Appearance
Control Assessment
Where to find it: Controls & Assurance, then Control Assessment (/assess), with sub-pages for Design Assessment, Operating Effectiveness and Control Testing.
Control assessment is the human counterpart to continuous indicators: periodic, judgement-based evaluation of whether a control is well designed and operating.
Three assessment types
| Type | Question it answers | Route |
|---|---|---|
| Design Assessment | If this control operated perfectly, would it achieve its objective? | /assess/design |
| Operating Effectiveness | Did it actually operate over the period? | /assess/operating |
| Control Testing | What do the test results show on a sample? | /assess/testing |
These are separate because a control can be well designed and not operating, or diligently operated and inadequately designed. Reporting one figure for both hides which problem you have — and they need entirely different remedies.
Design Assessment
Design assessment evaluates the control as written.
Ask:
- Does the control address the risk or obligation it is mapped to?
- Is it specific enough to be performed consistently?
- Is the frequency appropriate to the risk?
- Are the roles unambiguous?
- Is there a segregation problem built into it?
- Would evidence of its operation exist?
That last question is the most practically useful. A control whose operation would leave no trace cannot be assured, whatever its design merits.
Operating Effectiveness
Operating effectiveness evaluates whether the control operated as designed over a defined period.
Ask:
- Did it operate at the stated frequency?
- Did it operate across the whole in-scope population?
- Were exceptions identified, and what happened to them?
- Is there evidence for each occurrence, or only for some?
Design and operating are independent verdicts
A control assessed as adequately designed and ineffective in operation is a common and important result. Recording only one of them loses the distinction between "we need to rewrite the control" and "we need to make people do it".
Control Testing
Control testing records the results of testing a control against a sample, including the sampling approach, sample size, results and exceptions.
Testing is where an assessment stops being a conversation and becomes evidence.
The assessment lifecycle
Submission requires assessment.submit. Review requires assessment.review.
The self-review rule
An assessor cannot approve their own assessment
Segregation of duties is enforced: the person who authored an assessment cannot review and approve it.
The governed break-glass
A separate permission, assessment.review_self_override, allows a user to approve an assessment they authored — defeating the segregation rule.
It is off by default:
- It is granted to no system role template
- It is explicitly excluded from the tenant administrator's all-permissions grant
- It is never satisfied by administrator status alone
- It requires a documented reason
- It raises a dedicated audit event
Grant it deliberately to a custom role only if your governance model genuinely needs an emergency self-approval path — and expect to explain each use.
Assessments and continuous indicators
Both produce a view of a control. They are complementary, not competing.
| Manual assessment | Continuous indicators | |
|---|---|---|
| Cadence | Periodic | Continuous or scheduled |
| Basis | Human testing and judgement | Deterministic evaluation of telemetry |
| Strength | Process controls, judgement, design | Configuration state across populations |
| Weakness | Point-in-time; sampling risk | Only measures what is instrumented |
| Entitlement | control_assurance | continuous_assurance |
Use indicators for what a machine can observe. Use assessment for what a person must judge.
RCSA campaigns
Risk and Control Self-Assessment campaigns run assessments at scale across a defined population of controls and owners, tracking scope, progress and completion.
See Risk Assessments. Requires rcsa.read and rcsa.manage.
Permissions
| Action | Permission |
|---|---|
| View assessments | assessment.read |
| Submit for review | assessment.submit |
| Approve or return | assessment.review |
| Self-approve, break-glass | assessment.review_self_override |
| Run control evaluations | control.assess |
| View or manage RCSA campaigns | rcsa.read / rcsa.manage |
All require the control_assurance entitlement.
Example
Control CTL-2026-0067 — Vendor Due Diligence Review.
Design assessment: Adequate with observation. The control requires due diligence before onboarding, but does not specify what triggers re-assessment of an existing vendor. Observation raised; the control was amended to add a trigger on material contract change.
Operating effectiveness: Partially effective. Of 41 vendors onboarded in the period, 38 had documented due diligence. Three were onboarded under an expedited process with no record of who authorised the expedition.
Control testing: Sample of 15 from the 38. All 15 had complete documentation. Two showed the review completed after contract signature rather than before.
Overall: the control is now adequately designed and partially effective. Two findings were raised — one on the three undocumented expedited onboardings, one on review timing.
Note what did not happen: the design amendment did not make the operating result better, and the clean test sample did not make the three missing records disappear. The three verdicts stand independently, which is what makes them useful.
Troubleshooting
"I cannot approve an assessment." Either you lack assessment.review, or you authored it. Self-review is blocked.
"Assessments do not affect control effectiveness in Continuous Assurance." Continuous Assurance derives effectiveness from indicators. Manual assessment is a separate, parallel view. Both inform the overall picture; neither overwrites the other.
"Control Assessment is not visible." Requires the control_assurance entitlement and assessment.read.