PI1.1 Obtains or generates and uses relevant quality information to support processing integrity
Obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the us.
5
artefacts
0
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the quality of the information used to support processing, including its source, accuracy and timeliness · Document repository
governing documentDocuments that govern the control
- Documented definitions of the data processed and the product and service specifications, and evidence they are current · Document repository
- Evidence these definitions are communicated to the users of the products and services, such as documentation, interface specifications and service descriptions · Document repository
- Records showing the specifications are used as the basis for the processing controls that follow · Document repository
- Evidence of update to specifications and their communication when processing changes · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Specifications held informally by the engineering team and never communicated to the users who rely on them
- Definitions out of date against the processing actually performed, so every downstream completeness and accuracy control tests the wrong thing
- No traceability from the specification to the input, processing and output controls
- Changes to processing made with the documentation left describing the previous behaviour
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP8.1 Inquiries, complaints, and disputes regarding personal information are addressed · PI1.2 System inputs are complete, accurate, and processed in a timely manner