The challenger
Controls testing vs execution evidence.
Both matter. They answer different questions. Control testing helps establish whether a control is designed, configured, implemented, or operating as defined. Execution evidence asks whether the consequential action that actually committed remained inside the approved standard and authority in force.
A green control does not prove the consequential outcome stayed authorized.
When the question is whether a specific consequential action actually stayed inside authority, event-level execution evidence provides proof that control documentation, design evidence, or point-in-time testing alone cannot.
Different evidence objects
What each approach is good at establishing.
Did the control exist and operate as designed?
- Policy or control exists
- Owner and responsibility exist
- Configuration or procedure exists
- Approval process is defined
- Sampled or automated control test passed
- Evidence was collected for the control objective
Did this committed outcome stay inside the authority?
- Exact rule and version in force
- Exact authority basis
- Event inputs and provenance
- Exception or override path
- Pulse decision where instrumented
- Actual committed action
- Replay or reperformance linkage
The practical distinction
Do not replace controls testing. Extend the evidence chain to the event.
Question
Controls testing
Execution evidence
What should happen?
Strong
Uses the approved standard as the baseline
Was authority defined?
Can test the control/process
Links authority to the specific event
What actually committed?
May be inferred or sampled depending on procedure
Explicitly preserved for the event/population
Can the event be replayed?
Not necessarily
Designed for traceability/reperformance when the evidence contract is sufficient
What if evidence is missing?
Procedure-dependent
CANNOT ESTABLISH rather than forced pass/fail