Before relying on a new access approval control, the information security manager wants to know whether it actually worked throughout the past six months, not only whether it was designed correctly. Which evaluation is required?
Select an answer to reveal the explanation.
Short Explanation
A recipe can be perfect and the cook can still skip steps every Friday. Design asks whether the recipe works; operating effectiveness asks whether you actually followed it every time. The trap is the walkthrough, which proves the design but not six months of practice.
Full Explanation
Control evaluation has two distinct questions. Design effectiveness asks whether the control, if performed as described, would meet its objective; operating effectiveness asks whether it was actually performed consistently and correctly over a period of time. Because the manager wants to know whether the approval control worked throughout six months, the evaluation must test operation, typically by selecting a sample of access grants from across the period and confirming that each had a valid, timely approval by an authorized person. A walkthrough traces one instance through the control to confirm understanding and design; it is a design test and says nothing about whether the control operated on other occasions. Reviewing the written procedure and its approval confirms that the control is documented and authorized, which is again a design matter. Interviewing the control owner gathers useful context but provides only testimonial evidence that is weak on its own and cannot demonstrate consistent operation. Exam caveat: design should normally be evaluated first, because there is little value in testing the operation of a control whose design is inadequate. Operational check: define the population of access grants for the period, select a sample across all months, record evidence of approval for each and report exceptions with their root causes.