FREE WORKING FILE / EDITION 01
Make your evidence
reasoning visible.
A small register for a difficult habit: writing only the conclusion your records support. Use it for GRC, IT audit or supplier-risk interview practice.
Download editable CSVFree download. No account or email required. Opens in spreadsheet software.
FICTIONAL PRACTICE / NORTHLINE STUDIO
The export arrived.
The review did not.
Northline’s practice policy says the billing-system owner reviews active user access each month. You are examining April. The owner supplies an access export dated May 3 and a message saying, “Everything looks right.”
What can you conclude about the April review?
This is an original teaching scenario, not an employer assessment or a compliance determination.
A bounded answer
The export shows the accounts included in that export on May 3. The message gives an informal statement, but the supplied records do not establish the April population reviewed, the review date, the reviewer’s authority or how exceptions were resolved.
Request the April review record and its supporting population. Ask the owner to explain the relationship between that record and the May export. Keep the April review unverified until the gap is resolved.
Read the reasoning
A later snapshot can omit accounts removed during April. A general approval message may lack the scope and timing needed to support the specific claim. Neither point proves that the review failed to occur. Your next request should distinguish an undocumented review from an activity that was not performed.
HOW TO USE THE FILE
Four passes through one record.
Write the claim precisely
Name the system, population and period. ‘Access is reviewed’ leaves all three unclear. Record the expected review frequency separately from what the evidence actually shows.
Describe the record you received
Record its source, date and coverage before judging it. An export showing current access is useful, but it does not by itself establish who reviewed earlier access or when.
Bound the conclusion
Say what the record supports, what remains unknown and what you would request next. Missing documentation is a gap to investigate; it is not proof that the underlying activity never happened.
Choose a follow-up with an owner
Ask for a specific record or explanation tied to the gap. Assign an illustrative owner and requested date in a fictional exercise; agree real deadlines with the responsible team.
Try the two unfinished rows.
One concerns a deployment approval recorded after implementation. The other concerns a supplier report that excludes the service under consideration. Complete your conclusion before reading the companion’s suggested approach.
Use synthetic records only. Do not put customer information, employer documents or personal data into a public portfolio.
Turn practice into an honest story.
Explain your question, the records you examined, the limit you found and the next step you proposed. Label it an independent fictional exercise on your resume.
How to label a portfolio projectExplore the larger portfolio case and its previewChoose your career practice pathEmail delivery is not available in this development edition. Both files can be downloaded above.