Assurance programme and assessment procedure

Assurance programme and assessment procedure

AS-01 — Assurance policy

[Organisation] maintains an assurance programme to determine whether its adopted policy commitments are fulfilled and whether the resulting capability is sufficient for the intended purpose. Assurance connects the promise made, the work performed, evidence of that work and the decision supported. The programme owner maintains the scope and reporting; assessors evaluate evidence and report their conclusions and limitations.

The programme distinguishes design, implementation, operation and effectiveness. A policy may be well written but not implemented; an implemented control may not operate consistently; a consistently performed activity may not achieve its intended outcome. Each assessment states which question it addresses. Framework alignment is recorded separately from evidence that a promise was kept.

AS-02 — Build the assurance plan

The assurance lead takes the adopted commitments from AD-01 and identifies their scope, responsible owner, procedure, expected evidence and operational schedule or trigger. For each promise, the lead defines the assessment objective and the evidence needed to judge it. The plan identifies risk significance, dependencies and any requirements for assessor competence or independence.

Assessment timing reflects when the activity occurs and when evidence can support a decision. Event-driven work is assessed against the events that actually occurred. Periodic work is assessed against the approved schedule. A promise for which no qualifying event occurred is reported with that context; it is not counted as tested merely because no failure was found.

AS-03 — Select methods and samples

The assessor selects examination, interview, testing or a combination. Examination inspects documents, records, configuration or other artefacts. Interview establishes relevant explanations and understanding. Testing observes whether the required behaviour occurs under defined conditions. The plan records why the chosen methods are sufficient for the intended conclusion and where they are limited.

The assessor defines the population, period, sample selection and coverage. Sampling considers different systems, actors, change types, suppliers and exceptional conditions where they affect the promise. A convenience sample is identified as such. Statistical claims are made only where the sampling and analysis support them. Selection does not intentionally exclude difficult or failed cases while presenting the result as representative.

AS-04 — Obtain and evaluate evidence

The assessor confirms the evidence source, version, period, scope and relationship to the activity. The assessment considers completeness, authenticity, relevance and the possibility that the evidence was produced by the same failure being assessed. Statements by the performer can explain work but are not automatically sufficient to demonstrate that it occurred.

Contradictory evidence is investigated and retained with the conclusion. The assessor distinguishes a missing record from an observed failure of the activity, while recognising that a promise to retain a record can itself be assessed. Evidence is evaluated against the commitment effective at the time of the work and the actual scope of any approved exception.

AS-05 — Record results

The result states the objective, evidence, method, population, sample, finding and limitations. Conclusions distinguish supported fulfilment, partial fulfilment, observed non-fulfilment, insufficient evidence and activity not due in the assessed period. The organisation may use local status labels if their definitions preserve these distinctions. A risk acceptance is recorded alongside a deficiency rather than changing the deficiency into a satisfactory assessment result.

Findings identify the promise affected, observed condition, consequence, evidence and responsible owner. The assessor records the reasoning connecting evidence to conclusion so that another person can review it. Where confidence depends on a supplier report or untested assumption, that reliance is explicit. The report identifies any immediate decision needed because the finding changes the basis of continued operation.

AS-06 — Correct and follow through

The owner of a finding identifies correction, cause analysis and any wider corrective action. Actions have accountable owners, dates, resources and verification arrangements. Closing an action requires the evidence identified for closure; effectiveness may require a later observation period or repeat assessment. The record distinguishes correcting one missing artefact from changing the process that repeatedly fails to produce it.

Disputes about a finding are recorded with the competing evidence and resolved through [review authority]. The assessor’s original conclusion and the final disposition remain traceable. Management decides on resources, risk acceptance or changes to commitments through the applicable procedures. The assessment process does not silently rewrite policy to remove an inconvenient finding.

AS-07 — Report and maintain the programme

Reports identify coverage, significant findings, overdue assessments, unresolved evidence gaps and progress on corrective action. They show the scope and period and distinguish assessments planned from assessments completed. Changes in policy, system scope, risks or suppliers cause the assurance plan to be reviewed. The lead checks that new promises have corresponding assessment arrangements and that retired promises no longer generate inappropriate work.