Control Test Workpaper Template
Standard workpaper recording population, sample, attributes tested, exceptions and conclusion.
Available soon
- Format
- Excel
- Size
- 113 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Copy the blank Workpaper sheet once for each test (right-click its tab, Move or Copy, Create a copy) and name the copy with the workpaper ID. Keep the blank sheet as your master. |
| 2 | Section 1: enter the control from the Control Inventory & Ownership Register, with its statement, owner, performer, key status and risk rating. The Attributes by Control sheet gives the source rule of each control in CISO Times packs; the inventory and the source document give its statement. Enter the testing period: from the end of the last tested period to the end of the period being tested, never longer than the test cycle (CA-06). |
| 3 | Name a tester who owns and performs none of the controls they test, and a reviewer who is not the tester (CA-10, CA-11). The independence check says when that is not so. |
| 4 | Section 2: walk one occurrence through, from start to record, before testing operation (CA-02). If the design could not keep the risk in check, choose Deficient: the operation is Not tested and a design deficiency is raised. |
| 5 | Section 3: take the population yourself from the system of record and check its count against a second source (CA-04). If the control has not run in the period, enter 0 and give the reason (CA-06). |
| 6 | Section 4: the workbook gives the sample size from the Sample Bands sheet (CA-05). Choose the items yourself, spread across the period. Then copy the control's attributes into section 5. |
| 7 | Section 6: test every attribute on every item by inspecting records, watching the control run or re-performing it (CA-03). Enter Pass, Fail or N/A and the evidence reference. For a deadline, enter the trigger date, the days allowed and the action date: the workbook works out the deadline and whether the action met it. |
| 8 | If section 7 says the sample must be extended, test the same number of new items again (CA-07). The conclusion in section 8 is then worked out from both. |
| 9 | Section 9: if a deficiency is raised, answer the three questions. The workbook proposes its severity and its dates (CA-12, CA-13). Record it in the Control Deficiency & Remediation Tracker with the same ID. |
| 10 | Section 10: enter the date of the last test step. The reviewer checks that the workpaper supports its conclusion and enters the date they signed, within 10 working days. The conclusion is final only then (CA-11). |
| 11 | File the workpaper with its evidence where the control owner cannot change it, and keep both for 3 years, or longer if law or a contract asks (CA-20). The two EXAMPLE sheets can stay as a guide or be deleted. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you test whether your security controls work. It is not legal advice, and a test result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law, a certification or a contract asks for an audit or an independent review, confirm with counsel, your certification body or the other party what it must include.
What a workpaper must hold (CA-11): the population and its source, the sample, the attributes, the result for each, the exceptions and the conclusion. Who signs: the tester, who proposes the conclusion, and the reviewer, who makes it final. Workpaper reviewer: the assurance lead, or for the lead's own tests, internal audit. CA-10 applies P08's IS-07: "Internal auditors must not audit their own work."
Control testing is not an internal audit, a certification audit, a P19 maturity assessment or a statement of compliance, and is never presented as one. Its results can feed each of them. A test does not show compliance with any law or standard.
CA-08 differs from P19's MA-05 on purpose. P19 rates a whole practice with its own checks, so a failure the practice caught itself is not a failure there. Here one control is tested, so a failure another control caught is still this control's exception. The other control counts when the deficiency is rated.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its pilot round TR-2026-P ran from 21 Sep 2026 to 25 Sep 2026 and tested 1 Mar 2026 to 31 Aug 2026. EXAMPLE WP-2026-02 is CT-13, urgent vulnerabilities fixed in time: Not effective, raising DF-01. EXAMPLE WP-2026-01 is CT-16, leavers' access removed: one exception, an extension, and Effective.
Limitations. The workbook checks the arithmetic and the rules, not the evidence. The reviewer still reads the evidence for each item. Working days count Monday to Friday only.
Tailoring — small organisation: if nobody inside can test a control independently, ask a colleague from another function, internal audit or a contracted tester (Tester: the assurance lead, a colleague from another function, internal audit, or a contracted tester). A test by the owner stays a self-check.
This workbook is your own record. Keep it with the test plan, the evidence and the deficiency tracker.
Workpaper
Control test workpaper
One test of one control (CA-11). Yellow cells are yours; the rest calculate. Copy this sheet for each test.
1. The control and the test
| Workpaper ID | One ID per test, for example WP-2026-01. Quote it in the deficiency tracker. | ||||||||||||||||
| Test round | The round or plan entry this test belongs to (Annual Control Testing Plan). | ||||||||||||||||
| Control ID | From the Control Inventory & Ownership Register. The Attributes by Control sheet lists CT-01 to CT-30. | ||||||||||||||||
| Control | |||||||||||||||||
| Control statement: who does what, how often, and the record it leaves | CA-01: the control is tested against this statement. With no written statement, the control has a design deficiency. | ||||||||||||||||
| Source rule | The rule the control comes from, with the document that sets it. | ||||||||||||||||
| Control owner | Agrees the test dates, gives access to records and fixes deficiencies. | ||||||||||||||||
| Performer: who runs it each time | May not test it (CA-10). | ||||||||||||||||
| Key control | A control whose failure, on its own, would let a risk on the register happen or go unnoticed, or that the organisation names as its evidence for an obligation. Key controls are never rated Lower risk. | ||||||||||||||||
| Risk rating when tested | From the inventory (CA-15). It sets the sample size and the test cycle on the Sample Bands sheet. | ||||||||||||||||
| Automated control (CA-09) | An automated control is tested once for each configuration, and that test holds only while change control over the system was itself tested effective for the same period. Otherwise it is tested as a manual control. | ||||||||||||||||
| Testing period from | From the end of the last tested period, or from when the control started. Never longer than the test cycle (CA-06). | ||||||||||||||||
| Testing period to | |||||||||||||||||
| Test cycle, months (calc) | From the risk rating: the longest time between operating tests (CA-15). | ||||||||||||||||
| Testing period check (calc) | |||||||||||||||||
| Tester | Owns and performs none of the controls they test (CA-10). | ||||||||||||||||
| Reviewer | Checks that each workpaper supports its conclusion before it is final. Never reviews their own test. For the assurance lead's own tests: internal audit. | ||||||||||||||||
| Independence check (calc) | No one tests a control they own or perform (P08 IS-07, P19 MA-14). A check by the owner is recorded as a self-check: it does not count as a test, and the control stays untested. | ||||||||||||||||
2. Design: walk one occurrence through (CA-01, CA-02)
| Occurrence walked through | A check that the control, as written and as set up, would prevent or detect the risk if it ran: a walkthrough of one occurrence from start to record (CA-02). | ||||||||||||||||
| Walkthrough date | |||||||||||||||||
| What the walkthrough showed | Whether the control, as written and set up, would prevent or detect the risk if it ran. Inspect the record it leaves; asking is never enough (CA-03). | ||||||||||||||||
| Design conclusion | Adequate: go on to the operating test. Deficient: stop. The operation is Not tested until the design is fixed, and the design deficiency is raised below (CA-01). | ||||||||||||||||
3. Population (CA-04)
| Source: system of record, report and filter | Take it yourself from the system of record, for the whole testing period. Never a list the owner prepared that you cannot check. | ||||||||||||||||
| Population: occurrences in the period | Enter 0 if the control has not run in the period: the operation is then Not tested, with the reason below (CA-06). | ||||||||||||||||
| Second source used to check completeness | A different system or record that should show the same occurrences, for example payroll leavers against HR leavers. | ||||||||||||||||
| Count in the second source | |||||||||||||||||
| Completeness check (calc) | Explain any difference in the population source before you choose the sample. | ||||||||||||||||
| Reason, if Not tested | For example: the control started after the period, or no event happened. Record when it can first be tested. | ||||||||||||||||
4. Sample (CA-05)
| Sample for the population band (calc) | From the Sample Bands sheet, by population and risk rating. "All" means every occurrence. | ||||||||||||||||
| Sample size (calc) | The sample size comes from the population band and the control's risk rating. When the population is no larger than the sample, every occurrence is tested. | ||||||||||||||||
| Chosen by the tester, spread across the period | Choose the items yourself, from every part of the period. The owner never chooses them (CA-04). | ||||||||||||||||
| How each item is tested (CA-03) | Inspection, Observation or Re-performance. Inquiry only explains what you saw; it never supports a conclusion on its own. | ||||||||||||||||
5. Attributes: what you check on every item
| Attribute 1 | Copy them from the Attributes by Control sheet, and add any a requirement you rely on the control for needs (CA-17). | ||||||||||||||||
| Attribute 2 | |||||||||||||||||
| Attribute 3 | |||||||||||||||||
| Attribute 4 | |||||||||||||||||
6. Results: the sampled items
One row per sampled item. Give each attribute Pass, Fail or N/A. An item that fails any attribute is an exception, even if another control later caught and corrected it (CA-08): say so in column Q. For a deadline, the date columns work out whether the action came in time.
| No. | Item reference | What it is (asset, person, record) | Category (e.g. priority) | Trigger date (e.g. detected, last working day) | Days allowed | Day count | Deadline (calc) | Action date (e.g. fixed, removed) | By the deadline (calc) | Attribute 1 | Attribute 2 | Attribute 3 | Attribute 4 | Item result (calc) | Caught by another control? (CA-08) | Evidence reference | Notes |
|---|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Items tested (calc) | 0 | ||||||||||||||||
| Exceptions (calc) | 0 | A sampled occurrence that fails any attribute (CA-07, CA-08). | |||||||||||||||
| Passed (calc) | Written as a count, never a percentage (CA-19). | ||||||||||||||||
7. Extension: only after one exception (CA-07)
| Extension needed (calc) | No | No exception: Effective. One exception in a manual control whose population is at least twice the sample: the tester adds the same number again, new occurrences chosen the same way, and concludes Effective only if none of them fails, recording the exception. Otherwise, and for any exception in an automated control (even one sampled as a manual control under CA-09) or in a whole population, Not effective. | |||||||||||||||
| Only when the line above says Yes. New occurrences, chosen the same way, never items already tested. | |||||||||||||||||
| No. | Item reference | What it is (asset, person, record) | Category (e.g. priority) | Trigger date (e.g. detected, last working day) | Days allowed | Day count | Deadline (calc) | Action date (e.g. fixed, removed) | By the deadline (calc) | Attribute 1 | Attribute 2 | Attribute 3 | Attribute 4 | Item result (calc) | Caught by another control? (CA-08) | Evidence reference | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Extension items tested (calc) | 0 | ||||||||
| Extension exceptions (calc) | 0 | ||||||||
8. Conclusion (CA-07, CA-08)
| Operating conclusion (calc) | Record the design conclusion | Effective, Not effective or Not tested. Worked out from the sections above; do not overwrite it. An Effective test with an exception still records it (CA-07). | |||||||||||||||
| Exceptions recorded on this test (calc) | 0 | A sampled occurrence that fails an attribute is an exception, even if another control later caught and corrected it. The other control counts when the deficiency is rated (CA-12), not when this control is concluded. | |||||||||||||||
| Tester's summary | What was found, in plain words: each exception, and anything another control caught. | ||||||||||||||||
9. Deficiency (CA-12, CA-13)
| Deficiency raised (calc) | Every design deficiency and every Not effective result is a deficiency (CA-12). | ||||||||||||||||
| Design or operating (calc) | |||||||||||||||||
| Deficiency ID | Its ID in the Control Deficiency & Remediation Tracker, which follows it to a passed retest (CA-14). | ||||||||||||||||
| A compensating control was tested effective | Another control that keeps the same risk in check when this one fails. It counts only once it has been tested and found effective (CA-12). | ||||||||||||||||
| The failure leaves a risk outside appetite, or a recorded unmet obligation, without its control | |||||||||||||||||
| The control ran; only its record falls short of the evidence standard | The Control Evidence Standards Checklist sets what acceptable evidence looks like. | ||||||||||||||||
| Proposed severity (calc) | High: a key control failed and no compensating control was tested effective, or the failure leaves a risk outside appetite or a recorded unmet obligation without its control. Medium: a key control failed but a compensating control was tested effective, or a control that is not key failed. Low: the control ran, but its record falls short of the evidence standard. The control assurance lead confirms the rating. | ||||||||||||||||
| Next operating test due by (calc) | The end of the testing period plus the test cycle. A control that failed its last test is Higher risk until a retest passes (CA-15). | ||||||||||||||||
10. Sign-off (CA-11)
| Last test step: date | The tester enters the date of the last test step and signs the workpaper by entering their name above. | ||||||||||||||||
| Review by (calc): 10 working days later | Monday to Friday. Add your public holidays as a third argument to WORKDAY if you need them. | ||||||||||||||||
| Reviewer signed on | Someone other than the tester reviews it within [[10]] working days of the last test step; the conclusion is final only when they sign. | ||||||||||||||||
| Workpaper status (calc) | |||||||||||||||||
| Remediation plan agreed by (calc): 10 working days | Counted from the day the reviewer confirms the deficiency (CA-13). | ||||||||||||||||
| Deficiency fixed by (calc) | 90 days for High, 180 for Medium, 365 for Low, in calendar days from the reviewer's confirmation (CA-13). Track it in the Control Deficiency & Remediation Tracker. | ||||||||||||||||
| Keep until | Workpapers and the evidence they rely on are kept for [[3]] years, or longer where law or a contract asks, where the tester and reviewer can reach them and the control owner cannot change them. | ||||||||||||||||
EXAMPLE WP-2026-02
Control test workpaper — EXAMPLE WP-2026-02
EXAMPLE: workpaper WP-2026-02 from the pilot round TR-2026-P (21 Sep 2026 to 25 Sep 2026) of a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Tested by its Quality and Compliance Manager, reviewed by its Internal Audit Manager. The guidance for each line is on the blank Workpaper sheet.
1. The control and the test
| Workpaper ID | WP-2026-02 | ||||||||
| Test round | TR-2026-P | ||||||||
| Control ID | CT-13 | ||||||||
| Control | Urgent vulnerabilities fixed in time | ||||||||
| Control statement: who does what, how often, and the record it leaves | Priority 1 vulnerabilities are fixed within 7 days of first detection, and Priority 2 within 14 days, counted in calendar days. | ||||||||
| Source rule | P01 VM-08 (P01-A02) | ||||||||
| Control owner | Head of IT | ||||||||
| Performer: who runs it each time | Asset owner | ||||||||
| Key control | Yes | ||||||||
| Risk rating when tested | Standard | ||||||||
| Automated control (CA-09) | No | ||||||||
| Testing period from | 1 Mar 2026 | ||||||||
| Testing period to | 31 Aug 2026 | ||||||||
| Test cycle, months (calc) | 12 | ||||||||
| Testing period check (calc) | Within the test cycle | ||||||||
| Tester | Quality and Compliance Manager | ||||||||
| Reviewer | Internal Audit Manager | ||||||||
| Independence check (calc) | Independent | ||||||||
2. Design: walk one occurrence through (CA-01, CA-02)
| Occurrence walked through | [[the occurrence walked through, from start to record]] | ||||||||
| Walkthrough date | |||||||||
| What the walkthrough showed | [[what the walkthrough showed]] | ||||||||
| Design conclusion | Adequate | ||||||||
3. Population (CA-04)
| Source: system of record, report and filter | Remediation tracker export of Priority 1 and 2 findings due 1 Mar to 31 Aug 2026 | ||||||||
| Population: occurrences in the period | 34 | ||||||||
| Second source used to check completeness | 34 findings agreed to the scanner's list of Priority 1 and 2 detections for the same months | ||||||||
| Count in the second source | 34 | ||||||||
| Completeness check (calc) | Agrees | ||||||||
| Reason, if Not tested | |||||||||
4. Sample (CA-05)
| Sample for the population band (calc) | 5 | ||||||||
| Sample size (calc) | 5 | ||||||||
| Chosen by the tester, spread across the period | Yes | ||||||||
| How each item is tested (CA-03) | Inspection | ||||||||
5. Attributes: what you check on every item
| Attribute 1 | Fixed by the deadline its priority sets, counted from first detection | ||||||||
| Attribute 2 | The fix was confirmed by a rescan | ||||||||
| Attribute 3 | A miss was deferred as an exception before the deadline (P17 PM-14) | ||||||||
| Attribute 4 | |||||||||
6. Results: the sampled items
One row per sampled item. Give each attribute Pass, Fail or N/A. An item that fails any attribute is an exception, even if another control later caught and corrected it (CA-08): say so in column Q. For a deadline, the date columns work out whether the action came in time.
| No. | Item reference | What it is (asset, person, record) | Category (e.g. priority) | Trigger date (e.g. detected, last working day) | Days allowed | Day count | Deadline (calc) | Action date (e.g. fixed, removed) | By the deadline (calc) | Attribute 1 | Attribute 2 | Attribute 3 | Attribute 4 | Item result (calc) | Caught by another control? (CA-08) | Evidence reference | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | VUL-2026-0187 | Ordering platform web server | P2 | 10 Mar 2026 | 14 | Calendar | 24 Mar 2026 | 19 Mar 2026 | Yes | Pass | Pass | N/A | Pass | Rescanned 20 Mar 2026. | |||
| 2 | VUL-2026-0233 | Perimeter firewall | P1 | 14 Apr 2026 | 7 | Calendar | 21 Apr 2026 | 17 Apr 2026 | Yes | Pass | Pass | N/A | Pass | Rescanned 18 Apr 2026. | |||
| 3 | VUL-2026-0301 | Ordering platform database server | P2 | 2 Jun 2026 | 14 | Calendar | 16 Jun 2026 | 29 Jun 2026 | No | Fail | Pass | Fail | Exception | Rescanned 30 Jun 2026. Fixed after the deadline, with no deferral requested. | |||
| 4 | VUL-2026-0318 | Remote access gateway | P1 | 9 Jun 2026 | 7 | Calendar | 16 Jun 2026 | 22 Jun 2026 | No | Fail | Pass | Fail | Exception | Rescanned 23 Jun 2026. Fixed after the deadline, with no deferral requested. | |||
| 5 | VUL-2026-0402 | ERP application server | P2 | 21 Jul 2026 | 14 | Calendar | 4 Aug 2026 | 30 Jul 2026 | Yes | Pass | Pass | N/A | Pass | Rescanned 31 Jul 2026. |
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Items tested (calc) | 5 | ||||||||
| Exceptions (calc) | 2 | ||||||||
| Passed (calc) | 3 of 5 | ||||||||
7. Extension: only after one exception (CA-07)
| Extension needed (calc) | No | ||||||||||||||||
| Only when the line above says Yes. New occurrences, chosen the same way, never items already tested. | |||||||||||||||||
| No. | Item reference | What it is (asset, person, record) | Category (e.g. priority) | Trigger date (e.g. detected, last working day) | Days allowed | Day count | Deadline (calc) | Action date (e.g. fixed, removed) | By the deadline (calc) | Attribute 1 | Attribute 2 | Attribute 3 | Attribute 4 | Item result (calc) | Caught by another control? (CA-08) | Evidence reference | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Extension items tested (calc) | 0 | ||||||||
| Extension exceptions (calc) | 0 | ||||||||
8. Conclusion (CA-07, CA-08)
| Operating conclusion (calc) | Not effective | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Exceptions recorded on this test (calc) | 2 | ||||||||
| Tester's summary | VUL-2026-0301 and VUL-2026-0318 were fixed after their June deadlines, with no deferral requested (P17 PM-14). Two exceptions: Not effective. P19's assessment found the same misses (MP-18). | ||||||||
9. Deficiency (CA-12, CA-13)
| Deficiency raised (calc) | Yes | ||||||||
| Design or operating (calc) | Operating | ||||||||
| Deficiency ID | DF-01 | ||||||||
| A compensating control was tested effective | No | ||||||||
| The failure leaves a risk outside appetite, or a recorded unmet obligation, without its control | No | ||||||||
| The control ran; only its record falls short of the evidence standard | No | ||||||||
| Proposed severity (calc) | High | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Next operating test due by (calc) | 28 Feb 2027 | ||||||||
10. Sign-off (CA-11)
| Last test step: date | 22 Sep 2026 | ||||||||
| Review by (calc): 10 working days later | 6 Oct 2026 | ||||||||
| Reviewer signed on | 28 Sep 2026 | ||||||||
| Workpaper status (calc) | Final: reviewed in time | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Remediation plan agreed by (calc): 10 working days | 12 Oct 2026 | ||||||||
| Deficiency fixed by (calc) | 27 Dec 2026 | ||||||||
| Keep until | [[3 years after the reviewer signed, or longer where law or a contract asks]] | ||||||||
EXAMPLE WP-2026-01
Control test workpaper — EXAMPLE WP-2026-01
EXAMPLE: workpaper WP-2026-01 from the pilot round TR-2026-P (21 Sep 2026 to 25 Sep 2026) of a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Tested by its Quality and Compliance Manager, reviewed by its Internal Audit Manager. The guidance for each line is on the blank Workpaper sheet.
1. The control and the test
| Workpaper ID | WP-2026-01 | ||||||||
| Test round | TR-2026-P | ||||||||
| Control ID | CT-16 | ||||||||
| Control | Leavers' access removed | ||||||||
| Control statement: who does what, how often, and the record it leaves | A leaver's access is removed from every system, including local accounts, by the end of their last working day; for an urgent leaver within 60 minutes of the decision. | ||||||||
| Source rule | P13 JML-09 (P13-A02) | ||||||||
| Control owner | Head of IT | ||||||||
| Performer: who runs it each time | System administrator | ||||||||
| Key control | Yes | ||||||||
| Risk rating when tested | Standard | ||||||||
| Automated control (CA-09) | No | ||||||||
| Testing period from | 1 Mar 2026 | ||||||||
| Testing period to | 31 Aug 2026 | ||||||||
| Test cycle, months (calc) | 12 | ||||||||
| Testing period check (calc) | Within the test cycle | ||||||||
| Tester | Quality and Compliance Manager | ||||||||
| Reviewer | Internal Audit Manager | ||||||||
| Independence check (calc) | Independent | ||||||||
2. Design: walk one occurrence through (CA-01, CA-02)
| Occurrence walked through | [[the occurrence walked through, from start to record]] | ||||||||
| Walkthrough date | |||||||||
| What the walkthrough showed | [[what the walkthrough showed]] | ||||||||
| Design conclusion | Adequate | ||||||||
3. Population (CA-04)
| Source: system of record, report and filter | HR system leavers report, 1 Mar to 31 Aug 2026 | ||||||||
| Population: occurrences in the period | 38 | ||||||||
| Second source used to check completeness | 38 leavers agreed to the payroll system's leavers for the same months | ||||||||
| Count in the second source | 38 | ||||||||
| Completeness check (calc) | Agrees | ||||||||
| Reason, if Not tested | |||||||||
4. Sample (CA-05)
| Sample for the population band (calc) | 5 | ||||||||
| Sample size (calc) | 5 | ||||||||
| Chosen by the tester, spread across the period | Yes | ||||||||
| How each item is tested (CA-03) | Inspection | ||||||||
5. Attributes: what you check on every item
| Attribute 1 | Every account disabled by the end of the last working day in the HR record | ||||||||
| Attribute 2 | Removal recorded in the provisioning log | ||||||||
| Attribute 3 | |||||||||
| Attribute 4 | |||||||||
6. Results: the sampled items
One row per sampled item. Give each attribute Pass, Fail or N/A. An item that fails any attribute is an exception, even if another control later caught and corrected it (CA-08): say so in column Q. For a deadline, the date columns work out whether the action came in time.
| No. | Item reference | What it is (asset, person, record) | Category (e.g. priority) | Trigger date (e.g. detected, last working day) | Days allowed | Day count | Deadline (calc) | Action date (e.g. fixed, removed) | By the deadline (calc) | Attribute 1 | Attribute 2 | Attribute 3 | Attribute 4 | Item result (calc) | Caught by another control? (CA-08) | Evidence reference | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | L-2026-014 | Leaver | 13 Mar 2026 | 0 | Calendar | 13 Mar 2026 | 13 Mar 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 2 | L-2026-022 | Leaver | 10 Apr 2026 | 0 | Calendar | 10 Apr 2026 | 10 Apr 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 3 | L-2026-031 | Leaver | 15 May 2026 | 0 | Calendar | 15 May 2026 | 3 Jun 2026 | No | Fail | Pass | Exception | CT-18: still this control's exception (CA-08) | ERP account left enabled; found and disabled by the May reconciliation (CT-18) on 3 Jun 2026 | ||||
| 4 | L-2026-040 | Leaver | 26 Jun 2026 | 0 | Calendar | 26 Jun 2026 | 26 Jun 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 5 | L-2026-047 | Leaver | 7 Aug 2026 | 0 | Calendar | 7 Aug 2026 | 7 Aug 2026 | Yes | Pass | Pass | Pass | Same day, all systems |
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Items tested (calc) | 5 | ||||||||
| Exceptions (calc) | 1 | ||||||||
| Passed (calc) | 4 of 5 | ||||||||
7. Extension: only after one exception (CA-07)
| Extension needed (calc) | Yes: test 5 more, chosen the same way | ||||||||||||||||
| Only when the line above says Yes. New occurrences, chosen the same way, never items already tested. | |||||||||||||||||
| No. | Item reference | What it is (asset, person, record) | Category (e.g. priority) | Trigger date (e.g. detected, last working day) | Days allowed | Day count | Deadline (calc) | Action date (e.g. fixed, removed) | By the deadline (calc) | Attribute 1 | Attribute 2 | Attribute 3 | Attribute 4 | Item result (calc) | Caught by another control? (CA-08) | Evidence reference | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | L-2026-018 | Leaver | 27 Mar 2026 | 0 | Calendar | 27 Mar 2026 | 27 Mar 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 2 | L-2026-027 | Leaver | 30 Apr 2026 | 0 | Calendar | 30 Apr 2026 | 30 Apr 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 3 | L-2026-035 | Leaver | 29 May 2026 | 0 | Calendar | 29 May 2026 | 29 May 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 4 | L-2026-043 | Leaver | 17 Jul 2026 | 0 | Calendar | 17 Jul 2026 | 17 Jul 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
| 5 | L-2026-051 | Leaver | 28 Aug 2026 | 0 | Calendar | 28 Aug 2026 | 28 Aug 2026 | Yes | Pass | Pass | Pass | Same day, all systems | |||||
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Extension items tested (calc) | 5 | ||||||||
| Extension exceptions (calc) | 0 | ||||||||
8. Conclusion (CA-07, CA-08)
| Operating conclusion (calc) | Effective | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Exceptions recorded on this test (calc) | 1 | ||||||||
| Tester's summary | L-2026-031's ERP account stayed enabled for 19 days after the last working day. The May reconciliation (CT-18) found and disabled it. One exception, so five more leavers were tested (CA-07): none failed. Effective, with the exception recorded and CT-18 noted as having caught it (CA-08). | ||||||||
9. Deficiency (CA-12, CA-13)
| Deficiency raised (calc) | No | ||||||||
| Design or operating (calc) | |||||||||
| Deficiency ID | |||||||||
| A compensating control was tested effective | |||||||||
| The failure leaves a risk outside appetite, or a recorded unmet obligation, without its control | |||||||||
| The control ran; only its record falls short of the evidence standard | |||||||||
| Proposed severity (calc) | |||||||||
| Next operating test due by (calc) | 31 Aug 2027 | ||||||||
10. Sign-off (CA-11)
| Last test step: date | 21 Sep 2026 | ||||||||
| Review by (calc): 10 working days later | 5 Oct 2026 | ||||||||
| Reviewer signed on | 28 Sep 2026 | ||||||||
| Workpaper status (calc) | Final: reviewed in time | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Remediation plan agreed by (calc): 10 working days | |||||||||
| Deficiency fixed by (calc) | |||||||||
| Keep until | [[3 years after the reviewer signed, or longer where law or a contract asks]] | ||||||||
Sample Bands
Sample bands and settings
The Workpaper sheet's formulas read these tables. The sample size comes from the population band and the control's risk rating. When the population is no larger than the sample, every occurrence is tested.
Sample size by population and risk rating (CA-05)
| Population from | Population to | Standard or Lower risk | Higher risk | Typical control |
|---|---|---|---|---|
| 1 | 2 | All | All | An annual control, or a quarterly one tested over six months |
| 3 | 12 | 2 | 3 | A quarterly or monthly control |
| 13 | 52 | 5 | 10 | A weekly control, or events a few times a month |
| 53 | 250 | 20 | 30 | A daily control, or events most working days |
| 251 | and above | 25 | 40 | A control that runs many times a day |
| These are the pack's defaults, in line with common practice for testing recurring controls. They are not statistical samples. You may raise them; never lower them. | ||||
Risk ratings and test cycles (CA-15)
| Risk rating | Test at least every (months) | Sample column |
|---|---|---|
| Higher | 6 | higher |
| Standard | 12 | standard |
| Lower | 24 | standard |
A key control is never Lower risk. A control that failed its last test is Higher until a retest passes.
Days to fix a deficiency, by severity (CA-13)
| Severity | Calendar days |
|---|---|
| High | 90 |
| Medium | 180 |
| Low | 365 |
Working-day settings
| Setting | Working days |
|---|---|
| Reviewer signs within | 10 |
| Remediation plan agreed within | 10 |
Yellow values are the pack's defaults. Change them only in line with your Control Testing Methodology; every workpaper sheet uses them.
Attributes by Control
Attributes by control
The 30 controls the published CISO Times packs set, each with the attributes a tester checks on every sampled item. Copy a control's attributes into section 5 of a workpaper (Paste Special, Transpose). Add attributes a requirement you rely on the control for needs (CA-17). Restore testing is not in this list: no published CISO Times pack sets a rule for it yet. Add your own controls on the rows below.
| Control ID | Control | Source rule | Source document | How often | Performed by | Evidence type | Attribute 1 | Attribute 2 | Attribute 3 |
|---|---|---|---|---|---|---|---|---|---|
| CT-01 | Board report from checked figures | P03 BR-08 | P03-A05 | Quarterly | Security reporter | ET-02 Review or sign-off | Every figure in the deck appears in the workbook | The workbook was signed off before the deck's date | The sign-off is by someone other than the person who compiled the figures |
| CT-02 | Policy reviews on time | P04 PF-06 | P04-A02 | As it falls due | Document owner | ET-02 Review or sign-off | The review is recorded on or before the due date the register shows | The review was approved at the level the document's tier requires | The register shows the next review date |
| CT-03 | Joiners acknowledge policies | P04 PF-09 | P04-A02 | As it happens | HR | ET-05 Training or acknowledgement | Acknowledged within 10 working days of the start date in the HR record | The acknowledgement names the policies and their versions | |
| CT-04 | Quarterly risk review | P05 RM-09 | P05-A02 | Quarterly | Risk owner | ET-02 Review or sign-off | The risk was reviewed in the quarter | The review records a decision: rating confirmed or changed, treatment on track or not | The reviewer is the risk owner the register names |
| CT-05 | Exceptions approved and renewed in time | P02 EX-05, EX-06, EX-10 | P02-A02 | As it happens | Exception approver | ET-01 Approval before action | Approved by the approver the band requires, before the exception took effect | Expiry no later than the band allows | On expiry: remediated, renewed or escalated within the grace period |
| CT-06 | Monthly exception register review | P02 EX-11 | P02-A02 | Monthly | Information security | ET-02 Review or sign-off | A review is recorded for the month | Exceptions due to expire within 30 days were chased | Expired exceptions were escalated |
| CT-07 | Tier 1 suppliers reassessed in time | P06 TP-09 | P06-A02 | As it falls due | Supplier assessor | ET-02 Review or sign-off | Reassessed within 12 months of the last assessment | The assessment records a decision and who made it | Findings have owners and deadlines |
| CT-08 | Metric inputs checked before reporting | P11 MR-05, MR-06 | P11-A02 | Monthly | Metric validator | ET-04 Reconciliation | Each input in the cycle has the three checks recorded | The validator is not the supplier | A failed input was corrected, caveated or withheld |
| CT-09 | NIS2 readiness self-assessed | P12 NR-08 | P12-A04 | Every six months | NIS2 lead | ET-02 Review or sign-off | Completed within 6 months of the last one | Every item has a level and its evidence | Gaps found are in the gap tracker with owners |
| CT-10 | Board members trained | P12 NR-05 | P12-A06 | As it falls due | Board secretary | ET-05 Training or acknowledgement | Trained within 12 months of the last training, or 3 months of appointment | Attendance and content recorded | |
| CT-11 | Information register reviewed | P15 CL-03, CL-12 | P15-A02 | As it happens | Information owner | ET-07 Register kept current | Entry reviewed within 12 months | A change was reviewed within 15 working days | |
| CT-12 | Disposal certificates collected | P15 CL-11 | P15-A02 | As it happens | Records custodian | ET-03 Action within a deadline | Every Confidential item collected is on the certificate | Certificate received within 10 working days of collection | |
| CT-13 | Urgent vulnerabilities fixed in time | P01 VM-08 | P01-A02 | As it happens | Asset owner | ET-03 Action within a deadline | Fixed by the deadline its priority sets, counted from first detection | The fix was confirmed by a rescan | A miss was deferred as an exception before the deadline (P17 PM-14) |
| CT-14 | Vendor releases reviewed | P17 PM-03 | P17-A02 | As it happens | IT Operations | ET-03 Action within a deadline | Reviewed within 1 working day of release | Rated with the P01 model | Routed to a cycle |
| CT-15 | Missed patch deadlines deferred | P17 PM-14 | P17-A02 | As it happens | System owner | ET-01 Approval before action | Requested before the deadline | Approved by the band's approver | Expiry no later than the band allows |
| CT-16 | Leavers' access removed | P13 JML-09 | P13-A02 | As it happens | System administrator | ET-03 Action within a deadline | Every account disabled by the end of the last working day in the HR record | Removal recorded in the provisioning log | |
| CT-17 | Movers' old access removed | P13 JML-08 | P13-A02 | As it happens | System administrator | ET-03 Action within a deadline | Old access removed on the move date, or within the handover window | Any access kept was requested as non-standard | |
| CT-18 | Monthly account reconciliation | P13 JML-15 | P13-A02 | Monthly | Access coordinator | ET-04 Reconciliation | Run within 3 working days of month end | Every in-scope system included | Orphaned accounts disabled within 1 working day |
| CT-19 | User access reviews | P07 AR-02, AR-07 | P07-A02 | Every six months | Campaign coordinator | ET-02 Review or sign-off | The review covered the system in its interval | Every decision recorded by the reviewer the scope names | Removals made within the window and confirmed against a fresh extract |
| CT-20 | Privileged access reviewed | P14 PA-16 | P14-A02 | Quarterly | System owner with information security | ET-02 Review or sign-off | Reviewed within 3 months of the last review | Every privileged account has a decision | Removals made and confirmed |
| CT-21 | Break-glass accounts tested and every use reviewed | P14 PA-12 | P14-A02 | Quarterly | Head of Information Security | ET-06 Test or exercise | Tested within 3 months of the last test | Every sign-in in the period was declared and reviewed | |
| CT-22 | Security induction completed | P16 AW-05 | P16-A02 | As it happens | Awareness lead | ET-05 Training or acknowledgement | Completed within 10 working days of the start date in the HR record | ||
| CT-23 | Annual security course completed | P16 AW-04 | P16-A02 | As it falls due | Awareness lead | ET-05 Training or acknowledgement | Completed within 12 months of the last completion | ||
| CT-24 | Post-incident review held | P09 IM-11 | P09-A02 | As it happens | Incident manager | ET-03 Action within a deadline | Review held within 10 working days of closure | Every action has an owner and a due date | The risks it touched were sent for reassessment |
| CT-25 | Incident response exercised | P10 EX-02 | P10-A02 | As it falls due | Exercise lead | ET-06 Test or exercise | Each audience exercised within its interval | A live incident was not counted as an exercise | |
| CT-26 | After-action report approved | P10 EX-09 | P10-A12 | As it happens | Exercise sponsor | ET-03 Action within a deadline | Approved within 10 working days | Every objective rated | |
| CT-27 | Notification readiness checked | P18 RN-17 | P18-A08 | Every six months | Head of Information Security | ET-06 Test or exercise | Checklist completed within 6 months | Each signatory's channel access tested within 12 months | |
| CT-28 | Maturity assessed each year | P19 MA-17 | P19-A03 | Annual | Assessment lead | ET-02 Review or sign-off | Fieldwork ended within 12 months of the last | The lead rated no practice they own or run | |
| CT-29 | Supplier High findings escalated | P06 TP-08 | P06-A02 | As it happens | Supplier relationship owner | ET-02 Review or sign-off | Owner and deadline recorded | A High finding past its deadline was escalated | |
| CT-30 | Triggered risk reassessment | P05 RM-10 | P05-A02 | As it happens | Risk owner | ET-02 Review or sign-off | Reassessed within 10 working days of the trigger | The reassessment recorded the trigger |
Lists
| YesNo | Design | Result | DayCount | Method | Priority | PriorityDays |
|---|---|---|---|---|---|---|
| Yes | Adequate | Pass | Calendar | Inspection | P1 | 7 |
| No | Deficient | Fail | Working | Observation | P2 | 14 |
| N/A | Re-performance | P3 | 30 | |||
| Inquiry | P4 | 90 |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Control | Something done routinely to keep a risk in check, written as who does what, how often, and the record it leaves (CA-01). |
| Key control | A control whose failure, on its own, would let a risk on the register happen or go unnoticed, or that the organisation names as its evidence for an obligation. Key controls are never rated Lower risk. |
| Control owner | The manager accountable for a control running and leaving its record. Agrees test dates, provides access to records and fixes deficiencies. |
| Performer | The person who carries out the control each time it runs. May not test it (CA-10). |
| Tester | The person who tests a control. Owns and performs none of the controls they test (CA-10). |
| Workpaper reviewer | Checks that each workpaper supports its conclusion before it is final. Never reviews their own test. |
| Design test (walkthrough) | A check that the control, as written and as set up, would prevent or detect the risk if it ran: a walkthrough of one occurrence from start to record (CA-02). |
| Operating test | A check, on a sample chosen by the tester, that the control ran as designed throughout the testing period (CA-04 to CA-07). |
| Testing period | The months the operating test covers: since the control was last tested, and never longer than its test cycle (CA-06). |
| Population | Every occurrence of the control in the testing period, taken by the tester from the system of record, with a check that the list is complete (CA-04). |
| Sample | The occurrences the tester chooses from the population, spread across the testing period. The owner never chooses them (CA-04, CA-05). |
| Attribute | One thing the tester checks on every sampled occurrence, such as "removed by the end of the last working day" or "approved before the change". Each control's attributes are listed with it. |
| Exception | A sampled occurrence that fails any attribute (CA-07, CA-08). |
| Extension | The further items CA-07 asks for after one exception in a manual control whose population is at least twice the sample: the same number again, chosen the same way. |
| Effective | No exception; or one exception, an extension, and no exception among the added items (CA-07). Any exception is still recorded. |
| Not effective | Any other result with an exception, including any exception in an automated control or when every occurrence was tested (CA-07). |
| Not tested | No operating test was made: the design was deficient (CA-01), or the control did not run in the period, with the reason (CA-06). |
| Deficiency | A design that would not keep the risk in check, or an operating test concluded Not effective. Rated High, Medium or Low (CA-12). |
| Compensating control | Another control that keeps the same risk in check when this one fails. It counts only once it has been tested and found effective (CA-12). |
| Retest | An operating test of a fixed control, made after it has run enough times to sample, by someone other than its owner. A deficiency closes only on a retest that passes (CA-14). |
| Workpaper | The record of one test: population and its source, sample, attributes, results, exceptions, conclusion, tester and reviewer (CA-11). |
| Days allowed and day count | For an attribute with a deadline: the days the control allows, counted in calendar or working days (Monday to Friday). 0 means the same day as the trigger. |
| CA-nn, CT-nn | The rules (CA-01 to CA-20) of the Control Testing Methodology, and the controls (CT-01 to CT-30) of the Control Inventory & Ownership Register. |
| (calc) | A cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, pilot round TR-2026-P. People are named by role. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.36 — Compliance with policies, rules and standards for information security | Workpaper sheet: a test of whether a control the organisation's policies and standards set operated as written |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Sections 8 and 9: the improvement each test identifies, as a deficiency with its severity and dates |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Workpaper sheet: the record of one test of whether a cybersecurity risk-management measure is effective |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex point below; for others, a useful guide only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them | Workpaper sheet: who tests, the method, the testing period, and who reviews the result, recorded the same way for every test |
| DORA — Regulation (EU) 2022/2554 | Article 6(3) — financial entities minimise the impact of ICT risk through appropriate strategies, policies, procedures, ICT protocols and tools, and “shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request” | For financial entities: a complete, reviewed record of each test, ready to give the competent authority on request |
| DORA — Regulation (EU) 2022/2554 | Article 16(1)(g) — the entities under the simplified ICT risk management framework, to which Articles 5 to 15 do not apply, “test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c)” | For financial entities under the simplified framework: the record of each regular test of a control's effectiveness |
| GDPR — Regulation (EU) 2016/679 | Article 5(2) — “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).” | Workpaper and EXAMPLE sheets: a record a controller can use to show its security measures operate |
| GDPR — Regulation (EU) 2016/679 | Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing” | The workbook as a whole: one record in a process for regularly testing the effectiveness of security measures |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.