CTL-005 · Access and authority
Segregation of duties conflicts are detected and owned
Every conflicting duty pair held by one identity is detected, listed and assigned to a named owner with a date.
What counts as evidence for this control
Written before the test, so a tester cannot choose the evidence that suits the result
The live conflict register with owner and remediation date per row.
Test history
3 tests on record
| Test | Period | Sample method | Size | Pass | Fail | Result | Tester | Tested |
|---|---|---|---|---|---|---|---|---|
| CT-005-01 | Q3 month 2 2026 | full population | 2000 | 1996 | 4 | Fail | R. Whitfield Internal Audit | Aug 13, 2026 |
| CT-005-02 | Q3 month 1 2026 | full population | 600 | 600 | 0 | Pass | S. Nakamura Internal Audit | Jul 14, 2026 |
| CT-005-03 | Q2 2026 | full population | 800 | 800 | 0 | Pass | D. Okoye Internal Audit | Jun 14, 2026 |
CT-005-01 · findings
Q3 month 2 2026 · full population
4 items failed the attribute test. Detail carried into the exception register.
CT-005-02 · findings
Q3 month 1 2026 · full population
No exceptions in the sample. Evidence attached for every item tested.
CT-005-03 · findings
Q2 2026 · full population
No exceptions in the sample. Evidence attached for every item tested.
Exceptions raised against this control
1 still open of 1
Station owners who also approve their own gate are the largest conflict class in the estate by volume. Most rows have no named remediation owner, which makes the register a list rather than a control.
What this page is, and what it is not
Read this before quoting a result
The test results on this page are a modeled test history for a modeled estate. They demonstrate the shape of independent control testing — a named tester outside the operating team, a stated sample method, a sample size, a pass and fail count, and evidence citations that resolve into the chain — not the audited results of a live enterprise.
12 of 12 evidence citations on this control resolve to a record in the evidence spine. Every citation resolves; each one links through to the sealed record it refers to.
A control shown as untested has no result at all. Coverage on this platform counts controls that were actually tested; it never counts a control as passing because it was designed.