Sample instead of gut feeling
Sample size follows from the control frequency using a table you define yourself. A result is recorded per item, with evidence stored in document management.
ISMS & Risk
Internal Control System
Controls that are tested – not just described
A control catalogue nobody tests is a statement of intent. The internal control system records every control with its mode of operation, execution type and frequency, links it to risks, requirements and measures, and tests it per period: first the design in a walkthrough, then the effectiveness on a sample whose size follows from the frequency. Whatever fails is tracked as a deficiency, remediated and retested.
ISO 27001OSCAL
Features
Your benefits
Segregation of duties enforced
Whoever owns a control does not test it. Review is done by a third person. The system does not even allow the other setup.
Deficiencies with retest
Deficiencies carry a severity – deficiency or material weakness – and are remediated through existing measures. The retest feeds back into the deficiency instead of sitting beside it.
Attestation with escalation
Control owners periodically confirm the state of their controls. Reminders and escalation run through notification management, approval through the ICS owner.
Capabilities
All capabilities at a glance
- Controls with key-control flag, mode of operation (preventive, detective) and execution type (manual, IT-supported, automated)
- Links to risks from the risk register, requirements from OSCAL catalogues, measures and continuous control monitoring
- Test plan per period with design testing and effectiveness testing
- Sample size derived from frequency via a configurable table, result per sample item
- Deficiencies with severity, remediation via measures and retest with feedback
- Periodic attestation with reminders, escalation and approval
- Coverage per risk and process, status per period, heatmap, export as CSV and PDF
Result
At audit time you do not present the control catalogue but the evidence that the controls were tested and what the tests found.
Experience Internal Control System live
Schedule a no-obligation demo – we will show you the module with your own use cases.