Control evidence

A control record keeps the type, description, owner, verification evidence and effective window together. Its status shows whether verification is pending, verified, suspended or expired. The administrator maintains this record so a reviewer can see the basis of the current state.

• Identify the control. The administrator sets its type, description and team member owner.
• Inspect evidence. The reviewer reads the attached verification file and the effective dates before the status changes.
• Keep status current. The administrator revisits a Verified control when its effective window ends or its evidence changes.

Use the attached verification material as the point of reference when the status changes. Effective dates tell the team when a verification applies. An expired or suspended record should remain available to the administrator who can update its status.

Agree the evidence required for each control type and who can change the status. Set a review rhythm for approaching effective end dates. A status label is useful only when the team has agreed which record and evidence justify it. Walk through a completed case and a correction with the people who will operate the record. Decide where source documents arrive and who checks them before a status is changed. Keep the agreement close to the team’s operating procedure so a new owner can make the same decision.

The administrator receives a new control record and marks it Pending while its evidence is collected. The reviewer checks the attachment and effective period. Once the administrator records verification, a later review can trace the status, owner and evidence from the same record. Reopen the control with the reviewer and check its attachment, owner, effective start and effective end. Use the description to identify the control scope consistently across reviews. Record Suspended or Expired when the earlier Verified state no longer fits the record.

If a control changes hands, check that the new owner can still find the file used for verification. Compare the effective start and end dates with the date of the review. Where the record is Suspended or Expired, keep the status visible during the next planning cycle instead of treating an older Verified state as current.

• Controls pending verification — Open the working records that need the module’s first decision.
• Active findings — Compare related work before handing the case to another owner.

Follow assessment to decision and follow-up and retest. Check ownership in roles before rehearsing the handoff.