Control Attestation Agent
Finds the controls that exist on paper and nowhere else
6 of 9 controls failed their last test or are overdue for attestation.
9 controls checked. 6 are flagged for 14 points; the longest gap is 59 days.
Start with IR-01 Incident drill. The owner with the most flagged controls is Dana.
A passing test does not prove a control is well designed: that needs an assessor.
Why rows were flagged
- Attestation overdue67%
- Last test failed33%
Value flagged by Owner
- Dana2
- Yusuf1
- Sara1
- Omar1
- Lina1
Items to act on, worst first
| Item | Owner | Value | Days past attestation | Why |
|---|---|---|---|---|
| IR-01 Incident drill | Yusuf | 3 | 59 | Last test failed |
| AC-02 Privileged access | Dana | 3 | 20 | Last test failed |
| HR-01 Joiner/leaver checks | Sara | 2 | 50 | Attestation overdue |
| CM-02 Emergency changes | Omar | 2 | 41 | Attestation overdue |
| AC-01 User access review | Dana | 2 | 31 | Attestation overdue |
| BC-01 Backup test | Lina | 2 | 31 | Attestation overdue |
What to do this week
- Fix and retest IR-01 Incident drill first: its last test failed.
- Ask Dana to attest every overdue control this week.
- Schedule attestations on the calendar with the control owner, not from memory.
Do
- Fix the highest-risk item first, then run the check again on fresh data.
Don't
- Don't act on one row alone: open the source record first.
How to improve
- Add more detail per row (owner, date, source) so the next report can trace each item.
- Add a second period of data so the next report can show whether things are improving.
Demo
Overview
Compliance programmes accumulate controls. Each was created for a real reason, written into a policy, assigned an owner and a frequency, and then left. Nobody removes one, because removing a control means explaining why it is unnecessary — harder than leaving it. The register grows every year and the capacity to perform them does not.
What follows is predictable. Controls owned by people who left. Controls performed but never evidenced, which is indistinguishable from not performed when an auditor asks. Quarterly controls performed twice a year. Controls requiring an independent reviewer where the reviewer is the person who did the work — the segregation failure that turns a control into paperwork. And attestations signed in bulk on a deadline, which is a signature rather than a check.
The dangerous version is the documented control nobody performs, because the organisation believes a risk is covered when it is not. An undocumented gap is at least known.
This agent reads the register against what was actually done and reports which risks are covered only on paper. It never asserts that a control was effective — that judgement requires evidence and accountability belonging to a person who signs their name to it.
Benefits
You know which risks are actually covered
Rather than which ones have a policy about them.
Findings before the auditor's
And a register you can defend.
A case for removing controls
The ones nobody performs and nobody misses.
What it does
Finds controls that exist only on paper
The dangerous kind. The organisation believes a risk is covered when it is not, and an undocumented gap is at least known.
Separates performed from evidenced
A control performed and never evidenced is indistinguishable from one never performed, when asked.
Catches self-review
An independent check performed by the person who did the work. The control exists and does nothing.
Detects bulk attestation
Forty sign-offs in one minute on a deadline is a signature, not a check.
Finds orphaned controls
Owned by someone who left. Nobody notices, because a control with no owner produces no complaints.
Asserts no effectiveness
Whether a control worked is a judgement someone signs their name to. It reports what was done.
What this changes
What this changes about your week
- It takes over
- Checking whether documented controls are actually performed and evidenced.
- Done today by
- Attestation, which is a signature rather than a check.
- How often
- Quarterly, on a deadline.
- Typical manual effort
- Every control cross-checked against performance records, owners and independence.
Why Compliance & Risk in particular. A documented control nobody performs is worse than no control, because the organisation believes a risk is covered. An undocumented gap is at least known.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Control Attestation Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- The control register: control, owner, frequency, independence requirement
- Performance records with dates and who performed them
- Attestation records with timestamps
- Current staff list
- Requires the All-Access plan or higher
Use cases
Quarterly control review
What was performed, evidenced and by whom.
Before an audit
The gaps a reviewer would open with.
After a reorganisation
Which controls lost their owner in the move.
Rationalising a register
Which controls earn their place.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it decide whether controls are effective?
No. Effectiveness is a judgement with accountability attached to whoever signs it. This reports whether a control was performed, evidenced, and by someone independent — the facts that judgement needs.
Does it perform or sign off controls?
Never. It signs nothing, attests to nothing and closes nothing. A control signed by an agent is not a control.
Does it judge individuals?
No. It reports control-level findings. Where a pattern involves one owner it reports it as a capacity or design question, because a person owning forty controls is a register problem, not a personal one.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent