The pack says the controls
are fine. What would tell
you if they weren't?
A board discharges a personal obligation using a document it has no way to interrogate. Not because anyone is hiding anything — because there has never been a question available that the pack could not absorb. Here are seven.
Seven questions, and what a real answer sounds like.
- Coverage
- When was this control last tested, and by whom?
A real answer names a date and a person in the room. An assembled one arrives next week, after somebody has been asked to find out. - Falsifiability
- Could that check have come out differently?
If nobody can describe the case in which it would have failed, the check has not been shown to work. A test that can only pass is not a test — and it will report green until the day it matters. - Separation
- Who closed this finding, and were they the person who fixed it?
Separation of duties is usually asserted by the organisation chart. The question is whether the system that recorded the closure enforced it. - Provenance
- If the regulator asked today, would we produce this from the system, or assemble it?
Assembled evidence is not dishonest. It is late, expensive, and it cannot be re-derived if anyone disputes it a year from now. - The silence
- What is on this page because we examined it — and what is here because nobody reported a problem?
Most reporting cannot tell the difference. An absence of findings and an absence of looking arrive on the page looking identical. - Recurrence
- Has this failed before, and what is different this time?
A finding closed twice on the same evidence has not been closed twice. It has been closed once and re-labelled. - Dependence
- If our supplier stopped trading tomorrow, would last year's evidence still verify?
Retention obligations run to five, seven, sometimes ten years. Very few vendors will answer this one plainly, and the answer is worth knowing before it is tested.
Why these are rarely asked.
and an absence of
looking arrive at the
board in the same
colour.
Not evasion. Most compliance platforms have only two states to report — satisfied and not satisfied — so a check that could not be completed has nowhere to go but into the first one. The pack is accurate about what it was given. It is silent about what it could not establish, because it has no way to say so.
That silence is the thing a board is entitled to interrogate, and none of the questions above require technical knowledge to ask. They require only that somebody in the room asks them once.
Our interest in this, stated plainly.
We build software in this area, so we have an obvious interest in these questions being asked. That is a reason to read this page sceptically — and the reason we have kept it to questions rather than answers. Every question above is one a board should ask of whatever it already owns, and most institutions will find that some of them are answered well today.
If you want to see how we answer them, the signed record on the home page can be verified in your own browser in about five seconds, and the architecture is described without a sales call. Nothing on this page is a claim about your institution.
Ask us the same seven.
Conversations with directors and audit committees are run by the founder, and are not a sales call unless you want one. Thirty minutes.