§ 01

How do you know a control is working?

Eleven questions about how your organization evidences control effectiveness. Four minutes.

At the end you will see the system refuse things — a closure without proof, a person signing off their own work, a question it declines to answer. That is the demonstration, and it opens as soon as you submit.

A written summary of what your answers suggest follows by email. Answer only what you know — where you are not sure, say so. An honest “not sure” is more useful than a guess, and the summary will reflect it as such.

1Organization and your role

2Which best describes your sector?

3Roughly how many controls are in your register?

4For what share of controls is a named individual accountable — a person, not a role or a team?

5Can the same person who operates a control also sign off that it is effective?

6For what share of controls does supporting evidence exist?

7For what share of controls has that evidence been tested by someone other than the control owner?

8When an auditor asks for evidence of a control operating in a past period, how long does it take to produce?

9When a control test fails, is the correction verified by someone other than the person who made it?

10How do you know a control is working today?

Optional. We read these closely.

11Where should the summary go?

A work address, so we can address the summary properly.

Please use your work email so we can address the summary properly.

Opens immediately. No account, nothing to install.

Your answers are read by a person and used to write your summary. Nothing is scored, graded or assigned a maturity level — which is the same position the product takes.