Attestation of non-occurrence

Throughout your audit preparation, your organization may encounter a scenario where you have designed a control, but there have been no instances of the control occurring. In other words, there is simply no sample to show an auditor.

Specifically, this scenario may be caused by:

• No instance of a control occurring during the audit period

  • Example: no recent security incidents have occurred

• Your organization has designed a control and considers it to be in place, but it is too soon for an example

  • Example: a newly designed performance review process has not yet occurred

  • Note: In this scenario, the control should occur at least within the next year, so you should have evidence to provide for your subsequent audits.

In either of these cases, Strike Graph recommends utilizing an "Attestation of Non-Occurrence" to provide the auditor with the necessary information.

Questions?

Reach out through our chat feature for real-time Customer Success support 8 AM-5 PM PT Monday through Friday.