Part III · Chapter 6 · The Window · lesson 1

A photograph, or a film

11 min

Builds on What the document says, and the much larger thing it does not

A buyer's email says they need your report before the contract goes to legal. Four weeks. You have controls, you have evidence, and somebody tells you there is a version of this document you can get in four weeks.

There is. It is a different document.

Predict

Two reports on the same company. One says the controls were suitably designed as at the 30th of September. The other says they were suitably designed and operated throughout the twelve months to the 30th of September. How much more work is the second one?

A bit more — the same controls, with more evidence attachedRoughly double, because somebody has to sampleA different kind of work entirely — the first can be arranged this month, the second cannot be arranged at allLess, oddly — a longer period gives you more chances to show the control working

Two different claims wear the same cover.

One is about a date. On that day the controls described were in place and built in a way that could reasonably do the job. A photograph: somebody looked, and this is what was there.

The other is about a stretch of time. Across those months the controls were in place and they ran, repeatedly, and somebody tested instances of them running. A film: it has duration, and the duration is the evidence.

The first can be arranged in weeks because nothing in it depends on the past. The second depends entirely on the past, which means the only lever you have is when the period opens — and that lever only moves forwards.

Not the same thing

A moment

An opinion about controls as they stood on one stated date: described accurately, and designed in a way that could meet the objective.

Measured in: One date, and a set of controls described well enough that somebody could check the description against the thing
For example: A policy that exists, an access list reviewed and signed, a pipeline that refuses an unapproved merge, all observed on the 30th of September
Rests on: That design is a property you can see by looking, which for most controls it is
Chase it alone and: Nothing in it says the control ever ran twice. A setting correct on the date it was examined is compatible with that setting having been changed the week before and changed back

A period

An opinion about controls across a stated stretch of time: designed as above, and operating as described for the whole of it.

Measured in: Two dates, the instances the cadence implies between them, and a sample of those instances tested
For example: Four quarterly access reviews with four sets of dated approvals, eleven months of pipeline records, and the one month where the review slipped described rather than hidden
Rests on: That the evidence an operating control produced still exists, inside its own retention, for every month of the period
Chase it alone and: It is only ever about the past. A period that ended in June says nothing about July, which is the whole reason the gap letter in a later lesson exists

Both sides accept
Both are opinions about controls somebody described, formed by somebody independent, and neither of them is a statement that the organisation is secure. The difference is the axis: one has a date on it and the other has a length.

Which is which? Put each one on a side.

A screenshot of the production access list, taken the morning the reviewer asked for it
Four dated quarterly reviews, each with the approver's name, covering a year
A written policy, approved last month, saying access is re-approved quarterly
The deployment pipeline's own log, continuous, going back fourteen months
A buyer's question: has this been true since we signed, or is it true today?

Why buyers ask for the second and take the first

The procurement form asks for a report. It rarely asks which kind, and the two have names that differ by one word and a numeral, which is a detail that survives no email thread.

So this happens: a vendor sends the moment, the buyer's reviewer files it, and six months later somebody in that buyer's own audit asks whether the vendor's controls operated during the contract. Nobody set out to mislead anyone. The document answered a narrower question than the one being asked, and said so, on a page that is genuinely easy to skip.

The useful move is to be the one who names it. This report covers design as at the 30th of September; the period report opens on the 1st of November. Two clauses, both true, one of them a date. They cost you nothing you had, and they move the conversation from what you are hiding to what you are scheduling.

Check

You have a design-only report dated last month. A buyer asks whether your controls worked throughout the last year. What is the honest answer?

Yes — the controls in that report are the same controls that were running all yearThe report covers design on one date; operation over a period is a different examination, and here is when ours opensSend the report and let the reviewer read the scope sectionAsk the auditor to extend the existing report backwards to cover the year

The one case where the moment is the right documentOptional

A first-time organisation with nothing in place yet is in an awkward spot: the period report they want needs months they have not spent, and the months only start counting once the controls exist.

Taking the design-only report first is a reasonable sequence rather than a dodge. It gets an independent reader through the description while the clock on the period is running, and it gives the next conversation a concrete date rather than a promise.

What makes it a dodge is leaving it as the permanent answer. Two of these in successive years, with no period ever opening, is a pattern a reader will notice, and the reader who notices is usually the buyer's third one.

Worth remembering

A design opinion is about one date; a period opinion is about a stretch of time and the instances inside it.
Design can be arranged in weeks because none of it depends on the past; operation cannot be arranged at all, because the months either happened with the control running or they did not.
The only lever on a period is when it opens, and that lever moves in one direction.
Buyers ask for the period and accept the moment, because the two names differ by a word and nobody reads the page that distinguishes them.
Naming which document you have, and giving a date for the other, costs nothing and moves the conversation from concealment to scheduling.