C1 (3 points)
https://knobit.org/id/task/dg-bcbs239-controls-evidence/C1
Also as Turtle · JSON-LD · RDF/XML
| dcterms:license | https://creativecommons.org/licenses/by/4.0/ |
|---|---|
| rdfs:label | C1 (3 points) en |
| schema:hasPart | dg-bcbs239-controls-evidence C1: CT-014 effective on a design walk-through only withdrawn, operating test named |
| schema:hasPart | dg-bcbs239-controls-evidence C1: CT-010 design effective, operating test failed - not effective, operation remediated |
| schema:hasPart | dg-bcbs239-controls-evidence C1: the design against operating effectiveness distinction stated |
| schema:identifier | C1 |
| schema:position | 1 |
| schema:text | Design against operation, 1 each. (a) CT-014, the review and CRO sign-off, is recorded as test_result effective, but the only Internal Audit test of it (TT-01) is a design walk-through: the answer sets test_result to not tested (or otherwise withdraws 'effective'), reports it, and names what an operating test needs - a sample of months showing the reviewed and signed report before distribution. (b) CT-010, the coverage check, passed its design test (TT-04) but failed its operating test (TT-05: two of three sampled months unreviewed, the April SEK gap flagged and not followed up): the answer sets test_result to not effective, reports it, and resolves it by fixing how the check is run (reviewer sign-off, flagged gaps followed up) with a retest - not with a redesign of the logic alone and not by leaving it effective. (c) The answer states the distinction it applied, in Part B or a comment: a design test shows the control exists and would catch the error if run; an operating test shows it did run over the period, by whom, with what result; the supervisor relies on the second. en |