Build control evidence that can be reviewed

A description is only the beginning

A policy describes what should happen. A reviewer also needs to understand who performs the control, when it operates and what record shows the activity took place. Evidence should support the specific control being assessed. ## Connect objective, owner and record For each selected control, write down its objective, the person responsible and the expected evidence. An access review might have a defined population, a reviewer, a dated decision and a record of follow-up actions. The exact requirements depend on the agreed audit scope. ## Keep the period clear Records should make the review period understandable. A document created today may explain current design but may not demonstrate how a control operated earlier. Preserve relevant records rather than reconstructing them without clear labelling. ## Track exceptions A control review is more useful when exceptions have owners and follow-up. Record what was identified, the decision made and any unresolved action. Be clear about items still in progress. ## Prepare for a scoped review - Control objective and description - Responsible owner and review cadence - Relevant population and period - Reviewable evidence of operation - Exception and action register ## Next step An IS audit or ITGC review can assess agreed control areas and help management understand gaps. It does not replace management responsibility for operating the controls.