A documented control is not the same as an operating control

Consider the question: “Is access removed promptly when someone leaves?” A written offboarding procedure is relevant. But the existence of that procedure does not, on its own, demonstrate what happened for a particular leaver or across a whole review period.

That distinction is easy to lose when a questionnaire expects a short answer and the available document sounds reassuring.

Match the claim to the evidence

Start with the exact claim. Then ask what would substantiate it: which systems, which population, which dates and which actions? A policy, a system configuration, a review record and a sampled test answer different questions.

Use a compact evidence record

• Claim: the specific statement you want to make.
• Boundary: systems, users, data and period covered.
• Reference: the dated artifact or activity supporting the statement.
• Limit: what the evidence does not establish.
• Next action: the owner and check needed to close the gap.

Do not let “partial” disappear

If evidence supports a narrower answer, give that answer. If the product boundary is unclear, keep applicability unresolved. If the operating record is missing, say so and define the follow-up.

A gap register is useful precisely because it prevents uncertainty from being buried in a polished response.

Assessment is more than collecting documents

NIST SP 800-53A describes examination, interviews and testing as assessment methods. The appropriate combination depends on the assessment objective. A document-only review should not be described as though all of those activities occurred.

For a practical assurance conversation, the principle is simple: explain what was reviewed, what it supports and what is still unknown.

Further reading: NIST SP 800-53A Rev. 5 and NIST assessment methods overview. This original note is general information, not an audit opinion or legal advice.