Battlecards for Audit Pushback

This is just a documentation issue; the control really happened. That may be true operationally, but our assurance conclusion needs retained evidence showing who performed the control, when, and how exceptions were resolved. It acknowledges the possibility while holding the evidence standard required for assurance. No loss happened, so the rating should be low. No detected loss is relevant context. The rating also considers exposure, likelihood, control purpose, and whether compensating controls would detect a problem in time. It reframes severity as risk exposure, not only realized loss. It acknowledges the concern without lowering the evidence standard or confusing management…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in