before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 7.5 — Documented information | The workbook as a whole: the documented information that shows each control operated, and what makes it acceptable |
| ISO/IEC 27001:2022 | Clause 7.5.3 — Control of documented information | Obtaining and Keeping sheet: evidence protected from change, kept for a set period, then disposed of |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Evidence Check sheet: evidence that makes an evaluation's results, and the improvements identified from them, reliable |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | The workbook as a whole: the evidence standard on which a procedure to assess whether security measures are effective relies |
| NIS2 — Directive (EU) 2022/2555 | Article 32(2) — for essential entities, supervision includes on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | Evidence Check and Obtaining and Keeping sheets: records that show policies are applied, kept so they can be produced when a competent authority asks an essential entity for evidence of implementation. Keeping them is not supervision |
| NIS2 — Directive (EU) 2022/2555 | Article 33(2) — for important entities, supervision includes on-site inspections and off-site ex post supervision, targeted security audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | Evidence Check and Obtaining and Keeping sheets: the same records, which a competent authority may ask an important entity for after the event |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex point below; for others, a useful guide only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.1 — regularly review compliance with the network and information system security policies, topic-specific policies, rules and standards; “The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.” | Evidence Standards and By Control sheets, for those providers: the records a regular review of compliance with security policies, rules and standards checks, judged by one standard |
| DORA — Regulation (EU) 2022/2554 | Article 6(3) — financial entities minimise the impact of ICT risk through appropriate strategies, policies, procedures, ICT protocols and tools, and “shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request” | Obtaining and Keeping sheet, for financial entities: complete, current records that can be given to the competent authority on request |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 27(2)(l) — the sources of information for the review report: for financial entities other than microenterprises, the results of internal audits; the results of compliance assessments; results of digital operational resilience testing, including threat-led penetration testing where applicable; and external sources | Evidence Check sheet, for financial entities: evidence behind test results that can be one source for the review report. They are not the results of an internal audit |
| GDPR — Regulation (EU) 2016/679 | Article 5(2) — “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).” | Evidence Check and Obtaining and Keeping sheets: records that help a controller show that its security measures are in place |
| GDPR — Regulation (EU) 2016/679 | Article 24(1) — the controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is performed in accordance with the Regulation; “Those measures shall be reviewed and updated where necessary.” | By Control sheet: the record each control leaves, which lets a controller show that its measures operate and are reviewed |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.