Part IV · Chapter 7 · The Audit · lesson 13
Defend your own register against the three questions
16 min
Builds on Defend one control to somebody who doubts it
Part IV · Chapter 7 · The Audit · lesson 13
16 min
Builds on Defend one control to somebody who doubts it
Last lesson of the track, and it is a rehearsal rather than a reading.
Pick the control you are least comfortable with. Not your best one — the one you would quietly hope nobody selects. Then answer the three questions about it, out loud, as though somebody were sitting opposite you with your own description open.
Who approved this. Show me the one from the middle of the period. What happened the time it did not run.
What a landed answer sounds like, for each of the three.
Who approved this. A name, a date, and the fact that they were not the one doing the work. If they were: who decided that, when, and what stands in for the second pair of eyes.
Show me the one from the middle. An artefact the control produced, dated inside the period, held in a system you did not type the date into. Not a summary, and not the most recent one.
What happened the time it did not run. Either a story with a record — it failed in May, here is what we did — or the detection path: what you would see, who would see it, how long that takes.
If the third answer is it has never failed, the follow-up is the whole question, and the honest version is below.
Running this on your strongest control produces a pleasant ten minutes and teaches nothing. The control you are uncomfortable with is uncomfortable for a reason you can usually name in one sentence once you let yourself, and that sentence is almost always one of three: nobody independent looks at it, the middle of the period is thin, or nobody would know if it stopped.
Those are the three questions again. Your discomfort has already done the diagnosis; the exercise is to write it down.
The control below is the one with the clearest shape for this: who still needs what, asked on a clock. It has a cadence, so the middle of the period means something arithmetically. It has an authority problem built into it — the person who knows what a role grants is usually not the person who knows what somebody does. And it fails silently, because every stale permission keeps working exactly as granted.
Record where it actually stands for you, with the reason in your own words, and a name against who notices when it stops.
Decide · access-recertification
Access accumulates and nothing in the ordinary course of work takes it away again. People pick up permissions for a migration, a launch or a one-off favour, and the permission outlives the reason. This control is the recurring moment where somebody with the standing to say no looks at the list and confirms each entry still has a reason behind it.
The decision
Who reviews, on what cycle, and what a review is allowed to conclude. The reviewer who knows what a role grants is usually not the reviewer who knows what the person does, so either the review happens twice with two different questions or it happens once and answers neither. Picking a cadence is the easy half; deciding that a reviewer may remove access without asking the holder is the half that makes it work.
Where this goes wrong
The first list produced is usually correct, which makes the whole exercise feel like paperwork and lets the cadence slip. Nothing breaks in the meantime — every stale permission works exactly as granted — so the decay is invisible until a departed colleague's account turns up in a sample, long after the quarter where removing it would have been easy.
Does this apply to you?
Worth seeing before you defend it, because the defence changes depending on who is asking.
Where they part company
Who still needs what, asked on a clock
One side can be satisfied by a review process that demonstrably exists and is overseen internally; the other turns the same control into a dated population and samples it, so three completed reviews and one skipped quarter is a passing picture in the first case and a deficiency in the second. The practical consequence is that the cadence itself becomes the control under a period examination, and a review done late is a different outcome from a review done.
Read the list below as the three questions, with your own data substituted.
If this control is marked running with nothing linked to it, that is show me the one from the middle with no answer available. If everything linked to it is a policy or a settings export, that is the same question answered with a document about intentions — the design half, which is real evidence of something other than operation. If it is in place with nobody named, that is who approved this and who notices when it stops at once.
And if the list is empty for this control, that tells you the fourteen things the engine checks are consistent for it. It does not tell you the third question has an answer, because the engine has no rule for the third question and never will.
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
This is the condition under which the whole exercise above stops working, and it is extremely common.
A control with no failure history has no record of its exception path, so the third question has no artefact behind it. The temptation is to describe a procedure — the reviewer escalates to the security lead, who logs an issue — which may be exactly what would happen and is, today, a sentence about the future.
The honest answer has two parts and takes about as long to say. First: it has not failed, or not that we have detected, and here is the difference between those two claims for this particular control. Second: here is what would show it. The alert, the dashboard, the person whose job includes looking, the day of the week they look. If that second part is thin, you have found something more useful than an audit finding — you have found that the control is unmonitored, which is a thing you can fix this month for very little money.
There is a version of this that is better still and it takes planning: run it into a failure deliberately. A restore test that does not restore, an access review seeded with an account that should not be there. One deliberate failure produces a real record of a real response, and it is the only way to have an answer to the third question before the first real failure arrives.
Check
Not a verdict, and nothing that says where you stand. Four specific things.
A sentence describing what the opinion is actually about, which is narrower and stranger than almost everybody assumes. Three questions you can run against your own register in an afternoon, producing the same thin answers a stranger would find. A sorting habit that tells you, for any gap, whether assembling paperwork is even available. And a price, in hours, for the weeks this costs the people who are not running it.
What you do not have is permission to tell anybody you are ready, and this course has no mechanism for producing that. What an auditor concludes is their professional judgement applied to your evidence, in a year you have not reached, against a boundary you can still change.