Compliance · Monitoring · Component
The monitoring plan
What is tested, how often, and by whom — weighted by consequence rather than spread evenly.
The deliverable
What it is
Testing everything equally means testing the consequential controls too rarely and the trivial ones too often.
Independence is what makes monitoring worth doing. Self-assessment reliably finds what it expects to find.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The frequency
How often each control is tested, weighted by consequence.
3 attributes: Test frequency · Risk weight · Last tested
LearnThe independence
Who performs the testing, and their distance from the control.
3 attributes: Tester · Independence · Reason
Learn
Self-assessment has value and is not assurance. State which one you are producing.
The other components in monitoring
The test record
What was sampled, what was found, and against what evidence — testing operation rather than documentation.
LearnThe findings log
Open findings with owner and date, tracked to closure — because a finding raised and not closed is a documented failure.
Learn