Five steps describing how well you can prove a control works — from “somebody says so” to “it stays true on its own”. Other models describe an ambition. This one describes what is physically in the room at each level, and the one question that settles where you are.
You believe the control is there because somebody says it is.
A policy, a slide, or a supplier assurance. Nothing that can be examined.
Ask who last looked. If the answer is a name and no date, you are here.
Write down what exists. An honest inventory is the whole of level two.
The gap between two levels is almost always one artefact.
Between asserted and documented it is an inventory. Between documented and evidenced it is a decision record. Between evidenced and tested it is somebody who does not own the control. None of those are expensive. They are just cheap to keep and expensive to reconstruct.
It gives a board and an engineering team the same word for the same thing, which removes most of the argument.
Score yourself before anybody sells you anything. If you land on level four, most assurance work is not for you.
Level five on a system nobody uses is worth less than level three on the one carrying your revenue. Scope first.
Ten statements, answered honestly. Nothing is submitted and nothing is stored.