Evaluating the Effectiveness of Implemented Controls
Checking that the control works, not just that it exists
A control being documented and formally implemented doesn't guarantee that it works as expected in day-to-day operations, so evaluating its effectiveness requires going beyond confirming its existence and testing whether it actually meets the objective it was designed for. This means distinguishing between design tests, which verify whether the control is well conceived to mitigate the risk, and operating tests, which confirm whether it's carried out consistently during the assessed period, with real evidence of its operation at different times and not just on the day of the audit. A common practical example is the periodic access review control, which may exist as a policy and appear as met on a checklist, but when the real evidence is reviewed it turns out the last effective review took place more than a year ago. Evaluating effectiveness always requires asking for evidence, never accepting the process owner's statement as sufficient proof.