Control Owner Attestation Template: quarterly sign-off with linked evidence

A control owner's signature is only worth something if it says exactly which control, for which period, on what evidence, and what went wrong. Many organisations run quarterly attestations that ask owners to tick "operating effectively" against a list of control names, with no evidence link and no route for reporting exceptions; auditors then place little weight on them and the executives who sign annual certifications have nothing solid underneath. This template gives [Organisation] a ready-to-use quarterly attestation procedure and form: who attests, what each statement means, the evidence that must be linked, how exceptions and changes are reported, and how sign-offs roll up to executive and regulatory certifications such as the NYDFS Part 500 annual certification or SOX management certifications. It is for GRC, internal control and compliance teams and the control owners they support.

How to use this template

• Replace the bracketed values: [Organisation], [GRC team], [Control library], [Evidence repository], deadlines and escalation contacts. Cadences and deadlines shown are NHI Mgmt Group recommendations unless a rule is cited.
• Attest per control, not per owner. Each control in the library gets its own attestation record, even when one person owns many controls. Section 5 gives the record fields.
• Run it in a system with history. A GRC platform, ticketing workflow or restricted workbook with version history, so each sign-off is timestamped and cannot be edited afterwards.
• Treat attestation as management's self-assessment, not as testing. PCAOB AS 2201 paragraph .50 notes that inquiry alone does not provide sufficient evidence about a control's effectiveness; an attestation is a structured form of inquiry, so it must link to evidence and sits alongside independent testing (section 9), never in place of it.
• Map for audit: NIST SP 800-53 Rev. 5 CA-2 Control Assessments, CA-7 Continuous Monitoring and CA-5 Plan of Action and Milestones; NIST CSF 2.0 GV.RR-02 (roles, responsibilities and authorities) and GV.OV-03 (performance evaluated and reviewed).

1. Purpose

1.1 This procedure requires the owner of each control in [Control library] to confirm each quarter whether the control was designed and operated as documented during the period, to link the evidence supporting that statement, and to report exceptions, changes and open remediation.

1.2 The attestations provide input to: management's assessment of internal control; executive sub-certifications; the [Board risk committee] control report; regulatory certifications such as 23 NYCRR 500.17(b); and external audit and certification planning.

2. Scope

2.1 In scope: every control marked "key" or "attestable" in [Control library], including IT general controls, security controls, privacy controls and identity controls covering human and non-human identities.

2.2 Period: calendar quarters ending [31 March, 30 June, 30 September, 31 December]. Attestations cover the whole quarter, not just the day of signing.

2.3 Controls operated by a third party are attested by the internal relationship owner, who links the provider's assurance report (for example a SOC 2 Type 2 report and its bridge letter) and confirms the complementary user entity controls [Organisation] operates. See the Third-Party Attestation Comparison Map.

2.4 Out of scope: controls retired during the quarter (record the retirement date and approver instead) and controls not yet in operation (record the go-live date).

3. Roles and responsibilities

3.1 Owners are named individuals, never team mailboxes. When an owner leaves or changes role, the [GRC team] reassigns the control within [10] working days and the new owner attests for the whole quarter, reviewing evidence from before they took over.

3.2 The owner must not be the only person checking their own work for high-risk controls: where the owner also performs the control, the domain head reviews the evidence. See the Segregation of Duties Guide.

4. Attestation statements

4.1 For each control the owner selects one overall conclusion and answers the supporting statements. Wording should be used as written so results can be compared across quarters.

4.2 Supporting statements (answer yes or no, with comment for any "no"):

1. The control description, frequency and performer in [Control library] are accurate.
2. The control was performed at the documented frequency for every occurrence in the quarter.
3. Evidence of each occurrence (or of the sample defined in section 6) is stored in [Evidence repository] and linked below.
4. The population the control covers (systems, accounts, changes, vendors) was complete; how completeness was confirmed is stated.
5. All exceptions identified by the control were followed up and resolved or tracked.
6. Any tool, report or query the control depends on was unchanged, or changes were tested.
7. No changes in people, systems or process during the quarter affected the control, or they are described.
8. Open findings from audit, testing or prior attestations are listed with current status.

4.3 The design versus operation split matters: AS 2201 paragraphs .42 and .44 distinguish whether a control would meet its objective if performed as prescribed from whether it actually operated as designed. Statement 1 covers design; statements 2 to 6 cover operation.

5. Attestation record fields

5.1 Sign-off statement shown to the owner: "I confirm that, to the best of my knowledge and based on the evidence linked, the answers above accurately describe the design and operation of this control for the period stated, and that I have reported all exceptions and changes known to me."

6. Evidence standards

6.1 Evidence must show that the control happened, when, by whom and over what population. Acceptable evidence, from strongest to weakest, follows the AS 2201 ordering of re-performance, inspection, observation and inquiry: system-generated records and reports with run dates; signed or approved tickets and workflow records; timestamped screenshots showing the system clock and parameters; written confirmations only as a last resort.

6.2 For each recurring control, the owner keeps: the population with the query or report used and its run date; the output of the control (the review decisions, the approval records); and evidence of follow-up on items found.

6.3 Where a control runs many times (for example each change or each joiner), the owner links the full log and [GRC team] selects a sample using [sampling table]. Owners do not choose their own samples.

6.4 Evidence containing personal data or secrets is stored in [Evidence repository] with access restricted to the owner, [GRC team] and auditors; secrets are redacted. See the Audit Evidence Request Tracker Template.

6.5 Evidence is retained for [the longest applicable period]. 23 NYCRR 500.17(b) requires covered entities to keep the records supporting the annual certification or acknowledgment for five years.

7. Exceptions, changes and remediation

7.1 Each exception has a record: control ID, occurrence affected, description, cause, whether a compensating control operated, impact assessment, remediation owner and target date.

7.2 [GRC team] and the domain head classify each exception using [deficiency classification], distinguishing an isolated exception from a control deficiency. See Audit Exception vs Control Deficiency.

7.3 Deficiencies go to the plan of action and milestones (NIST SP 800-53 CA-5) or [Risk register], with an owner and date. Accepted risks require approval at the level set in [Risk acceptance policy]. See the Risk Register Template.

7.4 Design changes (conclusion D) trigger an update to the control library within [30] days and a design review by [GRC team] before the next quarter.

7.5 Exceptions reported by owners are not penalised. Exceptions found later by testing that the owner had attested as "no exceptions" are reported to the domain head and tracked as an attestation quality issue.

8. Timeline, non-response and escalation

8.1 A control with no attestation by day 20 is reported as "not attested" in the roll-up. It is never carried forward from the previous quarter.

8.2 Repeated late or unsupported attestations by the same owner are raised with their line manager and may lead to reassignment of the control.

9. Independent review and testing

9.1 Each quarter [GRC team] re-checks a sample of [10 per cent] of "A" attestations, weighted to high-risk controls, by inspecting the linked evidence. Results feed an attestation accuracy metric (section 11).

9.2 Internal audit tests key controls on its own plan and may use attestation records as a starting point but not as evidence of effectiveness. See the Internal Audit for Cybersecurity Guide.

9.3 External auditors may rely on management's testing only to the extent their standards allow: AS 2201 paragraphs .16 to .19 tie reliance on others' work to their competence and objectivity and require auditors to do more of the work themselves as risk rises. Self-attestations by control owners carry low objectivity, which is why section 6 evidence and section 9.1 re-checks matter.

9.4 Where continuous controls monitoring produces automated results for a control, link the monitoring output as evidence and focus the owner's attestation on exceptions and changes. See the Audit Evidence and Continuous Controls Monitoring Guide.

10. Roll-up to executive and regulatory certifications

10.1 [GRC team] produces a roll-up per quarter: controls attested by conclusion, exceptions and deficiencies by severity, open remediation, not-attested controls and changes affecting internal control.

10.2 Domain heads sign a sub-certification for their domain covering the attestations beneath it. Executives sign only after reviewing the roll-up and open deficiencies.

10.3 Executive certifications must not state more than the roll-up supports. Where controls are not attested or deficiencies are open, the certification or its supporting memo says so.

11. Metrics and review of this procedure

• On-time completion: attestations completed by day 15 and by day 20.
• Evidence completeness: attestations with working evidence links for the full period.
• Attestation accuracy: share of re-checked "A" attestations confirmed by evidence (section 9.1).
• Self-reported exceptions: exceptions raised by owners versus those found later by testing; a healthy programme sees most found by owners.
• Remediation on time: deficiencies closed by their target date.

11.1 [GRC team] reviews this procedure annually and after any significant audit finding about attestations. Approved by [Chief Risk Officer] on [date]. Version [x.y].

Implementation guidance

1. Clean the control library first: every attestable control needs an owner, performer, frequency, population source and evidence definition. Attesting against vague control descriptions produces vague answers.
2. Pilot one domain for one quarter: pick identity and access or change management, run the full cycle, re-check every "A" answer and adjust the questions before scaling.
3. Pre-fill from systems: populate populations, occurrence counts and open findings automatically where the IGA, ticketing and GRC tools allow, so owners confirm and explain rather than retype.
4. Train owners on what "effective" means: a 20-minute briefing with a good and a bad worked example of conclusion B does more than a long policy.
5. Include machine identity controls: service account ownership and credential rotation controls fit the same cycle. See the NHI Ownership Attestation Campaigns Guide.
6. Scale for size: a small organisation with 40 controls can run this in a shared workbook with version history and one reviewer; a large one needs a GRC platform, domain sub-certifications and sampling.

Common failure patterns to avoid: attesting to a list of control names with no evidence; carrying last quarter's answer forward; owners who left months ago still on the record; "no exceptions" from owners whose own tickets show missed reviews; and executives signing annual certifications without seeing the quarterly exceptions.

Related NHI Mgmt Group resources: Audit, Assurance and Compliance Guide · NYDFS Part 500 Annual Certification Checklist · NHI Ownership Attestation Campaigns Guide · Audit Evidence and Continuous Controls Monitoring Guide