A control requires a manager’s judgment that segregation of duties remains appropriate, while another control can be measured by an automated configuration check. How should evidence architecture differ?
Select an answer to reveal the explanation.
Short Explanation
Some locks need a person to say ‘still looks right,’ and some locks have a sensor. Attestations capture human judgment; indicators capture system-measurable signals. Pick the evidence style that matches how the control can actually be checked.
Full Explanation
Evidence architecture should match the nature of the control. Use attestation when a manager's judgment that segregation of duties remains appropriate is required, and use an automated indicator when another control can be measured by configuration check. Blending those modes poorly creates either false automation of judgment or unnecessary manual toil for machine-checkable settings across a municipal estate. Using only automated indicators for both ignores human judgment where it is required and will fail examiner interviews. Using only annual audit engagements and never collecting recurring evidence leaves long dark periods between assurances. Storing both as Software Asset Management license counts confuses SAM entitlement with GRC evidence. Exam caveat: many civic controls are hybrid—pair indicators for continuous signals with periodic human attestation for residual judgment on the same theme. Operational check: classify in-scope controls as judgment-based, automated, or hybrid; configure attestation campaigns and indicators accordingly; verify both feed compliance posture; and document the evidence mode on each control objective for owners. Review the classification annually as automation coverage improves in the municipal environment and update owner playbooks.