PI1.5 Inputs are processed completely, accurately, and timely for stored data
Implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity's objectives.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of completeness and accuracy of stored data, such as integrity checks, checksums or reconciliation between stored and source data · Document repository
- Evidence of protection of stored data against alteration, loss and unauthorised change, including access controls and audit trails · Policy repository / GRC workspace
- Evidence of backup and recovery of stored items and of verification of their integrity on restore · Backup / DR tooling
governing documentDocuments that govern the control
- Policies and procedures over the storage of inputs, items in processing and outputs, in accordance with the system specifications · Policy repository / GRC workspace
- Evidence of retention and archival of stored items in line with the specification and any commitment · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Integrity of stored data assumed from the storage platform with no independent check
- Items in processing held in transient stores with no protection or recovery capability, so a failure mid process loses them
- Retention applied to outputs while inputs and intermediate items are kept indefinitely or discarded arbitrarily
- Restore tested for availability with no verification that the restored data is complete and accurate
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPI1.4 System outputs are complete, valid, accurate, timely, and distributed