CTL-001 · Access and authority
Privileged role assignment is recertified
Every holder of an enterprise or function scope role is confirmed by a named person each quarter, or the role is withdrawn.
What counts as evidence for this control
Written before the test, so a tester cannot choose the evidence that suits the result
Recertification list with a signature and a date per holder.
Test history
2 tests on record
| Test | Period | Sample method | Size | Pass | Fail | Result | Tester | Tested |
|---|---|---|---|---|---|---|---|---|
| CT-001-01 | Q3 month 1 2026 | random attribute sample | 25 | 22 | 3 | Fail | S. Nakamura Internal Audit | Jul 15, 2026 |
| CT-001-02 | Q2 2026 | random attribute sample | 44 | 44 | 0 | Pass | D. Okoye Internal Audit | Apr 14, 2026 |
CT-001-01 · findings
Q3 month 1 2026 · random attribute sample
3 items failed the attribute test. Detail carried into the exception register.
CT-001-02 · findings
Q2 2026 · random attribute sample
No exceptions in the sample. Evidence attached for every item tested.
Exceptions raised against this control
1 still open of 1
The two break-glass holders were not recertified in the last cycle. Neither activated the role, so there is no evidence of harm, and there is also no evidence the holders are still correct.
What this page is, and what it is not
Read this before quoting a result
The test results on this page are a modeled test history for a modeled estate. They demonstrate the shape of independent control testing — a named tester outside the operating team, a stated sample method, a sample size, a pass and fail count, and evidence citations that resolve into the chain — not the audited results of a live enterprise.
8 of 8 evidence citations on this control resolve to a record in the evidence spine. Every citation resolves; each one links through to the sealed record it refers to.
A control shown as untested has no result at all. Coverage on this platform counts controls that were actually tested; it never counts a control as passing because it was designed.