Original practice work / Synthetic desk review / 02
Assurance without overclaiming
Three fictional questionnaire responses show how to distinguish supported statements, missing evidence and unresolved scope.
The question
A fictional software company needs to answer a security questionnaire. Its documents describe useful controls, but they do not justify universal claims about MFA, offboarding, backups, logging or incident exercises. How can it respond honestly without turning every incomplete answer into a vague “yes”?
The review method
Trace every proposed answer to a supplied evidence reference. Distinguish a documented design from a control shown to be operating. Where evidence is absent, retain the gap and assign a next action rather than manufacture assurance.
- Identify the precise question and the relevant product or organizational boundary.
- Map the proposed response to a dated, fictional evidence reference.
- Check whether that evidence supports the full claim, a narrower claim or no conclusion.
- Record an owner, review date and follow-up action for each unresolved item.
An illustrative evidence trail
| Question | Supplied evidence | Bounded response |
|---|---|---|
| Are logs retained for 90 days? | A configuration showing 30-day retention. | Describe the demonstrated 30 days. Do not claim 90 without additional evidence. |
| Is access removed promptly? | A written offboarding procedure, with incomplete operating records. | Describe the procedure and the evidence gap; do not imply universal timeliness. |
| Is this data class out of scope? | A stated exclusion without a confirmed product boundary. | Keep applicability open until the data flow and boundary are confirmed. |
The artifact
The table on this page is the complete example. It shows the supplied evidence, the response it supports and the question that still needs review. No separate client report or larger evidence collection is implied.
This is not a compliance scorecard. A questionnaire answer, a readiness review and an independent audit opinion are different things.
The takeaway
An unanswered question is not a yes. A clear boundary, a source reference and a named next action make the answer more useful than an unsupported promise.