Designed, or running? Decide for each one

Six controls, and everything that exists for each one. Nothing has been left out to make a point; this is the ordinary contents of an ordinary folder.

What the register calls it	What actually exists
Quarterly access review	An approved policy naming the cycle, and two completed reviews dated March and June
Change approval	Branch protection requiring one approval, enabled eighteen months ago
Incident threshold	A one-page definition with examples, approved in January
Staff training	A platform report showing 94 of 97 people completed the course
Alerting	A runbook, a paging rota, and a channel with eleven thousand messages in it
Backups	Nightly job history for the whole period, every night green

Before reading on: which of those six would you mark as running, and which as designed and no further? Say the number out loud. Most people land on three or four and the defensible figure is lower.

Predict

Of those six, how many have an artefact attached that shows the control operated during the period?

Choose one answer

Five — only the incident threshold is a document on its ownThree — the access review, the training report and the backupsTwo — the access review and the training reportOne — only the access review, because the training figure is self-reported

Lock in answer

The alerting row is the interesting one. Eleven thousand messages is a great deal of evidence that a channel exists. It is evidence of the control only if somebody can show what was acknowledged, by whom, and how long it took — and the ones nobody acknowledged, which is the half that makes the artefact worth reading.

Now do it for one of your own. The control below is chosen because it has the widest gap between the two columns of anything in the register: almost every organisation has the design, and a much smaller number have anything on the other side.

Decide · backup-restore-test

The restore you have not tried

A backup is a hypothesis and a restore is the experiment. Nearly every organisation has backups; a much smaller number have evidence that data came back out of one, into a working system, within a time anybody had agreed to. This control is about the second thing, and the first thing only matters because it is a precondition.

The decision

What you restore, how far you take it, and how often. A restore into a scratch environment proves the archive is readable; a restore that an application then successfully serves proves considerably more and costs considerably more. Deciding which of those you are claiming, and saying so, is the control. So is deciding what happens when the test fails, because a failed restore test during business hours is good news arriving at an inconvenient time.

Where this goes wrong

The backup job reports success and the success is monitored, which makes the whole area feel covered. Nothing in that signal speaks to whether the archive can be read, whether the schema still matches, or whether anybody holds the key, and each of those failures is silent right up until the restore that was not a test.

Does this apply to you?

Yes, it is ours to doNo, and I can say why

Record this decisionDecide whether it applies first.

Reading your own answer back

Three things are worth looking at in what you just recorded.

If you marked it running, name the artefact. Not the job history — the thing with a date on it that reports an outcome somebody did not choose in advance: what was restored, how long it took, who did it, and what went wrong on the way. A restore test with no problems listed is either a very clean system or a test that was written up rather than performed.

If you marked it in place, you have said the design exists and the instances do not yet. That is a precise and unembarrassing claim, and it is the one most registers would be more accurate for making. It also tells you exactly what the next quarter owes you.

Whoever you named as the person who notices when it stops: check whether they are the same person who performs it. If they are, the control's failure and its detection share a single point, and the honest version of the owner field is that nobody outside the activity would find out. That is the condition under which this lesson's whole framing weakens, and it is extremely common at small headcounts.

Check

A control is enforced continuously by a setting that will not let work proceed without it. There are no instances to count. What does operation evidence look like?

Choose one answer

The setting's own change history across the period, plus a sample from the population it governedThe current export of the setting, which shows it is onThere is none, because a continuous control has nothing to evidenceA statement from the person who owns the setting confirming it was never changed

Check answer

Worth remembering

• Sorting your own artefacts into design and operation is a two-minute exercise that most registers have never had done to them.
• A timestamp is not a record of the control: a settings export, a job history and a signed policy all carry dates and all speak to design.
• The question that separates the columns is whether the activity itself produced the artefact as a by-product.
• Marking a control as in place rather than running is a precise claim and usually the more accurate one.
• An owner who is also the performer means failure and detection share a single point, and the owner field then says less than it appears to.
• A continuously enforced control has no instances, so its operation evidence is the setting's change history plus a sample of the work it governed.