CONTROL EVIDENCE AND TEST WORKSHEET

Control Objective · Sample · Test Steps · Evidence Quality · Result

Table of Contents

1. Purpose and Use
2. Template Instructions
3. Fill-In Template
4. Review and Approval
5. Document Control

1. Purpose and Use

This worksheet standardizes control testing and evidence review. It records the control objective, test method, population, sample, evidence examined, result, exceptions, and remediation linkage so audit work is repeatable and defensible.

Evidence Must Prove the Control, Not Decorate the File

A screenshot is useful only if it proves the control objective for the right scope and period. Evidence that cannot be tied to the control, sample, date, and result is not audit-ready evidence.

2. Template Instructions

1. Copy this template before use.
2. Replace every bracketed field with case-specific information.
3. Do not delete fields that appear not applicable. Mark them Not Applicable and explain why.
4. Use canonical CERG role names from CERG-GOV-OM-001.
5. Link risks, findings, exceptions, evidence, and approvals to the system of record.
6. Store the completed artifact in the evidence library governed by CERG-PRC-AUD-001.

3. Fill-In Template

3.1 Control Test Header

3.2 Population and Sample

3.3 Test Steps and Results

3.4 Exceptions and Remediation

4. Review and Approval

Completed templates are reviewed at the cadence defined by their parent procedure or plan. Material changes require a new review.

5. Document Control

Revision History

Review Triggers

• Parent procedure or plan change
• Audit, assessment, or tabletop finding related to this template
• Role or approval model change
• Direction from the CISO

Related Documents

Source: templates/CERG-TMPL-AUD-001_Control_Evidence_and_Test_Worksheet.md · Download .md · View on GitHub