0.1 The Purpose of a Control Assessment

Introduction

A control assessment is a structured test of whether a security control does what an organization says it does. Someone claims that leaver accounts are disabled promptly, that every administrator uses multifactor authentication, that backups can be restored within four hours.

An assessor takes that claim, measures it against written criteria, gathers evidence about what actually happened, and records a determination that other people will rely on. The work is valuable precisely because the claim is usually made by the people who run the control, and they are the people least able to see where it fails.

The method used throughout this course comes from NIST Special Publication 800-53A, which describes how to assess security and privacy controls. Its central move is to stop treating a control as one thing to be judged. A control is broken into determination statements, each one specific enough that evidence can settle it, and each statement is decided as satisfied or other than satisfied. The figure shows how the parts connect.

Every assessment starts from a claim, and it pays to read the claim as carefully as any piece of evidence. Organizations record their controls in a control register, a risk register or a statement of applicability, and each entry says what the control is, who owns it, how often it runs and, often, whether it is considered effective.

That last field is the claim. It is usually written by the control owner, sometimes after a self-assessment, sometimes from memory.

The register entry below is a typical one. It describes a manual control: when HR notifies the service desk that someone is leaving, the desk disables the account and closes a ticket.

Notice what the entry does and does not say. It says the control exists and names an owner, a trigger and a mechanism. It describes the control in words that sound complete. It says nothing about how quickly the account is disabled, and nothing about how anyone knows the control worked last quarter.

The self-assessed status of Effective is an opinion, and the date beside it says when the opinion was formed, not what period it covers.

An assessor treats the claim as a hypothesis. It might be true. The assessment exists to find out, and the first discipline of the work is to keep the claim and the evidence apart: a register that says Effective is evidence that someone believes the control works, which is a different thing from evidence that it does.

Internal auditors call this habit professional skepticism. The IIA's 2024 standards describe it as staying curious, critically assessing whether information is reliable, and seeking more evidence when what is offered looks incomplete or inconsistent.

Applied to a register entry, it comes down to three questions asked before any evidence is requested: who wrote the status, on what basis, and for which period. The answers rarely change what is tested. They change how much weight the plan gives the claim, which is usually none beyond naming the control.

A claim cannot be tested until it is measured against something. That something is the criteria: the specific, written requirement the control is meant to satisfy. Without criteria an assessor can only describe what they saw; with criteria they can say whether what they saw is enough.

Criteria come from three places. An organization's own policies and standards are the most common, because they state its decisions in its own terms.

External frameworks supply them too: ISO/IEC 27001 Annex A, the SOC 2 Trust Services Criteria, the NIST Cybersecurity Framework, NIST SP 800-53 and the CIS Controls each describe what a control should achieve, at different levels of detail. And contracts or regulations impose them, sometimes with exact numbers.

When more than one source applies, the assessment states which one it is using, because a control can meet one and fail another.

The control register entry did not say how quickly a leaver must be disabled. The organization's Access Control Standard does:

This clause turns a vague claim into a measurable one. "Promptly" is unmeasurable; "within one business day of the leave date HR records" names a start point, an end point and a limit. It also names the source of the start point, HR's record, which settles in advance an argument that would otherwise happen at the end of the assessment about which date counts.

Good criteria are specific enough that two assessors reading the same evidence would reach the same result.

Criteria can also conflict. A framework might require access removal within a day while a contract with a customer allows three, or a policy might say one business day while the procedure that implements it says "by the end of the week".

The assessment does not pick the convenient one. It states which criterion applies to the question being asked, and where two apply it tests against each and reports both results, because each has a different reader.

Some criteria are not that kind. A framework requirement such as "access is removed in a timely manner" leaves the limit to the organization. When the criteria are vague, the assessment either finds a more specific standard that the organization has adopted, or records the limit it applied and why. An assessment with unstated criteria produces determinations nobody can check.

Notice that the criterion arrives already worded. The assessor does not get to soften it to one or two business days because the process is mostly manual, or tighten it to the same day because that is what the interview promised. Whatever the words say is what the leavers are tested against, and any view about whether the words are right goes into the report separately.

Ask whether a control "works" and you are really asking one of three questions, and the evidence for each is different. Mixing them up is the most common way an assessment reaches a conclusion its evidence does not support.

The first is design: if the control were done exactly as described, would it meet the criteria? A leaver procedure that waits for a monthly HR report could be performed perfectly and still never meet a one-business-day limit, because the design cannot. Design is assessed by reading procedures, configurations and responsibilities against the criteria.

The second is implementation: is the control actually in place as described, on a given date? A procedure that exists only in a document is designed but not implemented. Implementation is usually shown with a single walkthrough, one occurrence followed from trigger to outcome.

The third is operating effectiveness: did the control work every time it was needed, across a stated period? This is the hardest and the most useful, because it is the only one that says anything about what happened.

Go back to the register entry with these three questions in mind. Its description of the procedure speaks to design. Its owner and frequency speak, loosely, to implementation. Its status of Effective is a claim about operating effectiveness, and nothing in the entry supports it, because a register describes a control and records an opinion about it; it does not record the control happening.

The same distinction shapes the reports organizations exchange. A SOC 2 report comes in two forms: one gives an opinion on the suitability of the design of controls as of a date, and the other on both their design and their operating effectiveness throughout a period.

A reader who treats the first as if it were the second has read a description of the control as a record of it working.

The same three questions apply to every assessment in this course, whatever produced the evidence. When you read a determination, find out which of them it answers before you decide how much it tells you.

An operating-effectiveness determination always covers a period, and the period is part of the determination. "The leaver control operated effectively" is incomplete; "the leaver control operated effectively from 1 July to 30 September 2026" is a statement someone can rely on, and can also see the limits of.

The period matters because controls fail intermittently. A control that works on the day an assessor looks may have failed the week before, during a holiday, a staff change or a migration. Testing a period means looking at every occurrence of the control in that period, or at a sample drawn from all of them, and the conclusion reaches no further than the period does.

The timeline below places the quarter's fourteen leavers on the assessment period. Each dot is a leave date. Twelve were disabled within one business day. Two were not.

The same quarter looks different depending on the day you look at it. The table below shows what a single walkthrough on four different days would have found, using the same records.

Two of the four days would have found an overdue account and two would have found nothing wrong.

An assessor who walked one leaver through the process in early July, as an implementation check does, would have seen a sound control: the procedure existed and the account was disabled the same day. Which answer a single check produces depends on the calendar, which is no basis for a conclusion about a quarter.

Only reading every leaver in the period gives a result that does not depend on the day the assessor arrived. That is the difference between implementation and operating effectiveness made visible, and it is why an assessment that will be relied on as a statement about a period must test the period.

The period also limits the conclusion in the other direction. Nothing in this quarter's evidence says what happens in October.

Evidence is whatever shows what actually happened, and an assessor gets it by three methods. NIST 800-53A names them. To examine is to review, inspect, observe, study or analyze something: a document, a configuration, a record.

To interview is to hold discussions with the people who run or depend on the control. To test is to exercise a mechanism or activity under specified conditions and compare what it does with what it should do.

Each method has its objects. 800-53A sorts them into specifications such as policies and procedures, mechanisms such as systems and configurations, activities such as the work people do, and individuals. A determination about whether leavers were disabled on time is a determination about an activity, and the activity leaves records in two systems: HR records when someone left, and the directory records when their account was disabled.

employeeId,userPrincipalName,displayName,department,leaveDate,reason
E10400,n.chadwick2@ne.com,Niamh Chadwick,Engineering,2026-07-06,End of contract
E10401,s.eastwood2@ne.com,Sam Eastwood,Operations,2026-07-10,End of contract
E10402,j.clegg2@ne.com,Jade Clegg,Operations,2026-07-16,Resignation

Read the HR export for what it is. The leave date is the date HR entered as the person's last day, which is the start point the standard names. It is not the date HR told the service desk, which could be later and would make a late disable look like a late notification.

That difference matters to the finding, not to this determination, because the criterion counts from the leave date.

userPrincipalName,accountEnabled,disabledDateTime
n.chadwick2@ne.com,False,2026-07-06T10:15:00Z
s.eastwood2@ne.com,False,2026-07-13T11:16:00Z
j.clegg2@ne.com,False,2026-07-17T12:17:00Z

Two systems, owned by two teams, are better evidence together than either would be alone. HR has no reason to adjust a leave date to suit IT, and the directory records the disable time automatically rather than from someone's recollection.

Evidence that comes from a system rather than from the person whose control is being assessed, and that two independent sources corroborate, carries more weight. Module 4 is about that weighing.

The leaver tickets are evidence too, but of something narrower. Every one of the fourteen is marked Closed. A closed ticket shows that someone closed a ticket. It does not show when the account was disabled, and treating it as if it did is the first mistake this course will ask you to avoid.

With the criteria fixed and the evidence in hand, the test itself is mechanical, which is how a good test should be. For each leaver, take the leave date from HR, take the disable time from the directory, count the business days between them, and compare the count with the limit of one.

Counting business days needs a rule stated in advance. Here a business day is a weekday that is not a public holiday, a leave date on a Friday makes the following Monday the first business day, and the late-August bank holiday is excluded.

Stating the rule matters because a leaver on a Friday disabled on a Monday is either compliant or not depending on it, and an assessor who decides the rule after seeing the results can make the results say anything.

The population is small enough to test in full, so there is no sample: every leaver in the period is in the test.

One more rule hides in the data. The directory records disable times in UTC, shown by the Z at the end of each time, while the organization works in UK time, which in summer runs an hour ahead.

A disable recorded at 23:30 UTC on a Monday happened at 00:30 on Tuesday in the office. None of this quarter's disable times fall near midnight, so the convention does not change any result here, but the assessor checks that before relying on the dates rather than after.

Twelve of the fourteen meet the limit, three of them on the same day as the leave date. Two do not: a.dawson4@ne.com was disabled after 4 business days and g.ainsworth2@ne.com after 9.

A result like this invites a softer reading, and it is worth naming the temptation. Twelve of fourteen is 86 percent, which sounds like a control that mostly works. But the criterion is not a percentage. It says each leaver is disabled within one business day, and two were not.

The percentage describes the result; it does not change the determination. It does help the finding that follows, because it shows the failures are exceptions in a process that usually runs, which points the investigation at what was different about those two.

Testing every leaver is possible here because there are only fourteen. With a few hundred, the same test would run on a sample, and the conclusion would have to say how the sample was drawn. The logic does not change: each item is compared with the limit, and every failure is counted and named.

A determination records the assessor's decision on one statement, together with everything a reader needs to check it. This course records each one on a workpaper: the criterion and its source, the statement being decided, the method, the population, the evidence cited by file, what the test found, and the determination with its reason.

The statement is narrower than the claim, and deliberately so. The register claimed the control is effective; the statement asks only whether each leaver account was disabled within the limit. Removing access to applications that do not use single sign-on is a second statement under the same criterion, and it would be decided separately, with its own evidence.

800-53A allows two values, satisfied and other than satisfied. There is no partly satisfied, and the reason line is what carries the nuance a third value would have tried to. This one says deficiency: the evidence shows the statement does not hold.

Other workpapers in this course will say something different under the same heading: that the evidence supplied cannot settle the statement either way. Both are other than satisfied, and they lead to very different next steps, which is the subject of 0.2.

The two values come from NIST. Its glossary defines assessment findings as the results of applying an assessment procedure to a control to meet an assessment objective: the assessor executes a determination statement, and the result is either satisfied or other than satisfied.

The definition matters for what it leaves out. It has no room for a control that is mostly working, because the statement is about each item in the population, and a finding about most items is a finding that some failed. The workpaper's fields exist so that another assessor, given the same evidence and the same statement, would reach the same value.

A determination leaves the assessor's hands and is used by people who never see the evidence. Management uses it to decide whether to fix a control, accept the risk or escalate. An internal auditor may rely on it rather than retest. An external auditor may use it to reduce their own testing. Customers and regulators read the reports it feeds into.

Because readers cannot see the evidence, a determination has to carry its own limits with it.

Three limits apply to every assessment. It covers a stated period and says nothing outside it. It covers the population tested, and where that was a sample, the conclusion about the rest is an inference. And it rests on the evidence supplied: if a record was missing, altered or never produced, the assessor can only state what the evidence that did exist shows.

A determination also ages. The next assessment of the same control does not start from this one's conclusion; it starts from the same criteria and a new period's evidence. What carries forward is the knowledge of where the control failed and why, which tells the next assessor where to look first.

None of this weakens an assessment. It is what makes one usable. A reader who knows that the leaver determination covers the third quarter, every leaver HR recorded, and the directory's own disable times, can decide how far to rely on it. A reader handed only the word "ineffective", or worse "effective", cannot.

Service organization reports work the same way, and they are a useful model. A SOC 2 Type 2 report covers a stated period, describes the tests the service auditor performed and their results, and lists the exceptions found; its readers rely on it without seeing a single record.

An internal determination is read in the same conditions, by people who will not open the workpaper, so it carries the same things on its face: the period, the population, and what the evidence was.

Then find the equivalent in an organization you know. Pick one control with a written limit, a leaver process, a patch window or an access review, and identify the two independent records that would show whether it met that limit over the last quarter. If you cannot name them, you have found the first gap an assessment of that control would report.

The next lesson takes the determination apart: what satisfied and other than satisfied mean, and how the reason for an other-than-satisfied determination decides what happens next.