A policy is a starting point: practice reading control evidence

A policy can tell you what an organization expects people to do. To evaluate whether an activity happened as expected, you need evidence that addresses the particular question, population and period. The existence of a policy does not settle those questions by itself.

This guide uses a fictional exercise to practice careful conclusions. It is not a complete control-assessment methodology. NIST publishes formal assessment guidance in SP 800-53A; real work should follow the methodology and criteria appropriate to the engagement.

The three-record package

Imagine a supplier provides the following documents:

Record	What it says	A question to investigate
Access policy	Privileged access is reviewed quarterly	Which systems, accounts and reviewers are covered?
Account export	Eighteen accounts are listed at quarter-end	How was the population produced and reconciled?
Review worksheet	Sixteen accounts were accepted; two need confirmation	What happened to the two open questions?

Each document adds something. None should be interpreted more broadly than its contents support. The export's timestamp does not tell you whether service accounts were excluded. A reviewer's name does not establish that every required review step was completed.

Begin with the claim

“Access is reviewed” is too broad to assess without clarification. Ask whether the intended claim is that a quarterly review occurred, that every privileged account was included, that each access decision was appropriate, or that exceptions were resolved within the required time.

These questions need related but different support. A dated worksheet may help establish that review activity occurred. A reconciliation may help with completeness. A ticket and subsequent record may support follow-up on an exception. Do not substitute one conclusion for another.

Write a proportionate request

A vague request such as “send all your access evidence” creates unnecessary work and may collect sensitive material you do not need. In this fictional case, a more focused request would ask for:

The service and account types covered by the export, including how the population was generated.
The reconciliation or explanation supporting completeness for the stated scope.
The disposition of the two open account questions, with relevant dates and approvals.
Any criteria needed to understand whether the timing meets the supplier's stated review process.

In real work, use authorized channels and request appropriately redacted evidence. The educational exercise does not require personal account details or actual customer records.

Avoid two opposite mistakes

The first mistake is concluding that the control works because a document has the right title. The second is concluding that the control failed because the first evidence package was incomplete.

An incomplete package may mean that an activity was not performed. It may also mean that the supplier sent the wrong records, omitted a period or misunderstood the request. Record the limitation, request clarification and apply the engagement's criteria before making a stronger conclusion.

If the evidence cannot be obtained by the decision deadline, explain the unresolved limitation and its possible consequence to the responsible owner. Do not manufacture certainty to make the report look finished.

Practice your conclusion

Write three sentences: what the supplied records support, what remains unresolved and what should happen next. Compare them with the reasoning in the interactive evidence desk.

For formal background, consult NIST SP 800-53A, Assessing Security and Privacy Controls. The fictional records and commentary here are original teaching material, not an official NIST assessment or certification.

A relevant next step

The Interview Case Workbook applies this distinction across access, change, risk and supplier cases. Read its real sample before choosing more practice.

For a complete procedure-and-result explanation, work through the account-removal interview example.

If you are deciding whether to use a longer practice resource, read the access-review workbook selection guide. It explains fit, actual contents and what the public sample includes.

Apply the distinction to a customer answer

The qualified security-answer exercise applies these evidence limits on the supplier side. Compare the questionnaire portfolio preparation path when selecting practice material.