P04 / Assurance / Independent work sample
Audit readiness.
Controls, evidence and remediation need a single traceable assessment.
The decision
behind the work.
Execute repeatable test procedures and preserve observations, hashes, results, exceptions, and POA&M records in machine-readable form.
Methodology and scope are defined in the project manifest. Listed capabilities describe the module design; source files show the implemented subset.
Assessment approach
- Control crosswalk
- Test procedure registry
- Collector binding
- Design and operating effectiveness states
- OSCAL assessment results
- POA&M generation
Evidence
to request.
Start with source records, owner confirmation, scope and observation dates. A completed template alone does not establish operating effectiveness.
Defined output contract
- assessment-plan.json
- assessment-results.json
- poam.json
- evidence-manifest.json
The manifest defines these expected artifacts; confirm their existence and completion in source before relying on an output.
Read the full manifest ↗Review & decision boundaries
- Automation does not replace the independent auditor
- Failures and collection errors are distinct
- Evidence custody and timestamps must be preserved
Remediation sequence
Record each finding with its evidence reference, risk rationale, accountable owner, target date and closure test. Escalate missing evidence rather than treating it as a pass.
Present management with the supported conclusion, remaining uncertainty and a specific decision request.