Each cycle, confirm whether each control is really in place. Your confirmations set the unit's residual risk.
Steps
On the unit screen, click Confirm on the control.
Choose its status (see the table below).
Add an evidence reference if you have one (a document name, a ticket number).
Give a rationale and save.
Status | Means | Effect on residual risk |
|---|---|---|
Confirmed | In place and working | Full strength (100%) |
Partial | In place but not fully effective; you say how effective, from 1 to 99% | Strength × your percentage |
Not in place | Not happening | None |
Not applicable | Doesn't apply to this unit | None |
If your tenancy wants proof first
Your tenancy settings can say that a control can't be Confirmed or Partial until testing has signed off a test of it (optionally, a test from this cycle). If so, use Test it first. Not in place and Not applicable are always allowed.
Each cycle starts fresh
Confirmations belong to a cycle. When the unit comes round again, every control starts as needs review, so nothing is carried over without someone looking at it. The control's confirmation history keeps every past confirmation.
Confirmed isn't proven
A confirmation is your judgement. Testing checks it. If a test of a control you confirmed fails, Conform flags the difference ("claimed vs proven") and proposes a change for your next assessment. See Proposals from testing.