Writing a control down does not show that it works. A test is a named check, run on a date, with a result and evidence, and a date when it should be run again.
What a test tells you
- Whether this control has ever been tested.
- Whether the last result is still in date.
- Whether the result was effective, partially effective, or ineffective.
- Which control and which frameworks the test belongs to.
Why a single list matters
Tests live on each implemented control. A single list shows the ones that are overdue, due soon, or never run, without opening every control. How ISMSVision helps with control tests is the product.