The Control That Only Exists on Paper: Test One Before Year-End

The policy says departing employees lose system access the same day. Does that actually happen? The policy says backups run nightly. When did anyone last watch one complete? Somewhere between the binder and the building, controls have a way of becoming intentions.

You do not need an audit program to find out. Before the year ends, pick one control whose failure would genuinely hurt, and look at the evidence it left behind.

Key takeaways

• A control that is never observed operating is an assumption, not a control.

• Test the few controls whose failure would hurt the most.

• Evidence beats intention: watch the control run or pull the records it produced.

• When a control fails the test, fix the control or fix the paperwork. Do not leave both standing.

• One honest test teaches more than ten unchecked boxes.

Step 1: Choose the control whose failure would hurt

Good candidates share a profile: the policy makes a clear promise, and the promise breaking would be expensive or embarrassing. Access removal at departure, backup completion, the alert someone is supposed to answer, the approval step before a payment run.

Pick one. The exercise works because it is small enough to actually do.

Step 2: Watch it run, or read its tracks

Two honest ways to test. Observe the control operating on the next real case, or pull the records from the last few times it should have operated. For access removal, take the last three departures and check the timestamps: when did access actually die, and who did it?

The records usually exist. What is usually missing is anyone reading them against the promise.

Step 3: Compare the record to the promise

Now the policy meets the evidence. Same-day removal took five days. The nightly backup skipped weekends. The alert went to a mailbox nobody opens.

Write the gap in plain language without drama. This fictional example shows the record. It is an illustration, not a prescription.

The gap column is the year's most useful sentence.

Step 4: Decide what changes

Every gap has two honest fixes. Bring the practice up to the promise, or rewrite the promise to match a practice you can defend. Same-day removal may be right; so may three days with a compensating check. What is not defensible is the binder saying one thing while the building does another.

Step 5: Put the next test on the calendar

One test is an event; a rotation is a program. Pick the next control and the next quarter while the habit is warm. In a year you will have looked at four controls properly, which is more than most companies do in five.

Closing the loop on findings covers what happens after a test finds something, and compensating controls is the right frame for promises the building cannot fully keep.

Frequently asked questions

Is testing one control really enough?

Enough to start, and more than most companies did this year. One control tested properly surfaces the habits and owners that decide whether the other controls work. Then the quarterly rotation compounds.

Who should run the test?

Someone who did not build the control. That can be another leader, an outside advisor or a board member with the stomach for it. Independence matters more than seniority.

What if the test finds something serious?

Treat it as a finding, not a scandal: record it, assign an owner, set a fix date, and decide whether the gap changes any risk you have already accepted. Serious findings during a self-test are the cheap kind. The expensive kind arrive through an incident.

Should the board hear about this?

A one-line summary belongs in the regular cyber report: what was tested, what was found, what is being fixed. It shows the difference between a program that asserts and one that verifies.

A Defensible Next Step

Pick the control that keeps you up at night and pull the records from its last three runs. What you find is the start of next year's program. Book a Decision-Clarity Call if you want help designing the first test.