# Control test and conflict workpaper

SecNet.Work · Audit evidence, sampling and workpapers · 2026.10

Compare expected behavior, observation and conclusion.

Blank organizational workpaper. Enter real contact, asset and data details only in a controlled organizational copy. This file is not evidence, organizational approval or an automated compliance decision.

- Separate facts, explanations and unverified assumptions.
- Retain question and evidence IDs when handing off an exception.

| Criterion / procedure | Expected / observed | Evidence / conflict | Conclusion / review |
| --- | --- | --- | --- |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |

## Approval and follow-up

| Version | Owner | Approval | Review |
| --- | --- | --- | --- |
|  |  |  |  |

## Official references

- [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011)
- [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/)
- [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final)
- [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)