How leadership can know, with evidence, whether the controls it relies on are operating

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

The corpus defines the path that evidence about controls travels. Its document architecture framework sets out a five-step evidence flow running upward from operational execution to governance reporting (its Evidence flow section owns the ordered steps and their contents). This page maps the corpus documents along that flow to a single outcome:

Leadership can state, with evidence, whether the controls it relies on are operating, and can see where assurance itself has gaps.

The first half of the outcome concerns the controls. The second half concerns the assurance over them, which the corpus records separately: the assurance map register records, for each material risk, what assurance is in place and where the gaps are, on a defined rating scale (its Purpose and Section 5). The assembly of the corpus documents below into one chain, and the reading order, are a composite synthesis across the sources this page lists; the limitations say so.

Each row relates one corpus control to the outcome using exactly one of the narrative layer's four relationship words. A contribution materially advances the outcome without being sufficient for it; a dependency is a condition the outcome requires; a prevention reduces the opportunity for a named failure mode; evidence demonstrates that a control exists or operates. No stronger relationship word appears on this page, by design. Where a row's justification is the cited document's own stated purpose or objective, the row paraphrases it closely; the assignment of exactly one word per row is a composite reading, and the limitations carry that caveat.

• The corpus states the chain's couplings document by document: the continuous assurance framework describes the per-control effectiveness metric as populated from the Control Testing Register (its section 4.4); the assurance metrics register names the metric's data sources (its Per-control effectiveness metric section); and the board risk report template summarizes audit coverage per the assurance map and links the assurance map and the KRI dashboard as appendices (its Sections 11 and 14). The reading of all eight rows as one ordered chain is this page's synthesis, not any single document's statement; the limitations flag it as composite.
• The corpus separates a control's design from its operation: the control testing procedure tests the two separately (its sections 2.1 and 2.2), and the audit evidence package template records implementation status and operating effectiveness as separate axes of its control inventory index.
• The assurance map register operates at the risk-area level: its scope states that it does not cover every individual control and that it is supported by the control register. Its linked-controls field expects control identifiers from the adopter's own control register, which the library deliberately does not ship (its Section 2); an adopting organization supplies its own control register for that linkage to operate.

Each item below is an evidence class leadership can ask management for, for a sampled control. Each is evidence for a named layer of the map operating.

• A period's operating records for the sampled control, as evidence for the record-producing layer the evidence flow describes.
• The control's latest operating-effectiveness test result, with its tester and independent reviewer, from the Control Testing Register, as evidence for the testing layer in the control testing procedure.
• The control's current effectiveness band and its inputs, as evidence for the metric layer in the assurance metrics register.
• Evidence of how the second and third lines consume the effectiveness bands, as evidence for the lines-of-defence layer in the continuous assurance framework.
• The current assurance-map rating for the relevant risk area, with its last and next assurance events, as evidence for the assurance-visibility layer in the assurance map register.
• The assurance section of the latest board risk report, and any threshold-breach escalations in the period, as evidence for the reporting layer in the board risk report template and the key risk indicator catalogue.
• The latest assembled evidence package for an in-scope framework, with its internal sign-off, as evidence for the external-assurance layer in the audit evidence package template.
• Any open exception touching the sampled control, with its register fields per the policy's section 4.5, as evidence for the accepted-deviation route in the exception and risk acceptance management policy.

• This page creates no compliance and imposes no requirement. The linked corpus documents govern; where this page differs from a corpus document, the corpus document prevails.
• This page carries composite claims. The assembly of the listed corpus documents into a single chain, the reading order, the two-part outcome framing, and the assignment of exactly one relationship word per row are synthesized across the sources named above; a control can serve the outcome in more than one way, and the map records the primary relationship. The adopting organization validates that reading against its own control framework and assurance model.
• The corpus documents this page points to carry the specific values: the result classifications and sampling rules of control testing, the metric's band definitions and escalation triggers, the assurance rating scale, the reporting cadences, and the exception duration and renewal ceilings. This page routes to them and does not reproduce them.
• Adoption is not presented as effectiveness. Holding the documents this page links, or requesting the artefacts it names, is not evidence that any control operates in an adopting organization; the corpus itself separates design effectiveness from operating effectiveness in the control testing procedure, and only the organization's own records and test results speak to the operating half.
• The body names on this page (governing body, board risk committee, enterprise risk committee, internal audit, second-line functions) are the corpus's reference vocabulary. The minimum viable governance structure guideline describes how a smaller organization consolidates forums into a leaner structure without losing the underlying accountability.
• This page makes no claim about the likelihood, occurrence frequency, or magnitude of a control failure, an assurance gap, or an outcome, and none of its statements should be read as a probability; the review and testing cadences it points to are the cited sources' own, routed and not reproduced.