A test covers a period, not a date
Your access review completed cleanly in late October. The auditor signed off on the sample, the evidence package was filed, and the control looked solid. Then, in mid-November, the identity team migrated from one directory service to another and quietly rebuilt the role assignment logic. The audit period runs to December 31.
The test you completed does not cover that. A test of controls establishes that the control operated as described during the interval the test examined — not during the remainder of the period after testing concluded. Period coverage and test completion are different things. Conflating them is the error that produces qualified opinions and corrective action requests during fieldwork.
This article starts where your control program (documented in GRC-FOUND-002) ends: you have an inventory, you have ownership, you have evidence standards. What you need now is a structured answer to the question every auditor eventually asks — "What do you have for the months you didn't test?"
What the tested items actually license
A completed test licenses one specific conclusion: that the evidence examined demonstrated the control operated in a defined way during the sampled interval. That conclusion does not automatically extend forward in time, and it does not cover systemic changes that occurred after the test window closed.
Under PCAOB AS 2315, sample size for a test of controls is calibrated to three factors: the tolerable rate of deviation, the expected rate of deviation, and the allowable risk of assessing control risk too low. (Source: PCAOB AS 2315, https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315) None of those factors account for what happens to the control after the sample was drawn. The sample speaks to its own interval.
This framing matters for GRC managers because the temptation in audit preparation is to treat a clean test as a clean period. It is not. The test licenses an inference about the sampled period; it does not certify the untested remainder. What the tested items actually license is the floor of your coverage argument — not the ceiling.
Test question for your evidence package: Can you draw a line between the last date your test evidence covers and the last day of the audit period? If anything changed on the control side of that line, you have a gap that requires a documented procedure.
The gap between test date and period end
In most assurance engagements, testing occurs before the period closes. That gap — between the last evidence date and the period-end date — is normal and expected. What is not acceptable is leaving it unaddressed.
The consequence of an undocumented gap is that the auditor fills it with their own inference, which is rarely favorable. A gap with no procedure attached reads as absence of evidence, not evidence of absence. In environments where audit periods run six to twelve months, the gap between test completion and period end can represent a material fraction of the coverage obligation — and closing it with documentation is the GRC manager's responsibility, not the auditor's.
NIST SP 800-53 Rev. 5 control CA-7 requires a continuous monitoring strategy that defines assessment frequencies and requires ongoing control assessments in accordance with that strategy. (Source: NIST SP 800-53 Rev. 5, https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) A control that operates continuously still requires assessment on a defined cadence. The gap between your last test and period end is precisely the interval CA-7's assessment cadence is designed to address. If your assessment cadence does not cover the tail of the period, the gap is a finding waiting to happen.
The gap becomes an audit liability: when the period end is more than a defined interval past the last evidence date (what that interval should be is a risk and policy judgment, not a universal rule); when a change occurred in the gap; or when no monitoring record bridges the interval.
Roll forward as a procedure with its own evidence
Roll-forward testing is the procedure that closes the gap between the last tested date and the period end. It is not a re-run of the original test. It is a targeted examination of the untested interval, designed to confirm that the control continued to operate without material deviation after the original sample period closed.
Roll-forward procedures require their own evidence. That evidence should, at minimum, demonstrate that the control remained in its tested configuration, that no exceptions were identified by the roll-forward procedures performed, and that the same owner remained accountable for the control. Note the wording: no exceptions identified is a narrower claim than none occurred, and it is the defensible one unless the procedure provides complete observation of the interval. The evidence standard for roll-forward work is the same standard documented in GRC-FOUND-002 — it is not a lighter-weight substitute.
What roll-forward cannot do is repair a gap caused by a control change. If the control itself changed during the roll-forward interval, the roll-forward procedure applies to the changed control's operation — and the period before the change still requires separate coverage (or a documented limitation). See When The Control Changed Mid Period below.
A useful structural test: can you produce a timeline showing, day by day or week by week across the untested interval, what evidence confirms the control operated? If that timeline has blank stretches, the roll-forward is incomplete. The continuous evidence collection infrastructure that GRC-AUDIT-002 describes is the operational answer to this problem — this article addresses what you document when that infrastructure was not running, or ran but produced a gap.
When the control changed mid period
This section is the thesis of the coverage problem. A changed control is a new control for coverage purposes when the change touches something the conclusion depends on — the control's design, the population it covers, the evidence it produces, how it is operated, or the assertion being tested. A change that touches none of those — a renamed field, a reformatted report — does not create a new test object; record it and say why the tested conclusion still holds. Where the change does touch one of them, the tested version and the post-change version are not the same subject, and evidence collected on the original does not carry across. The size of the change is not the test; what the change touches is.
NIST SP 800-137 directs that monitoring and assessment frequencies be determined by organizational risk tolerance. (Source: NIST SP 800-137, https://csrc.nist.gov/publications/detail/sp/800-137/final) A control change is precisely the kind of event that risk tolerance is calibrated to detect and respond to. When a control changes mid-period, the assessment obligation resets for the changed version.
The practical consequence: if your access review control changed in November — new system, new role logic, new evidence format — your October test result covers October's control. The November-forward interval requires its own test against the changed control design. That test carries its own evidence, its own sample, and its own conclusion. If the changed control was not tested before period end, you have a coverage limitation that must be documented.
The control question: Does your change management process require a GRC notification when a control changes mid-period? If it does not, coverage gaps can accumulate undetected until fieldwork surfaces them. That notification linkage is a policy design question (GRC-FOUND-002 owns the ownership and change notification model).
What period coverage cannot establish
Period coverage, even when complete, cannot establish that a control will operate correctly in the future. It establishes what occurred during the defined interval. Future operating effectiveness is outside the scope of any period opinion.
Coverage also cannot establish that an untested exception did not occur. If your monitoring produced no alert and your evidence captured no deviation, that is evidence the control operated — but only to the extent your detection capability was functioning. A gap in monitoring is not the same as confirmed operation.
Coverage cannot substitute for control design adequacy. A poorly designed control that operated consistently during the period is still a poorly designed control. GRC-FOUND-003 addresses the failure patterns — policy-as-evidence and framework coverage theater — that can make a period look covered when the underlying control is not fit for purpose.
Finally, coverage cannot establish that the right party was accountable at every point in the period. If control ownership transferred mid-period without a documented handoff, the coverage argument for the post-transfer interval depends on whether the new owner's actions are traceable to the control. Gaps in accountability chains are a common finding in periods that span organizational changes.
The coverage test
Before submitting an evidence package for any period, run this structural check:
- Draw the timeline. Mark the first day of the period, the last date of test evidence, and the last day of the period. If there is space between the last evidence date and period end, that space requires a documented procedure.
- Identify changes. Did the control design, system, owner, or evidence source change at any point in the period? Each change point resets the coverage obligation for the post-change interval.
- Confirm roll-forward evidence. For every gap, is there evidence — not assertion — that the control operated? Evidence means records the auditor can examine, not narrative descriptions.
- Document limitations explicitly. If any interval has no adequate evidence, document the limitation before the auditor finds it. A documented limitation with a remediation plan is a different conversation than a gap discovered during fieldwork.
Period coverage table
| Situation | What the original test established | What remains uncovered | Procedure required | What it still cannot establish |
|---|---|---|---|---|
| Test completed mid-period, no changes | Control operated as designed during the tested interval | The interval between last test evidence and period end | Roll-forward testing with independent evidence for the untested tail | That no undetected exception occurred in the uncovered interval |
| Control changed after testing | That the pre-change design operated during the test window | The entire post-change interval, regardless of how similar the new design appears | Separate test of the changed control covering the post-change interval | Equivalence between the pre-change and post-change control designs |
| Control owner changed mid-period | The prior owner's actions during the tested period | Accountability chain from the transition date forward | Documented handoff record and evidence of new owner's operation of the control after transfer | That the new owner performed the control identically to the prior owner |
| System migrated mid-period | Operation on the original system during the pre-migration interval | Control operation on the new system from migration date to period end | Test of the control on the new system covering the post-migration interval; migration change record | That the control design on the new system is equivalent without a separate test |
| Evidence source retired mid-period | What the original evidence source captured during its operational period | Any interval after the evidence source was decommissioned without a replacement | Documentation of the transition, identification of the replacement evidence source, and evidence from the replacement covering the remaining interval | That evidence collected under different methods is directly comparable without a gap analysis |
| Period extended after testing | Control operation during the originally anticipated period | The extension interval — all days between the original period-end date and the revised end date | Roll-forward or additional test coverage for the extension interval with its own evidence | That the extension interval is covered by evidence scoped to the original period |
Compliance framework mapping
SOC 2: A Type II period opinion asserts effective operation throughout the stated period, so gap coverage is the evidence foundation for that assertion — an untested interval with no roll-forward procedure is a limitation that the auditor may surface as a qualified opinion or an exception.
NIST SP 800-53 Rev. 5, CA-7: Requires a defined monitoring strategy with explicit assessment frequencies and ongoing control assessments in accordance with that strategy. (Source: NIST SP 800-53 Rev. 5, https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) A coverage gap in the control assessment record is a direct gap against CA-7.
FedRAMP and PCI DSS: A FedRAMP Authorization to Operate is an authorization decision informed by a security assessment and supported by ongoing continuous monitoring — not a point-in-time assessment. A PCI DSS Report on Compliance reflects the state of the cardholder data environment at the time of assessment, with ongoing obligations extending beyond it. Neither framework produces a period-coverage opinion in the SOC 2 sense. Coverage procedures for these frameworks address ongoing obligation fulfillment and monitoring continuity, not a defined-period assertion. Do not analogize coverage methodology between these and a SOC 2 Type II engagement.
Documentation recommendation: For each coverage procedure — original test, roll-forward, post-change test — maintain a coverage log that records the procedure type, the interval it covers, the evidence reference, the owner who provided evidence, and the date the procedure was completed. That log is the artifact the auditor examines to confirm no interval is asserted without a procedure backing it. Keep it as a living document throughout the period, not a retrospective reconstruction at fieldwork.
Sources
- PCAOB AS 2315: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315
- NIST SP 800-53 Rev. 5: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
- NIST SP 800-137: https://csrc.nist.gov/publications/detail/sp/800-137/final
