Continuous monitoring beats the annual snapshot

An auditor samples twenty-five change records from the year and checks each was approved. All twenty-five pass. The control is deemed effective.

What that establishes is that twenty-five of several thousand changes were approved. It says very little about the other few thousand, and nothing at all about whether the control was failing for a month in the middle.

Test the population, not a sample

Sampling exists because manual testing is expensive. When the test is a query, it costs the same to run against everything:

-- deployments without a linked approval, this period
SELECT d.id, d.deployed_at, d.actor
  FROM deployments d
  LEFT JOIN approvals a ON a.change_ref = d.change_ref
 WHERE a.id IS NULL
   AND d.deployed_at >= :period_start

Run it nightly. The result is not a pass or a fail — it is the exact list of exceptions, dated, which is both the test result and the remediation queue.

Store the run, not just the outcome

control_runs
  control_id
  ran_at
  population_size
  exception_count
  exception_refs      -- the actual failing ids
  query_version

Twelve months of these is a far stronger artefact than a single tested sample. You can show the control was effective every day, and where it was not, exactly which items failed and what happened to them.

query_version matters more than it looks — an auditor will ask whether the test changed during the period, and a version column answers it.

Expect a non-zero exception rate

A control that never produces exceptions is usually not testing anything. Real processes have emergency changes, break-glass access, and genuine mistakes. The healthy pattern is a small number of exceptions, each with a recorded justification.

Zero exceptions across a year is a signal the query is wrong, not that the organisation is perfect.

What changes for the audit

The engagement stops being a data collection exercise. The auditor gets a year of dated runs against full populations, plus the exceptions and their dispositions.

That is a stronger position than any sample, and it took no additional effort during the audit — because the work happened nightly, all year, in a job nobody had to think about.