The control that ran twice in a period that wanted four

The control is a quarterly re-approval of who can reach production. The period is twelve months. Four instances were due.

Two happened. One in April, one in November. Both are immaculate: the right person reviewed them, the list is attached, three accounts were removed and the removals are dated. Nobody falsified anything and nobody was careless with the two that ran.

Two quarters have nothing in them at all.

What would you do

You are writing the description of this control for a period report, and you are the one who noticed the two empty quarters. The reviewer has not asked about them yet; the sample request lands next week and will name specific quarters.

The control owner moved teams in June. Nobody reassigned it, and nobody has done it since November, when a different person picked it up for reasons unrelated to the schedule. The policy on file says quarterly. Your largest customer contract does not mention a cadence; it mentions periodic review.

Optimising for

Being able to answer the next question without creating a second problem. Assume every description you write will be read alongside the sample request, and that somebody will ask to see the two missing quarters.

You cannot know

• Whether the reviewer's sample would have landed on a missing quarter anyway
• Whether access actually changed during the two quarters nobody reviewed
• Whether quarterly was ever the right cadence for this risk, or a number somebody wrote once
• How the buyer who reads the finished report weighs a described exception against a clean page
• Whether the person who moved teams in June knew the control was theirs

Choose an option

Describe it as a tested control: two instances examined, both without exception.Record the cadence as semi-annual, matching what actually happened, and describe two of two as complete.Describe it as designed quarterly, operated twice, not operated in two quarters, with the reason and what has changed.Run the review twice now, for the two missed quarters, and attach both.

Where this changes shape: whose promise was the cadence?

Everything above assumes quarterly meant something. Ask where the number came from.

If a customer contract or a regulator specifies the frequency, missing it is a breach of an external commitment and the description is the smaller of your problems. That is a conversation with a counterparty, and the report is just where they find out.

If the quarterly cadence was your own choice — somebody wrote a number in a policy three years ago and nobody has revisited it — then missing it is breaking a promise you made to yourself. That is still a real exception, because the description of the system said quarterly and the period is judged against the description. But the remedy is different and better: you can decide, now, with a dated decision and a reason, that this control runs semi-annually from here on, and then meet that.

The difference between that and option B is six words long and it is the whole thing: from here on, rather than all along. A cadence changed prospectively with a reason is a design decision. The same change applied backwards is a description that disagrees with your own files.

Check

Same situation, except all four quarterly reviews happened and the reviewer tested two of them, both clean. Does the sampling arithmetic from earlier in this track apply?

Choose one answer

Yes — two of four examined, so there is a bound on the other twoNo — four instances is too small a population for a confidence boundNo — if all four ran, the control operated and there is nothing to boundOnly if the two tested instances were chosen at random

Check answer

Worth remembering

• Two clean instances out of four due is a count, not a sample: nothing is unexamined, so there is no bound to compute and nothing to extend.
• Three descriptions are available and only one survives the next question: tested-control invites a request for the missing quarter, a rewritten cadence invites comparison with your own policy.
• The honest description names the designed cadence, the instances that ran, the ones that did not, and the reason — and the usual reason is an owner who changed teams.
• Whether the control ran is now fixed; how it is described is the only part still under your control, which makes describing it badly the more expensive mistake.
• A catch-up instance performed now is useful evidence about now and does not make a closed quarter happen.
• Changing a cadence prospectively with a dated reason is a design decision; changing it backwards is a description that disagrees with your own files.
• When the cadence came from a contract or a regulator rather than from you, the description is the smaller problem.