CRITICAL CONTROLS / VERIFICATION

The challenge

Verification was happening.

But completing verification didn't always mean the organisation knew whether the control was effective.

The work

We worked from the control's intended function and performance requirements to determine what evidence was actually needed.

Only then did we develop the verification questions.

The shift

The focus moved from:

Was the check completed?

to:

What does the evidence tell us about protection?

This created a clearer connection between the serious-harm pathway, the critical control, its requirements and the decision being made in the field.