Topic
A statement is not evidence.
Most of the work consists of turning what you actually do into something a third party can verify. It is less impressive than security itself, and it is what decides the outcome.
The three levels, on one example
| Level | What it looks like | What an auditor does with it |
|---|---|---|
| Statement | “Access is reviewed regularly” | Not acceptable: no frequency, no scope, no record |
| Procedure | A document describing a quarterly access review, with a named owner | Acceptable as intent, insufficient as proof of execution |
| Dated evidence | The minutes of the 12 June review, the list examined, the accounts removed and the owner's approval | Acceptable: the control is described and its execution demonstrated |
How a gap should be declared
- 01
Name precisely what is missing
Not “being put in place”, but which control, over what scope, and since when it has been absent. A vague gap reads as an attempt to conceal.
- 02
State the compensating control
What limits the risk in the meantime. A manual review standing in for an automated control is a legitimate compensating measure, provided it is described and recorded as such.
- 03
Give a deadline you can hold
With a named owner. A deadline missed by the next questionnaire costs more than the original gap: it demonstrates that the plan is not being followed.
The stale-evidence trap
An answer library built once ages quickly. The procedure described has been changed, the named owner has moved on, the provider cited is no longer the right one, and the most recent record is eighteen months old.
A client renewing its assessment compares against the previous version. An answer identical word for word, with last year's evidence, signals a file that is not maintained, and triggers more questions than the first time.
That is what the periodic review exists for. It produces nothing visible, and yet it is what separates a usable file from a binder.
Request an assessment
Let's talk about the next questionnaire
Tell us who is asking, by when, and what usable evidence you already hold. We reply within two working days, in English, French or German.
- Swiss engineering
- Reply within two working days
Email Certenor
A questionnaire on your desk and a short deadline? That is the right moment to write to us.
Email Certenor