control-statements

A control is any action taken by management, the board, and other parties to manage risk and increase the likelihood that established goals are achieved. Write or review its title and description, returning wording to the auditor or calling skill.

Starting pattern and completeness

The title is a short noun phrase naming the action and its object. It is unique within the process and matches the description’s boundaries. Include frequency or system when needed to distinguish the control from others in the process.

A useful starting point for the description is:

[Role or automated system] [control action and scope] [frequency or trigger], using [relevant information, system, or configured rule], to [specific control purpose]. [Applicable criteria, exception follow-up, and supported records or outputs].

Adapt the wording to the context. Write one present-tense paragraph, roughly one to three sentences, stating the supported intended design. A description is complete when a reader can point to:

• Performer or automated system: which roles or systems perform the control. Name people by role and distinguish the accountable owner from the performer where relevant.
• Action and scope: the observable activity or mechanism and the population or other scope it covers.
• Frequency or timing: how often the activity occurs, what triggers it, or when it applies continuously, including relevant deadlines.
• Information or system: the relevant information, systems, or configurations used, where applicable.
• Precision: the operating rule or criteria that make the mechanism specific, such as the comparison performed, authorization condition, configured restriction, or recovery action. Include relevant granularity and supported thresholds; qualitative criteria may be sufficient.
• Exception handling: how applicable exceptions are resolved or escalated, by whom, and within any supported time limit.
• Purpose: the specific risk or undesired outcome addressed, or objective supported, through prevention, detection, correction, or recovery as applicable. Make the purpose understandable without consulting a linked risk statement and accurate wherever the shared control appears.

Include supported records or outputs where they explain the activity or how its performance is recorded. Distinguish inapplicable elements from material unknowns, and mark the latter as gaps.

Sources and gaps

Base descriptions on supported intended design and distinguish documented design, reported practice, and direct observation. Preserve differences between sources with their attribution.

Mark missing facts with descriptive bracketed gaps. When revising supplied wording, retain its source references, visible information gaps, and distinctions between documented, reported, and observed practice. When drafting directly for the user, identify the material or attributed statements used. When another skill requests the wording, return this supporting information with the draft for inclusion in its workpaper.

Control boundaries

Describe one coherent control mechanism per statement, with a clear purpose and scope. Keep connected steps together when they explain how the control works, including applicable review, investigation, resolution, and sign-off. Different roles, actions, or frequencies alone do not establish separate controls. When wording combines distinct controls, explain the distinction and propose separate statements.

When reviewing multiple statements, compare their mechanisms and scope for duplicated coverage. Clarify shared activities and recommend combining statements that describe the same control.

Faults

When reviewing control statements, check for the following problems and apply the corresponding guidance.

• A title that does not identify the control being described. Name the action and its object and match the description's boundaries. Owner, department, or system names alone are insufficient.
• A description that merely restates the title. Explain what the control addresses, how it works, and its scope, performers, timing, and applicable follow-up.
• A missing or unclear performer. Identify the roles or automated systems that perform the control and distinguish them from the accountable owner where relevant.
• Vague frequency or timing. State the supported frequency, trigger, or conditions for continuous operation, including relevant deadlines.
• A vague control activity. State the specific action or mechanism and what it applies to, using details supported by the sources.
• Missing operating rules or criteria. State the rules or criteria that explain how the mechanism works, including relevant granularity and supported thresholds.
• Missing applicable exception handling. State how exceptions are resolved or escalated, by whom, and within any supported time limit.
• A missing or unclear purpose. State the specific risk, undesired outcome, or objective addressed. Make the purpose understandable without a linked risk statement and accurate wherever the control appears.
• A requirement or objective without a control mechanism. Explain how the requirement or objective is put into practice. For policy-based controls, describe the supported activities for establishing, communicating, or enforcing the policy.
• Distinct controls combined, or one control split across descriptions. Keep connected steps of one mechanism together and propose separate statements for distinct controls. Recommend combining statements that describe the same control.
• Operating practice substituted for intended design. Describe the supported intended design and frequency. Keep contrary practice separately attributed and linked to the control.
• Documented design or reported practice presented as observed operation. Make the distinction clear among documented requirements, someone's account of practice, and direct observation. When sources differ, state what each source supports.
• Invented or guessed facts. Use details supported by the supplied material or information provided by the user or other identified sources. Mark missing information with descriptive bracketed gaps, including unknown records or outputs.
• An embedded judgment about control adequacy, effectiveness, or improvements. Describe intended design and keep assessments and improvements separate from the control description.
• Audit procedure or evidence-examination detail in the description. Describe how the control is intended to operate and keep planned examination separate from the control description.
• A description that contradicts a supplied attribute field. Identify the conflict and propose wording supported by the sources, or mark the missing information as a gap. Leave the supplied attribute unchanged.

Output

Check that the statements adhere to the guidance above before returning them.

Return the drafted or revised titles and descriptions to the user or calling skill, with a brief summary of what was created or changed.

Distinguish changes made from proposed changes, including any recommendations to combine, separate, or remove statements.

For each unresolved question or information gap, state which statement it affects and what clarification or source material is needed to resolve it.

If no changes are needed, confirm that the statements meet the guidance.