First define what the control must achieve.
Then define what must be true for that to happen.
Then determine what evidence would demonstrate it.
Design the evidence first. Write the question second.

Verification questions are often written too early.
Start a conversationVerification questions are often written too early.
01 / INSIGHTSThen define what must be true for that to happen.
Design the evidence first. Write the question second.
A bowtie with eight controls doesn't necessarily provide eight layers of protection.
The people doing the work encounter everything the procedure couldn't anticipate.
But where work itself is creating harmful exposure, support isn't enough.
You don’t need to know which service you need. We’ll start with the problem.