One vocabulary for the condition of a control.
The Standard is the part that does not change between modules. It defines how deeply a control is assured, how the evidence ages, and what may be claimed once it is held. Supply and Model are two applications of the same Standard.
The punch is applied only where evidence is current at the stated depth. It is withdrawn when the evidence lapses.
Four depths. Chosen by consequence, stated on the record.
Depth is a decision, not an accident. Every control and every relationship is held at one of four depths, and the depth travels with the claim so nobody has to guess how much weight it carries.
- D1
Declared
The organisation states the control is in place. Useful for low consequence relationships, and honest about what it is.
- D2
Evidenced
The statement is supported by an artefact with a date and an owner. Evidence carries an expiry, so ageing is visible.
- D3
Verified
Evidence is checked against the control definition on a set cadence, by a reviewer or a scheduled integration.
- D4Continuous
Observed
The control reports its own state from the source system. Assurance is continuous, and drift surfaces the day it happens.
Four states. Every one carries a date.
Evidence has a shelf life. The Standard makes that shelf life explicit, so the difference between assured and merely filed is legible to a board, a regulator and a counterparty.
Evidence is within its defined validity period and matches the control.
Evidence is still held but approaching expiry. Action is due, not overdue.
Evidence has passed its validity period. The control is not presently assured.
No evidence has been supplied. Unknown is stated openly rather than assumed to be fine.
State is always shown as a mark and a word together, never as colour alone.
From a framework on paper to a state you can read.
Map your frameworks
Obligations and control libraries are brought in and reconciled with the evidence already held.
Set the depth
Each control is assigned a depth from Declared to Observed, according to the consequence of failure.
Connect the sources
Where depth allows, state is read from the source system so it does not depend on someone remembering.
Produce the record
A dated, defensible record for the board, the auditor and the regulator, drawn from one source.
The claim never exceeds the evidence.
Certification under the Standard describes the condition of evidence at a stated depth and date. It is not a warranty of outcome, and we will not write it as one. Where evidence is absent, the record says Unknown.
Stated plainly
A claim names the control, the depth, the state and the date. All four, every time.
Withdrawn honestly
When evidence lapses, the mark is withdrawn. Nothing continues to be displayed on the strength of history.
Comparable
Because the vocabulary is fixed, two organisations can be read side by side without translation.
Hold your controls to the Standard.
We will walk the Standard against your own control library and show you where the record would sit today.