GRC · 5 min
Policies, Evidence & Audits
Proving a control works, not just that it exists
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Policy, standard, procedure
Three documents at three altitudes. Confusing them produces policies nobody can follow.
- Policy — what we require and why, approved by leadership
- Standard — the specific rules that satisfy the policy
- Procedure — step-by-step instructions for doing it
What counts as evidence
Evidence shows the control operated during a period, not that someone intended it to.
- System-generated records covering the whole period
- Records tied to specific dates, systems and people
- Samples an independent party can reproduce
- Exception records showing what was handled and how
Loading the interactive lesson…