# Security audits: turn control claims into evidence

Original SecNet workpaper · 1.0 · 11 October 2026

Complete placeholders for your assessment. The example below is fictional; it is not an executed test or a legal decision.

## Assessment identity

- Record ID: [___]
- Objective and decision question: [___]
- Scope / exclusions: [___]
- Criteria and version: [___]
- Authorization and limits: [___]
- Owner / independent reviewer: [___]
- Period / artifact digest: [___]
- Evidence access / retention: [___]

## Planned procedure

1. Agree the audit objective, criteria/version, organizational boundary, period, independence and reporting audience. Separate compliance questions from technical assurance questions.
2. Build a risk-based control population with named owners. Identify outsourced controls and shared responsibilities rather than assuming a supplier certificate covers your configuration.
3. Plan evidence requests with provenance, access limits and retention. Minimize personal data and use read-only exports where practical.
4. Select samples with a documented rationale and period coverage. Examine records, interview owners and test selected controls; a convenient sample is not automatically representative.
5. Validate findings with control owners: criterion, observed condition, evidence, consequence and cause. Mark missing evidence as a limitation instead of inventing operating effectiveness.
6. Agree corrective actions, owners and dates. Close only after closure evidence meets the original criterion; track accepted residual risks separately.

## Evidence and decision register

| ID | Criterion | Observation | Redacted evidence / origin / time | Conclusion and limitation | Owner / date | Recheck |
|---|---|---|---|---|---|---|
| [___] | [___] | [___] | [___] | [___] | [___] | [___] |

## Topic-specific deliverables

- [ ] Audit plan and control/evidence request list.
- [ ] Workpapers, sample rationale and finding register.
- [ ] Management report, corrective action plan and closure evidence register.

## Worked fictional decision example

Fictional audit: the policy requires quarterly access review. One signed spreadsheet proves one review, not a year of operation. Request the four review records, reconcile them with the account population, sample departures and track unresolved exceptions. If a quarter is missing, report the evidence gap and its impact on the conclusion without backdating a record.

## Closure check

- [ ] Criteria and period agreed before sampling?
- [ ] Evidence provenance and exclusions recorded?
- [ ] Closure based on evidence rather than a promise?

## Official references · checked: 2026-10-11

- [NIST SP 800-53A Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final)