Part IV · Chapter 7 · The Audit · lesson 12
The questions your own register cannot answer yet
14 min
Builds on The first thing that does not line up
Part IV · Chapter 7 · The Audit · lesson 12
14 min
Builds on The first thing that does not line up
The referee in this subject produces one number, and it is the only number anywhere in the Compliance Lab. It counts the things in your own register that contradict each other.
Read what follows carefully, because it is the opposite of what a number in a compliance tool normally means.
It is not a measure of where you stand. It does not get better as you improve. It gets longer every time you write something honest down — declare a period, and the evidence that falls outside it becomes visible; mark a control as running, and the missing artefact becomes visible; name a risk you would rather not have named, and a treatment with nothing behind it appears. The list grows as you get more honest and shrinks only when you do actual work.
Which is also why it is useless to anybody who wants to screenshot something. Nobody sends a customer a number they have been deliberately making bigger, and nothing here can tell you whether you are compliant.
Every row is not a deduction. It is a question somebody would ask.
The engine does one thing: it compares two things you wrote and reports where they disagree. A control marked running with nothing attached that could show it ran. A risk accepted with nobody named. An artefact whose period does not touch your window. A control last reviewed before the risk it addresses last changed.
None of that requires an opinion about your security, which is exactly why it can be done honestly by a machine. Sufficiency is a judgement that moves with the auditor, the boundary and the year, and no amount of software has access to it.
So the output is phrased as questions, and the questions are the ones from lesson four with your own data in them.
The fourteen rules the engine can produce sort almost perfectly onto the three questions in lesson four, which is not a coincidence — the rules were written from the same place the questions come from.
Who approved this. A control excluded with no justification recorded. A control in place with nobody named as owning it. A risk accepted with nobody named as having accepted it. Each one is the authority question with the name missing, and each one is answerable in a minute by somebody who knows the answer.
Show me the one from March. A control marked running with no evidence linked. A control marked running where everything linked speaks to design rather than operation. An artefact whose period does not overlap your window at all. An artefact that is older than its own cadence allows by the end of your period. A control whose expected instances should have produced something inside the window and nothing is recorded. All five are the history question, asked arithmetically.
What happened the time it failed. Nothing. There is no rule for it, and that absence is the honest edge of this whole workspace — see below.
The remaining rules are structural: a risk to be mitigated that names no control, a risk naming a control not in your register, an artefact linked to nothing at all, a control reviewed before its risk last moved, and a residual position no better than where it started with an operating control attached.
Fill in whatever you have not yet filled in, and watch the count move in the direction the previous lessons told you to expect.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
One or two sentences, in your own words. The test is whether you would read it out to a customer.
Six facts about you
These decide which controls are even yours to argue about. The honest answer usually removes more than it adds.
The period you are claiming
Everything in here is measured against these two dates. Typed as year-month-day, so the same thing is stored whatever your browser thinks the date format is.
two dates, the second after the first
What could go wrong
A sentence with a victim in it, not a category. There is no score field here and there is nowhere to put one: the two bands are never multiplied.
Once a year or so
A customer notices
What will you do about it?
What you could hand over
Only what already exists, with a date on it. A policy is real evidence of design and no evidence at all of operation, which is why that is the second question.
What does it show?
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
Three categories, and they are the reason this is a thinking tool rather than an assessment.
Anything outside the boundary you drew. The engine reads your register. A system nobody added, a supplier somebody started using in May, a second region that arrived with a team who have never read your boundary statement — none of that is in the graph, so none of it is in the list. The contradictions you cannot see are the ones that matter most, and they are structurally invisible here.
The third question. What happened the time it failed has no rule because a failure nobody recorded leaves nothing to compare. A control with eleven clean instances and one silent failure looks identical, in this data, to a control with twelve clean instances. That is not a gap in the engine; it is a fact about records, and it is why the third question has to be asked by a person.
Whether any of it is enough. No row anywhere in the output says compliant, ready, sufficient or good, and there is no field in which such a row could be stored. The design decision is deliberate and it is the same one that keeps the count going the wrong way.
Check
Every other tool in this field reports a figure that rises as you work, because a rising figure is what people will pay for and screenshot.
The problem is not that such a figure is imprecise. It is that it answers a question nobody is entitled to answer: how close is this organisation to being acceptable to a stranger applying professional judgement in a year's time, against a boundary that has not been fixed yet. Any number put against that is invented, and once invented it travels — into a slide, into an email to a customer, into a sentence somebody repeats in a meeting where nobody remembers where it came from.
A count that goes up when you are honest cannot travel, because nobody wants to carry it. That is the entire mechanism, and it is why there is no aggregate anywhere in this subject — not hidden, not disclaimed, not computed and withheld.