Assessment criterion
The agreed requirement used to assess a control. Its source, version and scope should be recorded.
Population
The complete set of records or systems from which samples are selected for a stated period.
Sample
A selected subset examined using a stated method. Exceptions do not automatically establish an estate-wide failure rate.
Control design
Whether a control, if implemented as described, addresses the specified risk or requirement.
Operating effectiveness
Evidence that a control performed as intended across the selected records and agreed review period.
Evidence limitation
A restriction on what can be concluded because records, access, coverage or corroboration are unavailable.
Finding closure
A supported conclusion that the defined remediation criteria have been met. Ticket status alone is insufficient.
