Chapter 27 — Security governance, risk and compliance: verification

Chapter 27 — Security governance, risk and compliance: verification

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Test types"]
  N2["27.2 Choosing tests"]
  N3["27.3 Documenting results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Test types"]
  N2["27.2 Choosing tests"]
  N3["27.3 Documenting results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Test types]
    |
    v
[27.2 Choosing tests]
    |
    v
[27.3 Documenting results]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) verify controls through inspection, observation and re-performance; (2) choose suitable tests; (3) document verification results.

27.1 Test types

Sofia learns three ways to verify a control. Inspection examines documents or records, such as access review sign-offs. Observation watches a control being performed, such as a manager reviewing access. Re-performance repeats the control independently, such as Sofia comparing the leaver list with active accounts herself. Re-performance gives the strongest evidence because it does not rely on the owner's records, but it takes the most time and access. Her own comparison of the leaver list with active accounts is re-performance, which is why it later finds what the review missed.

27.2 Choosing tests

For each key control Sofia chooses a test. For access reviews, she inspects sign-offs and re-performs a sample. For encryption, she inspects the device console report. For incident handling, she observes a tabletop exercise. She learns that the choice depends on the control's importance and the evidence available. Important controls deserve stronger tests. She also notes that relying only on inspection risks accepting records that look complete but describe controls nobody actually performed. Access reviews get both inspection and re-performance because they protect tenant data across every system.

27.3 Documenting results

Sofia documents each test with its objective, method, sample, results and conclusion. Re-performing the leaver check reveals one account that the access review missed, so she concludes the review control operates with an exception. She recommends adding the leaver list to reviewers' materials. She learns that verification results should state clearly whether a control operated effectively, operated with exceptions or failed, so that management knows how much to rely on it. Her conclusion that the review operates with an exception tells management to rely on it, but not without the leaver list added.

Worked example

Sofia uses inspection, observation and re-performance, finds an access review exception and states conclusions clearly.

Synthetic case. Tests and results are synthetic.

Errors and limits

Observation can change behaviour. Re-performance needs access.

Exercises

• EX079 — Strongest test. Which test type gives the strongest evidence? Rubric: 3 = re-performance;; 2 = re-perform;; 1 = inspection;; 0 = none.
• EX080 — Inspection risk. What is the risk of relying only on inspection? Rubric: 3 = records may describe controls nobody performed;; 2 = false records;; 1 = vague;; 0 = none.
• EX081 — Conclusion categories. What three conclusions can a verification reach? Rubric: 3 = effective, effective with exceptions, failed;; 2 = three;; 1 = vague;; 0 = none.

Synthesis

Verification chooses fitting tests and states clearly how far controls can be relied on.

Continue studying — chapter 27 of 40

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →