Attach yours, and watch the contradictions appear

Everything so far has been about other people's folders. This one is yours.

Below, record what you actually hold. Not what you intend to hold, not what the policy says should exist — the artefacts you could put in somebody's hands this afternoon, each with the two things that decide what it is worth: whether it shows the control is designed or that it ran, and the date of the most recent one.

Three rules while you fill it in, and all three make the list worse-looking.

Only things that already exist. If you would have to go and make it, it does not go in. That is not a trick; it is the difference between this list and a plan.

Say what it shows honestly. The temptation is to mark a policy as operation evidence because the control does in fact run. The register is not checking up on you, and marking it design is the only way the arithmetic downstream means anything.

Put in the weak ones. The screenshot with no row count. The notes from the meeting. Leaving your weakest artefact out does not strengthen the bundle; it removes the only record of where the bundle is thin.

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

What you could hand over

Only what already exists, with a date on it. A policy is real evidence of design and no evidence at all of operation, which is why that is the second question.

What does it show?

It is designedIt ran

How often?onceon-changemonthlyquarterlyannualcontinuous

Most recent one

Add it

What does not line up

What your own artefacts do not line up with

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

What does not line up

And what your controls say about the same gap

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

Reading two panels that are describing one hole

The findings above arrive in two groups, and they are mostly the same problem seen from opposite ends.

From the evidence end: every artefact you recorded is reported as linked to no control, with the question what does it show, and of what? That is not a criticism of the artefact. The workspace stores what you hold; the line from an artefact to the control it speaks for is the one thing in this graph you have to draw in your own head, and the referee can see both ends of it and not the line. So it reports both ends.

From the control end: every control you marked as running with nothing attached is reported, with the question you met in the first lesson of this track. And anything where the only attached artefact shows design gets the sharper one — what did this control produce, on a date, the last time it ran?

The pairing exercise is therefore yours, done on paper or out loud, with the two panels side by side. Take each control marked running. Find the artefact in your list that would speak for it. Three outcomes, and the proportions are usually not what people expect.

1. There is one, and it shows operation. Say which, and move on. This is the pile that needs no work and is usually the smallest.
2. There is one, and it shows design. You have a policy for a control you say is running. Either the operation artefact exists and you have not recorded it — which happens often, because by-products do not feel like evidence — or it does not exist, and the status is ahead of the facts.
3. There is nothing. The honest moves are to change the status or to change the control so it produces something. Both are real work and neither is a paperwork exercise.

On the artefact that speaks for four controls

One pattern is worth looking for before you finish.

A single quarterly review often covers access, privilege separation, and a piece of the supplier question all at once. One artefact, three controls, and it feels efficient because it is.

It is also a single point of failure that the arithmetic cannot see. The quarter that review does not happen, three controls lose their only operation evidence simultaneously, and the register will show three separate gaps appearing in the same month for reasons nobody wrote down. Worth knowing which of your artefacts carry that much weight, because the cadence on those is the one that matters most and is usually set as casually as the others.

Check

A by-product artefact exists but nobody recorded it. What does that cost?

Choose one answer

Nothing, since the artefact exists whether or not it is listedThe control reads as unevidenced to everyone except one personIt makes the finding count higher than it should beThe artefact will be deleted, since nobody knows to retain it

Check answer

Worth remembering

• The list is only useful if it holds what already exists; anything you would have to go and make belongs on a plan instead.
• Marking a policy as operation evidence hides the one gap the arithmetic downstream could have found.
• Leaving your weakest artefact out removes the record of where the bundle is thin, which is the thing the list is for.
• The referee sees controls with nothing attached and artefacts attached to nothing — two reports describing the same missing line.
• A control marked running whose only artefact shows design is either an unrecorded by-product or a status ahead of the facts.
• An artefact undocumented is, from every seat but one, indistinguishable from an artefact that does not exist.
• One artefact speaking for several controls takes all of them down in the same month when it does not happen.