SecondMark position
A documented control is not an effective control. Design, placement, authority, observability, bypass paths, and runtime performance all matter.
The examination is bounded to defined claims, a versioned system, and evidence that can be traced to the state under review. Any material exclusion or uncertainty remains visible in the conclusion.
Core questions
What the examination needs to establish.
- 01
What risk is each control meant to constrain?
- 02
Can the control be bypassed or become stale?
- 03
Who can detect and respond to failure?
- 04
Does runtime evidence show the control operating?
Evidence model
Evidence is assembled around the claim—not the folder structure.
Defined claims and decision context
Collected, attributed, challenged, and connected to the exact system boundary under examination.
Versioned system and dependency record
Collected, attributed, challenged, and connected to the exact system boundary under examination.
Direct observations and reproducible tests
Collected, attributed, challenged, and connected to the exact system boundary under examination.
Contradictory, missing, and residual evidence
Collected, attributed, challenged, and connected to the exact system boundary under examination.
Intended outcome
A grounded view of control effectiveness, dependencies, blind spots, residual risk, and the conditions operators must continue to monitor.
Professional boundary
What an opinion does—and does not—mean.
It provides
A traceable independent conclusion on defined claims, grounded in the evidence and system state examined.
It does not provide
A guarantee that failure is impossible, a permanent certification, or a conclusion beyond the stated scope and validity conditions.