A control you cannot test is a statement of intent.
Most control libraries describe what should be true. Very few state how you would know. Each control here carries the assertion, the test procedure, the population it must be tested on, the evidence that satisfies it, and the condition that constitutes failure. That last line is the one supervisors read.
How to read a test
Sampling is where assurance quietly fails
Where a single instance would be a finding — an unauthorised payment above limit, a designation live late in screening, a material obligation with no owner — the test runs on the full population. Sampling is appropriate for judgement-heavy controls, not for conditions where one exception is the whole exposure. Read the population line before the procedure.
141
32
14
Every obligation classified material has one named individual, not a committee or a function.
Reconcile the obligation register to the accountability map and confirm each material obligation resolves to a single named person in post at the test date.
All obligations flagged material; full population, no sampling.
Obligation register extract, accountability map, current organisation chart.
Any material obligation with no owner, a vacant post, or a committee named in place of a person.
Published here is the testable core. Effectiveness grading, evidence specifications, sample-size derivation and the remaining control set are institutional IP, released under engagement.
Request the full library