Independent control testing
Controls, and whether anyone has actually tested them
Having a control is not the same as knowing it works. Each control below carries a test history with a sample size, a named tester, and the evidence records the tester looked at — or it carries the word untested, which is not a pass and is never shown as one.
Health
Whether the controls have been tested
Controls by test result, how many run automatically, and the exceptions open against them.
Coverage by control domain
Where the estate is tested, and where it is only asserted.
Tests that are not independent
A control tested by the team that runs it. The result is kept, and marked.
Control catalog
0 shown of 24
| Control | Domain | Frequency | Owner | Tested by | Last result | Evidence | State |
|---|
Test calendar
What is due next, soonest first. Anything already overdue is at the top.
Exception register
Every failed or partially failed test leaves a row here with a name and a date against it.
| Exception | Control | Severity | Owner | Remediation | Due | State |
|---|---|---|---|---|---|---|
| Two leavers retained access beyond one business dayEXC-001One approver kept queue rights for five days and one function leader kept enterprise override rights for three days after departure. Both were removed once found, neither was found by the control. | CTL-004 | high | Acme Identity and Access Managementcustomer | Move leaver processing off the manual ticket path and onto the directory feed. Until that is done the control cannot pass. | 2026-09-05 | open |
| Quarterly recertification was not completed for the break-glass groupEXC-002The two break-glass holders were not recertified in the last cycle. Neither activated the role, so there is no evidence of harm, and there is also no evidence the holders are still correct. | CTL-001 | medium | Head of Platform Securitysecurity | Recertify both holders and add the group to the standard quarterly list rather than treating it as an exception. | 2026-08-26 | open |
| The dominant duty conflict has no single ownerEXC-003Station owners who also approve their own gate are the largest conflict class in the estate by volume. Most rows have no named remediation owner, which makes the register a list rather than a control. | CTL-005 | high | Head of Platform Securitysecurity | Assign an owner per function rather than per row, and set a target for the proportion of gates cleared by someone other than the station owner. | 2026-09-12 | open |
| Held units exceed the stated clock on several linesEXC-004Units held for a person are breaching the promised clock. The breach is visible in the platform, which is the control working; the clock itself is not being met, which is the failure. | CTL-014 | medium | Head of AI Business Servicesbusiness | Either resource the queues to the promise or change the promise. Both are acceptable; leaving the gap is not. | 2026-09-11 | open |
| Agent version changes were promoted without a recorded approvalEXC-005Version registry entries exist for changes that carry no matching approval record. The change happened and the approval was not captured, which is indistinguishable from the change being unapproved. | CTL-017 | high | Head of Agent Operationsengineering | Block promotion in the pipeline unless an approval record exists, rather than checking afterwards. | 2026-09-01 | open |
| Sandbox estate is not a true copy of productionEXC-006The sandbox carries a reduced estate, so a change rehearsed there does not prove the change is safe in the live estate at full volume. | CTL-018 | medium | Platform Engineering Leadengineering | Rehearse against a masked full-volume copy, or state openly that rehearsal covers correctness and not scale. | 2026-09-06 | open |
| Inference cost does not reconcile to the provider invoiceEXC-007The cost per unit the platform reports is derived from a modeled rate, not from the invoice. The direction is right; the figure is not reconciled. | CTL-023 | medium | Group Financial Controllerfinance | Ingest the provider invoice and reconcile monthly. Until then, label every cost figure as modeled wherever it appears. | 2026-09-04 | open |
| The evidence chain is not anchored outside the platformEXC-008The chain is verified from genesis on every read, which detects alteration by anyone who does not control the whole store. It does not defend against the platform operator, because nothing is anchored externally. | CTL-010 | high | Head of Platform Securitysecurity | Publish a periodic chain head digest to a store the platform operator cannot write to, and record the receipt. | 2026-09-01 | open |
| Directory-driven provisioning cannot be testedEXC-009The mapping mechanism exists and the roles it produces are enforced, but no directory is connected, so the control has never been executed against a real feed. | CTL-003 | high | Acme Identity and Access Managementcustomer | Supply the directory tenant identifier, application identifier and secret. The control cannot move off untested before that happens. | 2026-09-08 | open |
| No rollback rehearsal on record for the autonomous linesEXC-010Lines running at delegated or autonomous level have a documented fallback and no rehearsal evidence. An untested fallback is a plan, not a control. | CTL-019 | high | Head of AI Business Servicesbusiness | Rehearse one line per month and record the elapsed time to fall back to the manual path. | 2026-10-02 | open |
| A mover accumulated two approval queues for four daysEXC-011A move between functions added the new queue without removing the old one. Nothing was approved incorrectly in the window, which is luck rather than control. | CTL-004 | medium | Acme Identity and Access Managementcustomer | Make the mover path a remove-then-add transaction rather than an add. | 2026-09-03 | in-remediation |
| Processing location is not captured per unitEXC-012Residency is declared per tenant and is not evidenced per unit, so a residency claim cannot currently be proved from the record. | CTL-022 | medium | Data Protection Officerlegal | Record the processing region on every evidence record and test it against the tenant declaration. | 2026-09-22 | open |
Actions
What is waiting on a person
A control only counts once somebody has tested it and signed the result. Everything below is a control state that no agent can clear on its own.
Close a control exception
1 of them are already past the remediation date on the record.
Commission a first test
Never tested. Shown as a gap, never as a pass.
Remediate a failed control
Tested and did not hold. The process it guards is running without it.
Assign an independent tester
Tested by the same team that operates the control.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can start exactly one thing: a control test, against a named sample, by a named tester, writing its result and its evidence references back to the spine. It cannot change the process the control guards, waive a failure, or close an exception — a control test records what it found and stops there.
Live observability
What the record shows right now
Every control carries one of three states. Untested is counted separately from failed, because not knowing is a different problem from knowing it does not work.
Current distribution
24 controls
Is policy and strategy coming to fruition
Whether the written intent is holding here
17 of 24 controls have ever been tested. 10 passed.
Not holding on the record
The control framework is a written statement of what the estate promises to catch. On the record, 70.8% of it has been exercised at all, and 10 of 24 controls passed their most recent test. The remaining 14 are either unproven or proven not to work, and both cases are shown here as gaps rather than folded into a coverage percentage. No control on this page has been tested by anyone outside this organization.
It is: a real catalog with real test records. Sample sizes, testers and results are recorded per period, and every citation points at an evidence record that exists in the spine — open any control and follow the citation into the chain.
It is not: an audited opinion. The tests are modeled for a demonstration estate, and no external auditor has signed any of them. 7 controls have never been tested at all, including the external anchoring of the evidence chain — that one is not built, and it is listed as untested rather than quietly omitted.