CC2.1 COSO principle 13: Obtains and generates relevant, quality information
Obtains or generates and uses relevant, quality information to support the functioning of internal control.
5
artefacts
1
held by a system
4
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Identification of the information requirements supporting the functioning of internal control, such as security metrics, risk data and system inventories · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence of the sources used, both internal and external, and of how data is captured and processed into usable information · Policy repository / GRC workspace
- Evidence of the quality of that information, covering completeness, accuracy, timeliness and its retention · Data governance / DLP tooling
- Reporting produced during the period and evidence it was used in decisions · Policy repository / GRC workspace
- Evidence of review where information quality was found deficient and corrected · Policy repository / GRC workspace
governing documentDocuments that govern the control
none for this control
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Reports produced from a manually maintained spreadsheet with no control over its completeness or accuracy
- Asset and system inventories used as the basis for other controls while nothing verifies they are complete
- Information generated and never used, so relevance to internal control cannot be shown
- Cost and quality of the information never balanced, producing volume that obscures the signal
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC1.5 COSO principle 5: Holds individuals accountable for internal control responsibilities · CC2.2 COSO principle 14: Internally communicates information including objectives and responsibilities