Open the implemented control and go to Testing & Evidence. Add test sets the test up. You can link a policy or a register. You are then asked whether to run it.
Add the test
The test needs a name. The description is what the row shows under that name on the Tests list. Linking a policy makes this a check of that policy. Linking a register means a run saves a new image of that register.
Registers you can link include Communications, Context of the Organisation, Interested Parties, Legal requirements, Metrics, Objectives, and the risk, asset, incident, and supplier registers.
Run the test
Run test records the result. Set the effectiveness and the next review date, then save. Nothing is kept until you save the run. You can include an uploaded file or an evidence-library item.
A policy check can record whether the policy is up to date, whether people are doing what it says, whether it has been issued, and whether exceptions are still acceptable. An issued policy run can also capture the acceptances list.
The next review date can be suggested from the control’s monitoring frequency. Ad hoc, or a missing frequency, does not suggest a date; you pick one. Monitoring frequency itself is edited on the control’s implementation tab.